Surveillance pricing raises significant privacy and consumerprotection risks, as it may involve harvesting and extracting maximum value from individual consumers’ personal data, often without their knowledge or meaningful consent.

Read on to learn more about the legal landscape and concrete takeaways for businesses aiming to stay on the right side of privacy law.

]]> On September 1, 2026, the U.S. Department of Justice (“DOJ”) announced a $2,042,518 False Claims Act (“FCA”) settlement with Honeywell Aerospace Inc. (“Honeywell Aerospace” or “Honeywell” or “the company”), resolving allegations that the company failed to comply with certain cybersecurity requirements in a contract with the U.S. Department of War (“DoW”). This settlement is the latest in a growing line of enforcement actions under DOJ’s Civil Cyber-Fraud Initiative and underscores the government’s continued willingness to use the FCA to hold defense contractors accountable for apparent failures to comply with cybersecurity-related requirements.

As envisioned following debate in the state legislature’s privacy subcommittee, SB 690 would eliminate the private right of action for pen-register and trap-and-trace claims under California Penal Code Section 638.51. These claims allege that a business’ act of gathering standard IP addresses, device identifiers or similar metadata constitutes an illegal pen-register or trap-and-trace device. Of particular note, the proposal carries a retroactive component whereby any claims initiated in the two years preceding enactment would be barred outright.

SB 690 would not be a comprehensive solution for businesses facing these claims as it does not address CIPA’s wiretapping provisions or claims brought under other statutes, such as the Electronic Communications Privacy Act, or brought under common law.

For companies, prudent next steps include evaluating their website technologies, privacy policy and consent management platform (if any), and assessing ways to mitigate their exposure. Companies should also keep a close watch on both SB 690 as well as case law that continues to develop.

More sweeping reform may prove necessary down the line, but SB 690 would represent genuine and welcome progress.

]]> California Senate Bill 690 (“SB 690”) continues to advance in the California state legislature. SB 690 seeks to limit litigation brought pursuant to the California Invasion of Privacy Act (“CIPA”) given the avalanche of website technology litigation, which continues unabashedly. While SB 690 has been scaled back since its first introducion in February 2025, it would still have a meaningful impact on businesses faced with these lawsuits.

As envisioned following debate in the state legislature’s privacy subcommittee, SB 690 would eliminate the private right of action for pen-register and trap-and-trace claims under California Penal Code Section 638.51. These claims allege that a business’ act of gathering standard IP addresses, device identifiers or similar metadata constitutes an illegal pen-register or trap-and-trace device. Of particular note, the proposal carries a retroactive component whereby any claims initiated in the two years preceding enactment would be barred outright.

SB 690 would not be a comprehensive solution for businesses facing these claims as it does not address CIPA’s wiretapping provisions or claims brought under other statutes, such as the Electronic Communications Privacy Act, or brought under common law.

For companies, prudent next steps include evaluating their website technologies, privacy policy and consent management platform (if any), and assessing ways to mitigate their exposure. Companies should also keep a close watch on both SB 690 as well as case law that continues to develop.

More sweeping reform may prove necessary down the line, but SB 690 would represent genuine and welcome progress.

Read on for an analysis of how existing discovery rules already reach AI-generated content, the sanctions companies may face for failing to preserve it and the practical steps clients should take now to close the gap.

The ALPR Statute’s Private Right of Action

California’s ALPR Law requires operators and end-users to maintain reasonable security procedures and to implement and publicly post a usage and privacy policy addressing various topics. Section 1798.90.54 of the ALPR authorizes a private right of action for “an individual who has been harmed by a violation” to recover actual damages or at least $2,500 in liquidated damages, plus punitive damages, attorney fees, and injunctive relief.

What the Plaintiff Alleged

The plaintiff alleged that Digital Recognition Network tracked his license plate and maintained a privacy policy only as “lip service.” Critically, his own ALPR data was never breached, accessed without authorization, or misused. The trial court granted summary judgment, and the Fourth District affirmed.

