Insights

On July 20, 2026, New Jersey Governor Mikie Sherrill signed the Forbidding the Algorithmic Inflation of Rent (FAIR) Act into law, making New Jersey the fourth state to regulate algorithmic rent-setting practices. Three days later, on July 23, 2026, Governor Sherrill signed the Fair Price Protection Act, which targets “surveillance pricing”—the practice of using or collecting personal data about a user and using an algorithm or artificial intelligence to charge different consumers different prices for the same products. Together, these laws represent a significant expansion of New Jersey's consumer protection framework in the algorithmic pricing context.

New York is set to become the first state in the nation to restrict algorithmically-driven “addictive” social media features for users under 18. On July 29, 2026, the State published the final rules implementing the Stop Addictive Feeds Exploitation (SAFE) for Kids Act, which takes effect January 25, 2027.

On July 28, 2026, the Federal Communications Commission (FCC) updated its Covered List, established through the Secure and Trusted Communications Networks Act to include foreign-produced connected power inverters and advanced robotic devices. The designation of these products to the Covered List follows an Executive Branch national security determination that they “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.” Equipment listed on the Covered List is ineligible for FCC equipment authorization, effectively prohibiting the import, sale, or marketing of those products absent an exception or approval. This action comes only months after the FCC added consumer-grade routers to the Covered List on March 23, 2026 and uncrewed aircraft systems (UAS) on December 22, 2025. Taken together, these actions reflect the FCC’s increasingly expansive approach to using its authorities to guard against foreign produced connected technologies that may create vulnerabilities enabling disruption of critical infrastructure, unauthorized access to sensitive information, or cyber intrusions. The shift is a departure from the FCC’s previous focus on equipment and services produced by certain PRC and Russian companies.

Section 230 of the Communications Decency Act (“Section 230”) protects online platforms from liability for user-generated speech. Based on the premise that platforms generally do not create original content but instead curate their users’ own speech, Section 230’s protections have historically applied to a platform’s algorithmically assembled, selected or sequenced content; algorithms or features that amplified or directed user generated speech to particular users were generally protected. Indeed, the old rule of thumb was the more a platform used algorithms or automation, the more likely user generated speech remained user generated speech. GenAI has the potential to change that calculus. A platform that ingests user generated content and publishes a transformed output, can blur Section 230’s line between publication and creation. The central question is whether Section 230 protects GenAI, which analyzes, but does not alter, user-created content to produce an outcome, and its corresponding outputs.

On July 23, 2026, the U.S. Department of Justice’s Antitrust Division announced that it will again use targeted Second Request investigations and released a revised Model Timing Agreement, another signal that this Antitrust Division continues to take a more business friendly approach toward merger review. The model introduces an optional “Expedited Consideration” process that gives merging parties the option to address discrete competitive concerns identified by the DOJ before undertaking full Second Request compliance.

Two federal appellate courts have now looked at analogous allegations of price fixing using AI-driven pricing software and reached opposite conclusions—creating an arguable circuit split and providing additional guidance to companies using algorithmic pricing tools.

The rapid buildout of AI infrastructure has placed data centers at the heart of a new and expanding wave of class action litigation. Over the past several months, plaintiffs’ firms with significant experience in mass tort and environmental class actions have begun recruiting plaintiffs and filing lawsuits against data center operators, alleging that noise generated by their facilities — from cooling systems, diesel generators, and HVAC equipment — constitutes a public and private nuisance and reflects actionable negligence. Companies currently operating or constructing data centers near residential communities should treat this as a material and growing legal risk.

On June 18, 2026, the California Department of Toxic Substances Control (DTSC) added microplastics to the list of Candidate Chemicals maintained under the state’s Safer Consumer Products (SCP) regulations.  The listing of microplastics, which becomes effective on October 1, 2026, is the first step in the SCP regulatory process, which could lead to restrictions on products that contain or release microplastics. 

GAO’s recent dismissal of the protest in Tyonek Technical Innovations, LLC, B-424364, B-424364.2, June 30, 2026, carries an important lesson for government contractors: if you believe solicitation terms conflict with a statute or regulation, you must raise that challenge before proposals are due—not during discussions or afterwards.

