Tech Insights.

California’s newly enacted SB 690 will significantly limit certain claims under the California Invasion of Privacy Act (CIPA) involving website and app tracking technologies. In this article, Jonathan Downing examines the law’s impact on the recent wave of CIPA litigation, what claims it eliminates, and the important risks that remain for website owners and operators.

A significant privacy enforcement action out of California: the California Attorney General and four District Attorneys have proposed a $12.75 million settlement with GM over the alleged sale and retention of drivers’ data. In this article, we explain why the case matters—and why data minimization is emerging as a concrete compliance obligation, not merely a policy principle.

Who is the “volitional actor” when an AI system generates allegedly infringing output?

That question is central to ongoing copyright litigation against Anthropic and Perplexity. The platforms argue that users are responsible because outputs are generated in response to user prompts. Plaintiffs argue that platforms are responsible because they control training data, model architecture, and output constraints. Both positions draw on established copyright law, yet each captures only part of the causal chain.

The problem is that the volitional conduct doctrine was built for a different technological era: photocopiers, DVRs, and passive internet intermediaries where copying was discrete and attributable to a single actor. Generative AI does not work that way. There is also a growing tension in case law: if prompting may be insufficient to establish copyright authorship, can it nevertheless establish volitional conduct for direct liability?

In this new article, Chieh Tung explores why the traditional user-versus-system framework maps poorly onto AI systems where control is distributed across training, design, deployment, and prompting.