In the News

State AGs Zero In On China-Linked Data Flows
Lexology, March 2, 2026 by Victoria Hudgens

In bringing claims against data practices of companies linked to China, state attorneys general are beginning to rely more heavily on laws against unfair or deceptive acts or practices (UDAP), instead of data privacy laws. Litigators explain that UDAP claims are easier to prove, have a broader application, bring substantial penalties, and offer certain litigation advantages. However, there may be constitutional preemption challenges to this type of enforcement, as courts may find that states do not have the authority to bring actions motivated by national security or foreign relations concerns. “The federalism argument is that this is a power reserved to the states,” says Paul Schwartz, professor at UC Berkeley School of Law. “While . . . there’s a state role in protecting consumers from unfair trade practices, it does seem that raises very strong foreign-relations issues.”

 

UC Berkeley Division of Academic Senate Urges UC System to Resist Federal Attacks
The Daily Californian, April 29, 2025 by Eleanor Jonas

On April 22, 2025, the Berkeley Division of the Academic Senate passed a resolution to resist attacks on academic and political freedom. Approximately 95% of the 450 faculty members present at the meeting voted to pass the resolution to protect the rights and privacy of students. Safeguarding privacy is crucial as the current administration disregards federal privacy laws to target individuals by cross-referencing university data against other databases containing personal information such as immigration and tax records. “Privacy provides all kinds of fuel for democracy and for people to be willing to speak up and exercise First Amendment rights,” says Paul Schwartz, a contributor to the resolution’s language about privacy. “It’s very important that the University of California stands up and tries to protect the privacy of faculty, staff and students.”

 

It Has Your Money—and Your Pants Size. Here’s What PayPal Is Doing With Them
Wall Street Journal, October 25, 2024 by Imani Moise

Starting on Nov. 27, 2024, PayPal will compile and sell customer purchase data to retailers for targeted advertising. Advertisers find personal financial data like transaction patterns or checking account statements highly valuable because the data can reveal income levels, sources of earnings, and how people spend on specific categories such as child care or political donations. Federal law allows banks and financial-technology firms like PayPal to share vast amounts of customer data with outside parties for marketing as long as disclosure and opt-out requirements are met. “Disclosure requirements were set 25 years ago, and most financial companies use boilerplate language to satisfy legal requirements without adding details about how data is collected and shared,” says Paul Schwartz, co-director of the Center for Law & Technology at the University of California, Berkeley, School of Law. “The best way to give consumers more control over their data would be to switch the opt-out system to an opt-in one, which would require congressional action.”

 

US Privacy Litigation Surges, Though not Because of California Privacy Law, Expert Says
MLex, Mar. 8, 2024 by Mike Swift

The number of data privacy lawsuits filed in federal courts in the US has more than doubled over the past five years, but there’s little evidence the surge of litigation is solving the harms many plaintiffs claim.

Paul Schwartz, a Berkeley law professor, noted at today’s conference the absence of two major institutions from the shaping of privacy litigation – the US Supreme Court and Congress. The key federal wiretapping act, he noted, is nearly 40 years old.

“A lot of this speaks to Congressional gridlock,” Schwartz said. “We have major statutes in this area dating back to 1986. The Congress at that time had no notion of how the Internet was going to develop – how could you? – so [current laws] are quite antiquated in terms of being applied to technology that nobody could dream of at the time.”

The Illinois Supreme Court has been active in shaping interpretation of that state’s most prominent privacy law, the Biometric Information Privacy Act, Schwartz said. But compare that with the US Supreme Court, “which has been largely absent, for better or worse, from the privacy landscape,” he said.