A Recap of the Key Legal Developments in Q3 And Q4 & What to Expect In 2026

Written By: Kimberlynn Wilson

 

The second half of 2025 was a busy period for employment law and consumer privacy legislation. As 2026 approaches, several laws, ordinances, and regulations enacted this year will come into effect in the upcoming year or in 2027. To ensure compliance and stay informed, let’s review the key legal developments from Q3 and Q4.

 

Data Privacy & Artificial Intelligence (AI)

Biometric Data Privacy Amendment to the Colorado Privacy Act

• The Biometric Data Privacy Amendment to the Colorado Privacy Act became effective on July 1, 2025. Organizations collecting biometric data from residents of Colorado are now required to adhere to several new provisions. These amendments introduce additional obligations, including obtaining explicit consent, implementing a defined data-deletion schedule, and establishing a written incident-response protocol. Read more about the amendment here.

 

California, Colorado, and Connecticut Announced Joint Privacy Enforcement Sweep

• On September 9, 2025, the California Privacy Protection Agency (CCPA) and the Attorneys General of California, Colorado, and Connecticut initiated a coordinated enforcement initiative regarding opt-out rights. The focus of the enforcement is on Global Privacy Control (GPC), a browser setting that automatically signals to companies of a consumer’s preference not to have their personal information sold or shared. The enforcement highlighted that businesses must recognize GPC signals as opt-out requests and that they cannot impose obstacles to opting out. Read more about the enforcement sweep here.

 

California Approved New AI Regulations

• Revisions to Title 2 of the California Code of Regulations became effective on October 1, 2025. These updates address the use of AI-based tools, outline the scope of automated decision-making systems (ADS), specify what constitutes discriminatory use of ADS, require anti-bias testing for ADS, introduce new recordkeeping obligations, and discuss affirmative defenses to employer liability. Read more about the revisions here.

 

Maryland Online Data Privacy Act

• Another law that took effect October 1, 2025 was the Maryland Online Data Privacy Act. (MODPA). The MODPA bans the collection, processing, or sharing of sensitive personal information (SPI) unless it is “strictly necessary to provide or maintain a specific product or service requested by the consumer to whom the personal data pertains.” If an organization processes SPI that falls under the scope of the MODPA, it is recommended they work with qualified legal counsel to review and assess their policies and practices. Read more about MODPA here.

 

Deadline For Data Breach Notifications In California

• Another development in California from October was the signing of SB 446 into law by Governor Gavin Newsom. The new law mandates that businesses notify affected individuals within 30 calendar days of discovering or being notified of a data breach. For breaches impacting more than 500 California residents, organizations must also notify the California Attorney General within 15 calendar days of notifying affected consumers about the security breach. Read more about SB 446 here.

 

RAISE Act

• This month, New York Governor Kathy Hochul signed into law a revised version of the Responsible AI Safety and Education (RAISE Act). The legislation focuses on the risk for catastrophic harm resulting from highly capable AI systems and specifically applies to “frontier models,” the most advanced and sizable AI systems capable of enabling significant real-world risks, including cyberattacks. The law is scheduled to take effect on January 1, 2027. Read more about the RAISE Act here.

 

California Regulations For Businesses Utilizing ADMT

• In addition to the revisions effective in October, the CCPA Board has approved a set of final regulations that will take effect on January 1, 2026. These regulations establish new compliance requirements for businesses utilizing automated decision-making technology (ADMT). They encompass provisions related to notices, appeal rights, opt-out rights, consent, human review, risk assessments, and recordkeeping. Read more about the regulations here.

 

New Obligations For Illinois Employers Using AI For Employment Decisions And Other Workplace – Related Purposes

• Another law scheduled to take effect January 1, 2026 is Illinois’ House Bill 3773, which passed in 2024. This legislation includes amendments to the Illinois Human Rights Act and establishes requirements for employers utilizing AI in hiring, disciplinary actions, termination, or other workplace-related activities. To support the implementation of this law, the Illinois Department of Human Rights (IDHR) is currently developing compliance rules. Read more about the new law and IDHR’s proposed rules here

 

Indiana, Kentucky, and Rhode Island Join The Growing Number Of States With Enacted Consumer Privacy Laws

• Data privacy has been a prominent issue in recent legislative developments and continues to be a focus this year. Three additional states—Indiana, Kentucky, and Rhode Island—join the other 16 states with enacted consumer privacy laws. The Indiana Consumer Data Protection Act, Kentucky Consumer Data Privacy Act, and Rhode Island Data Transparency and Privacy Protection Act will all become effective on January 1, 2026. Kentucky and Indiana’s laws apply to businesses operating within their respective states that process data from at least 100,000 residents annually, or 25,000 residents if the business derives half or more of its revenue from the sale of personal information. Rhode Island’s law applies to companies processing data on 35,000 residents, or 25,000 residents if 20 percent or more of the business’ revenue is generated from selling personal data. Read more about the laws here.

