This is part one of a four-part series highlighting key learnings from the IAPP Privacy. Security. Risk. + AI Governance Global conference.

I spent time in Seattle earlier this month at the IAPP Privacy. Security. Risk. + AI Governance Global conference, where much of the discussion focused on how companies are managing the growing overlap between privacy, cybersecurity, and AI. 

One of my biggest takeaways was the growing emphasis on demonstrating that privacy and AI governance programs actually work in practice.

Established companies have already built out privacy policies, incident response plans, vendor review procedures, and, increasingly, AI governance frameworks. The challenge now is making sure those policies translate into effective controls across the business as companies deploy new technologies and expand their use of AI.

I saw concerns about companies' readiness to meet this challenge surface in Seattle in sessions covering consumer opt-outs, AI vendor oversight, and California's new cybersecurity audit requirements.

The California Consumer Privacy Act (CCPA) cybersecurity audits were a particularly frequent topic of conversation. My sense from the discussions is that a lot of companies are still trying to figure out how to approach these audits, how they'll differ from their existing security assessments, whether they can handle the audits internally or need an external auditor, and what they'll need to have in place to demonstrate compliance.

For in-house legal teams, I came away with several developments that warrant attention as we head into 2027.

Privacy Compliance: Making Sure Consumer Choices Are Honored

The session, Consent Fragmentation: The Cross-channel Opt-out Compliance Challenge, addressed a problem I see many clients face. A consumer exercises a privacy choice through one channel, but that choice isn't consistently applied across the company's other systems.

A consumer might opt out of the sale or sharing of personal information through a website, yet the request may not carry through to a mobile application, connected device, or third-party advertising platform.

California regulators are paying attention. In February 2026, the California Attorney General announced a $2.75 million settlement involving allegations that a streaming provider failed to fully implement consumers' requests to opt out of the sale or sharing of their personal information across its services and devices.

Website tracking litigation also remains a concern, although California has made a significant change to the legal landscape.

On Sept. 30, California enacted SB 690, Chapter 976. Beginning Jan. 1, 2027, the law limits private civil actions against private actors under the California Invasion of Privacy Act's (CIPA) pen register and trap-and-trace provision, Penal Code Section 638.51, when the alleged conduct occurs on websites or online and mobile applications. Under the amended civil remedy provision, only the Attorney General may bring those actions.

The amendment also applies retroactively to pending claims in actions commenced within two years before its operative date, meaning actions filed on or after Jan. 1, 2025.

The final legislation is narrower than earlier proposals. It doesn't eliminate other potential CIPA claims, including those involving alleged interception of communications under Section 631. Nor does it eliminate the underlying restrictions on pen registers and trap-and-trace devices.

For legal departments, the work remains much the same: understand the tracking technologies being deployed and verify that consent and opt-out mechanisms operate as intended.

Practical Takeaway

Have your privacy and technical teams test opt-out requests across websites, apps, advertising systems, and third-party integrations. Keep the test results and records of any remediation. Reassess tracking-related litigation exposure in light of SB 690.

What Should In-House Legal Teams Prioritize Over the Next 3, 6, and 12 Months?

Based on the discussions in Seattle and the regulatory developments ahead, I would focus on the following priorities.

Next 3 Months: Before January 2027

Next 6 Months: By April 2027

Next 12 Months: By October 2027

Federal AI preemption efforts, state enforcement activity, and EU AI Act implementation should be monitored throughout this period rather than treated as annual review items.

For companies working through these issues, our team can help with an AI vendor contracting playbook, a pre-audit evidence gap assessment, or a joint AI and cybersecurity incident tabletop exercise.