AI Moratorium, Bulk Data Controls, and Enforcement Trends

June 4, 2025 Edition of Privacy, Cyber, & AI Decoded

June 4, 2025
Privacy, Cyber, & AI Decoded

To help our clients and readers sort through the volume of privacy, cyber, and AI news, we are switching Privacy, Cyber, & AI Decoded to a summary format.

In this first edition, we look at a proposed 10-year moratorium on state and local artificial intelligence (AI) regulation, new federal restrictions on bulk sensitive data, recent enforcement actions by the California Privacy Protection Agency, and the high-profile sale of 23andMe's genetic database.

10-Year AI Regulation Moratorium

The U.S. House of Representatives has passed the One Big Beautiful Bill Act (H.R. 1), a broad federal budget bill that includes a 10-year moratorium on new state and local governments from regulating AI. The bill is currently under consideration in the U.S. Senate. The likelihood of its passage is uncertain, and if passed, legal challenges are expected based on state rights and preemption.

Bulk Sensitive Data Law

The new Trump Administration has given companies some additional time beyond its April 8, 2025, effective date to comply with the Bulk Sensitive Data Law.

CPPA Data Broker Cases

The California Privacy Protection Agency (CPPA) entered a settlement agreement with Background Alert, Inc. and National Public Data, two data brokers who allegedly violated the Delete Act by failing to register and pay the required annual fee.

CCPA Enforcement Cases

On May 6, 2025, the CPPA announced its second non-data broker enforcement action, requiring a national retailer to pay $345,178 in fines and remedy its violations of the California Consumer Privacy Act (CCPA). Specifically, and as set out in the Stipulated Final Order, the retailer:

In addition to the hefty fine, the retailer agreed to:

23andMe

The genetic testing company, 23andMe, is back to selling its assets in bankruptcy. This deal raises significant concerns from both a privacy and cybersecurity perspective, as the acquisition transfers data from one of the largest private genetic databases.

Intern Elyssa Eisenberg contributed to this post. She is not currently admitted to practice law.