Several years into the CCPA and CPRA regime, most companies have the basics in place: a privacy policy, a cookie banner, and a process for responding to consumer requests. Enforcement activity over the past year, however, has made clear that having the paperwork is not the same as being compliant in practice. The California Privacy Protection Agency and the Attorney General's office have both signaled that they are looking past the privacy policy and into how the business actually operates. Below are the gaps we see most often.

Treating the Privacy Policy as the Compliance Program

A ...

Since the California Court of Appeal decided Cook v. University of Southern California, employers using “including but not limited to” language to define covered claims in their arbitration agreements have faced a familiar argument from the plaintiffs’ bar: that the phrase renders the agreement’s scope unconscionably limitless, and that overbreadth also taints the agreement’s duration and mutuality. The Ninth Circuit’s decision in Cocom v. ABM Aviation, Inc. gives employers an answer to that argument, one that federal district courts within the circuit will now ...

California businesses that experience a data security incident now face a defined 30-day notification deadline under SB 446, a meaningful change from the prior standard, which required notice only “in the most expedient time possible and without unreasonable delay.” The shift from a flexible standard to a hard deadline changes how the first 72 hours of an incident response should be structured, and it raises the stakes for organizations that have not run a breach response before.

Why the Change Matters

Under the prior rule, a business had a defensible argument for taking ...

A letter of intent is meant to be a roadmap, not a finished contract, but the choices made at that stage tend to harden quickly once diligence begins. Buyers and sellers who treat the LOI as a formality often find themselves negotiating from a weaker position later, simply because a term was left vague or assumed rather than addressed head on. Below are five areas that consistently cause friction in middle-market transactions, and that are worth resolving, or at least framing clearly, before the LOI is signed.

1. Earnout Mechanics, Not Just the Earnout Amount

An earnout can bridge a ...

In the recently published opinion in Betanco v. Living Spaces Furniture, LLC, the First District Court of Appeal confirmed that a last-mile delivery driver can qualify as a “transportation worker” exempt from the Federal Arbitration Act even where the sale was retail and the delivery never left California. The First District’s inquiry turned on whether the driver remained part of the continuous movement of goods in interstate commerce from origin through delivery. Because the furniture never left that stream, even after a brief pause at a distribution center, his ...