 

Texas Responsible AI Governance Act

• Effective January 1, 2026, the Texas Responsible Artificial Intelligence Governance Act designates Texas as the second state (after Colorado) to implement comprehensive AI legislation. The law applies to organizations doing business in, producing products or services utilized by individuals in Texas, or involved in developing or deploying AI systems within the state. It specifies permissible and prohibited uses of AI systems, and establishes the Texas Artificial Intelligence Council to oversee enforcement and compliance. Read more about the Act here.

 

 

Fair Chance & Clean Slate

Navigating News Of An Employee’s Arrest Or Pending Criminal Charges As A California Employer

• California employers should carefully approach the risks and legal considerations before disciplining an employee who has recently been arrested or has pending charges. California law not only allows employees to pursue damages and recover attorney’s fees through a private right of action, but also limits an employer’s ability to rely on “any record of arrest or detention that did not result in a conviction.” It is recommended for California employers to consult with legal counsel to review their background check policies and practices. Read more here.

 

Expanded Protections Under Washington’s Fair Chance Act

• Earlier this year, Washington Governor Bob Ferguson signed House Bill 1747, which enhances protections for job applicants and employees under Washington’s Fair Chance Act. The new law will take effect on July 1, 2026, for employers with 15 or more employees. Employers with fewer than 15 employees will be required to comply starting January 1, 2027. The law prohibits employers from conducting criminal background checks until after a conditional job offer has been extended. Additionally, it limits the ways in which information obtained from criminal background checks can be used. The law also introduces new obligations related to the pre-adverse and adverse action processes, including the need for a legitimate business reason before taking adverse employment actions, holding the job position open for two business days, and conducting a written assessment. Read more about the new law here.

 

California Increases Enforcement Of The State’s Fair Chance Act

• Recently, the California Civil Rights Department (CRD) has increased enforcement of the California Fair Chance Act (CFCA). The CFCA establishes restrictions for covered employers regarding the timing of criminal history inquiries, the permissible use of criminal history information in hiring decisions, and the obligations employers must follow if rescinding a conditional job offer based on criminal history. In light of the recent increase in CFCA-related litigation and CRD enforcement actions, it is recommended California employers review their policies and practices with qualified legal counsel to ensure full compliance. Read more here.

 

Amendments To Philadelphia’s Fair Criminal Record Screenings Standard Ordinance Approved

• On October 8, 2025, Philadelphia Mayor Cherelle Parker approved amendments to the Fair Criminal Record Screenings Standard Ordinance. The amendments provide additional protections for job applicants and employees by enhancing enforcement and expanding the scope of coverage, definitions and protections. Read more about the amendments here.

 

New Orleans Voters Passed A Fair Chance Amendment

• In October 2025, New Orleans approved a Fair Chance Amendment. This amends the city’s existing Bill of Rights to include a prohibition on discrimination based on criminal history. Additionally, New Orlean’s City Council passed an ordinance that enhances the city’s Ban the Box law, originally passed in 2018. The new ordinance grants individuals the right to pursue civil legal action for damages if they believe they have been “arbitrarily and unreasonably” discriminated against in the hiring process due to their criminal history. Read more about the amendment here.

 

Illinois Clean Slate Law

• Illinois lawmakers approved House Bill 1836 on October 30, 2025. If signed into law, state agencies will have until 2029 to develop and test the automation systems. The initial group of eligible records will be required to be sealed by Illinois State Police by January 1, 2030. Automated sealing by Circuit Courts will be required to begin automated sealing by January 1, 2031. Eligible misdemeanor convictions and ordinance violations will be sealed 2 years after completion of sentence. Eligible felony convictions will be sealed 3 years after completion of the most recent felony conviction sentence. There are several offenses excluded from eligibility including serious violent crimes, sex crimes (including any requiring sex offender registration), DUIs, reckless driving, and cruelty to animals. As of December 30, 2025, the bill has not been signed into law by the Governor. Read more about the new law here.

