A MoFo Privacy Minute Q&A: Getting Ahead of State AGs’ 2025 Data Security Enforcement Priorities

This is “A MoFo Privacy Minute,” where we will answer the questions our clients are asking us in sixty seconds or less.

Question: In 2024, we saw state attorneys general (State AGs) continue to pursue data security claims against companies. What should we expect from State AGs in 2025, especially with the change of administration, and what should we be doing right now to stay ahead of the curve?

Answer:

In 2024, data security remained top-of-mind for State AGs as they continued to levy hefty fines and to require the implementation of robust compliance programs for organizations they believed had fallen short. This was especially true where State AGs believed an entity had failed to heed warnings about exploitable vulnerabilities. Even with the upcoming change in administration in the United States, we anticipate this trend in enforcement priorities will continue, with an additional focus on data related to new technologies (such as brain wave data captured from a consumer headset) and data that could be used to further some State AGs’ agendas (such as geolocation data that could be used to indicate an individual received reproductive healthcare). 

Now is the time for all organizations to take stock of where they are, both by “going back to the basics” and by ensuring they are keeping up with current and anticipated threats. Organizations should:

• Double check their process to ensure data minimization in terms of what data they capture, store, and share with third parties;
• Validate their information security program, including their incident response plans;
• Revisit their authentication practices, including multi-factor authentication and password hygiene practices;
• Check their logging and monitoring, suspicious activity alerting and threat response procedures, software development lifecycle practices, and password practices; and
• Update or perform appropriate risk assessments, including making sure their documentation of these is refreshed.

It is also especially important to ensure you “know your data.” Organizations should:

• Confirm that their data inventory is up-to-date, including knowing what data is being passed to third parties and how that data is being safeguarded or used by those third parties;
• Account for newly enacted laws that expand the definition of “sensitive data” (see, for example, our Client Alert on California adding neural data to its definition); and
• Think holistically about their data collection and retention practices and review their plan to respond to regulator or law enforcement inquiries seeking access to these data sets (i.e., if an organization holds information regarding gender-affirming medical care, sexual orientation, or gender identity, what steps would be taken in connection with providing the information sought). 

Hebani Duggal, an associate in our New York Office, contributed to the writing of this article.