The court reasoned that Section 1798.90.54(a)’s text—“harmed by a violation”—requires more than a bare statutory violation. The statute identifies, but plaintiff could not establish, any of the three illustrative harms (unauthorized access, unauthorized use, or a breach of security).

The court distinguished Bartholomew v. Parking Concepts, Inc., 118 Cal.App.5th 438 (1st Dist. 2026), a decision we discussed in a prior article, on the basis that the defendant’s complete failure in that case to post any ALPR policy satisfied the requisite harm. Comparatively, in Mata, the defendant maintained a policy and plaintiff’s theory that the policy was insincere, or that mass collection itself invades privacy, was insufficient.

Practical Significance

Mata highlights a potential, though likely factual, standing defense for ALPR defendants if plaintiffs cannot identify an actual misuse, breach, or unauthorized access of their specific data. However, it also does not appear to disturb Bartholomew’s holding that a complete failure to post a compliant policy remains actionable.

Businesses that operate or use ALPR systems should have a compliant, publicly posted usage and privacy policy that matches what they actually do. If a business says one thing in its policy but does another in practice, that gap could still expose it to liability, even under the Mata decision.

The case, Bartholomew v. Parking Concepts, Inc., 118 Cal. App. 5th 438 (1st Dist. Feb. 5, 2026), as modified on denial of reh’g (Feb. 27, 2026), review denied (May 13, 2026), has driven a new wave of putative class action filings, plaintiff recruitment campaigns, and investigations into ALPR operators and vendors, including shopping malls, hotels, office parks, and medical centers.

Businesses using an ALPR system, even those that maintain only a single camera or collect ALPR information from only a single, easily avoidable location, may be sued under the statute without sending a pre-suit cure notice. Importantly, a court may award “[a]ctual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500),” as well as punitive damages, attorney fees, and injunctive relief. Cal. Civ. Code § 1798.90.54(b).

The ALPR Statute’s Requirements

Under Section 1798.90.51(b), an ALPR system operator must implement a usage and privacy policy that ensures “the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties.” The statute requires various disclosures to be listed in the policy, including why the operator uses the ALPR system to collect information, how and why the operator may share information with third parties, how the operator will ensure the accuracy and security of the information, and how long the operator will retain the information.

The statute does not define the authorized purposes for using an ALPR system nor prescribe how an operator should protect or share ALPR information. Rather, the statute requires transparency: an operator must make the policy “available to the public in writing” and, if the operator has a website, post the policy conspicuously on that website.

Section 1798.90.53(b) also has substantially similar requirements for ALPR end-users with some subtle differences covering the access of ALPR information, the designation of an owner of ALPR information, and the implementation of a process for periodic system audits.

Subsequent Class Action Lawsuits

Following this appellate decision, there has been a noticeable increase in putative class actions filed across California courts. ALPR operators and end-users in high-traffic areas, such as healthcare facilities and retail chains, are particularly vulnerable to inflated class sizes (or mass arbitration actions) due to the potential recoverable statutory damages.

Recommendations for Compliance

Businesses using an ALPR system, whether as an operator or an end-user, should first ensure they have an ALPR usage and privacy policy in compliance with this law. Businesses should also confirm whether vendors receive ALPR information and implement contractual safeguards with them to mitigate any potential violations of this law.

The suspension aligns with Secretary of War Pete Hegseth’s Acquisition Transformation System directives and the broader “Arsenal of Freedom” initiative. Critically, the action does not relieve contractors of their underlying obligations to protect federal data, which includes the current DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) and the NIST SP 800-171 Rev. 2 security controls upon which the CMMC Phase II requirements are based.

Like every billing system, AI-assisted billing tools can make mistakes. However, AI-assisted systems can scale those mistakes across thousands of claims, and the records those systems generate may make it easier for the government or relators to argue that a provider’s submission of those claims violated the FCA.