 

‘Ban the Box’ Laws Remain A Prominent Area Of Focus

• In recent years, numerous states and municipalities have enacted “Ban the Box” legislation. These laws typically prevent employers from requesting criminal history information on job applications and impose limitations on when such inquiries can be made during the hiring process. As these laws are continually implemented and amended, employers should regularly review their operations to ensure compliance if they do business in or employ individuals residing in any of these jurisdictions. Read more here.

 

 

Drug Testing Developments

U.S. DOT Published Proposed Rule On Adding Fentanyl And Norfentanyl To Drug Testing Panels

• The U.S. Department of Transportation (DOT) published a proposed rule in the Federal Register on September 2, 2025, outlining a proposed amendment to its drug testing program regulations. The DOT proposed adding fentanyl and norfentanyl (a metabolite of fentanyl) to the drug testing panels. The objective of adding fentanyl and norfentanyl is to enhance transportation safety and to better align the DOT’s drug testing program with the U.S. Department of Health and Human Services Mandatory Guidelines for Federal Workplace Drug Testing Programs. The public comment period for the proposed rule concluded on October 17, 2025. Read more about the proposed rule here.

 

2025 Quest Diagnostics Drug Testing Index Finds Fentanyl Positivity Higher In Random Tests Than In Pre-Employment Drug Screenings

• Quest Diagnostics released the 2025 Quest Diagnostics Drug Testing Index earlier this year. The report indicated a slight decrease in workplace urine drug positivity rates, declining from 4.6% last year to 4.4%. However, the findings also revealed that fentanyl positivity in random tests was seven times higher compared to pre-employment drug screenings. This suggests that some workers may be using fentanyl after passing initial pre-employment screenings. Read more about the 2025 report here.

 

Executive Order To Reschedule Cannabis Signed

• On December 18, 2025, President Trump signed an Executive Order (EO) to reclassify cannabis from Schedule I to Schedule III. The EO includes a statement in Section 3 that the U.S. Department of Transportation views as supportive of continued testing for THC among safety-sensitive employees in the transportation industry. The EO does not automatically reclassify cannabis; rather, the EO instructs the Attorney General to “complete the rulemaking process.” A 30-day comment period will be held once the rule is issued by the Attorney General. Legal challenges from opponents of the rescheduling are anticipated. Read more about the EO here.

 

 

Miscellaneous Developments

Florida AHCA Required To Develop Public Website Detailing Background Screening Requirements

• Florida recently passed House Bill 531 requiring the Florida Agency for Health Care Administration (AHCA) to develop a public website that details background screening requirements, including who is subject to screening and the procedures for initiating and completing background checks. Additionally, users will have the ability to share their screening number with multiple organizations through the site. The purpose of this legislation is to enhance transparency and improve accessibility throughout the process. Read more about the new website requirement here.

 

CFPB Interpretative Rule On FCRA Preemption

• The CFPB issued an interpretative rule on October 28, 2025 to clarify that the FCRA generally preempts state laws that touch on broad areas of credit reporting. This interpretative rule replaces a July 2022 interpretive rule that the CFPB withdrew in May 2025.Troutman Pepper Locke released a podcast episode covering the interpretative rule and its impact beyond credit reporting. Listen to the podcast here.

 

CFPB Increased Allowable Charges For Consumer Disclosures Under Section 612(f) Of The FCRA

• On December 15, 2025 the Consumer Financial Protection Bureau (CFPB) increased the allowable charges under section 612(f) of the Fair Credit Reporting Act to a maximum of $16.00. Read more here.

 

 

Trends To Watch In 2026

Evolving Legal Compliance

• Laws regarding restrictions on criminal history inquiries (“Fair Chance,” “Ban the Box”), automatic record sealing and/or expungement (“Clean Slate”), and data privacy and AI regulations are anticipated to continue to be key areas of legislative focus.

 

AI & Automation

• More organizations are adopting AI technologies to enhance operational efficiency and productivity. As a result, more companies may be required to adhere to enacted data privacy and consumer protection regulations.

 

Multi-Jurisdictional Challenges

• Companies with remote or hybrid workforces need to determine which state laws apply to their organizations, considering both their operational locations and the residences of their employees. This can be complex, as an increasing number of states are enacting employment and privacy-related laws, each with varying scopes of coverage.