The new law establishes strong safeguards for sensitive student information and bans AI training on student data, extending California's existing Pre-K through 12th grade student privacy protections to millions of California higher education students.
In the first half of 2026, state agencies and HHS published 5,429 data breach notification filings describing 1,969 breach events and affecting at least 343 million people. A single platform breach at Instructure (Canvas) accounts for nearly 80 percent of that total, and the share of breaches whose cause cannot be determined from the public record has risen to one in three.
Deletion obligations start triggering today for every data broker registered with the California Privacy Protection Agency under the California Delete Act. If you have signed up for the Delete Request and Opt-Out Platform, every registered broker must now delete your information, and again every 45 days.
In force since July 1, 2024, the Oregon Consumer Privacy Act (OCPA) is one of the broadest state privacy laws in what it reaches. Beyond the usual rights to access, correct, delete, and opt out, Oregon lets residents request the specific companies that received their data, extends to the information generated by a person's car, and bans the sale of precise location data outright.