It is well established that “[c]ompetitive prejudice is an essential element of every viable protest.” Yet, for decades, the U.S. Government Accountability Office (GAO) has tempered this requirement with two critical corollaries: protesters need only demonstrate a “reasonable possibility” that they were prejudiced by an agency’s actions, and GAO “will resolve doubts regarding prejudice in favor of the protester.” These principles have been consistent features of GAO’s bid protest jurisprudence for more than 30 years. See, e.g., United Int’l Eng'g, Inc., B-245448, Jan. 29, 1992, 71 CPD ¶ 177.

On July 13, 2026, the U.S. Court of Appeals for the 2nd Circuit affirmed a preliminary injunction against Nielsen, handing Cumulus Media a significant win in a constructive tying case with implications beyond the radio ratings industry. Cumulus Media New Holdings Inc. v. The Nielsen Co. (US), LLC, No. 26-88 (2d Cir. Jul. 13, 2026).

On July 17, 2026, the United States Department of Justice (DOJ) announced that it had entered into a Deferred Prosecution Agreement (DPA) with The Scoular Company (Scoular), an agricultural supply chain company based in Omaha, Nebraska, to resolve allegations that Scoular relied on customs brokers to bribe Mexican government officials to allow Scoular goods to pass customs inspections and be delivered to Mexico from the United States. As part of its resolution, Scoular agreed to pay a $9,769,521 criminal penalty and forfeit an additional $414,351. Scoular also committed to continue cooperating with DOJ on any ongoing or future criminal investigations, implement a compliance and ethics program designed to prevent and detect violations of the Foreign Corrupt Practices Act (FCPA), and periodically report to DOJ on remediation and implementation of compliance measures throughout the term of the DPA.

A recently filed class action lawsuit against Gymshark, a prominent athletic apparel company, highlights the escalating legal risks associated with influencer marketing. The complaint, brought in the U.S. District Court for the Southern District of New York on June 16, 2026, alleges that Gymshark systematically paid social media influencers to promote its products without ensuring that the influencers were providing clear and conspicuous disclosures about such payment, in violation of Federal Trade Commission (FTC) guidance and New York state law.

The FAR Council recently released an updated draft of the much-anticipated “FAR CUI Rule” that would apply to contractors government-wide.

On July 6, 2026, the U.S. Department of Justice (DOJ) and the U.S. Department of Homeland Security (DHS) published an Interim Final Rule (IFR) setting up a new federal framework that allows state, local, Tribal, and territorial (SLTT) law enforcement and correctional agencies to detect, track, and, in some cases, disable or seize drones. The rule directly affects SLTT agencies looking to stand up counter-drone programs, as well as drone and counter-drone technology companies whose products will be subject to federal review and approval. Although the IFR bypassed the Administrative Procedure Act’s standard notice-and-comment process on good cause grounds — citing the statutory 180-day deadline and urgent public safety needs — the rule is already legally binding and effective as of July 1, 2026. The Departments are nonetheless accepting post-promulgation comments through September 4, 2026.

The Board of Directors of the Qatar Financial Markets Authority (QFMA) has issued Decision No. 3 of 2026, introducing the Instructions for the International License to Practice Certain Activities in International Financial Markets (the Instructions).

In the underlying litigation, Epic Games alleged that Apple violated antitrust and unfair competition laws by engaging in anti-steering behavior related to purchases on Apple’s in-app payment system. Apple received a percentage of payments made through this system, and Epic Games argued that Apple prohibited app developers from informing users about alternative payment options.  

As discussed in more detail here, the U.S. Department of War (DoW) recently issued a memorandum (Memo 26-P-1023, dated July 13, 2026) directing the immediate suspension of Cybersecurity Maturity Model Certification (CMMC) Phase II requirements (Level I and II self assessments are still permitted). Significantly, the memo directs that “all pending and future CMMC implementation milestones across DoW solicitations and contracts are held in abeyance until further notice.” Moreover, the DoW issued a memorandum on implementing these requirements (available here), directing agencies to issue amendments removing CMMC Level 2 and 3 requirements from active solicitations “as soon as practicable.” Contractors should monitor the government’s compliance with this requirement and should be prepared, if needed, to file a bid protest to protect their rights.

On June 30, 2026, the U.S. Supreme Court issued its decision in West Virginia v. B.P.J. / Little v. Hecox, holding that Title IX permits schools to limit participation in girls’ and women’s sports to students assigned female at birth and that state laws limiting such teams to students assigned female at birth do not violate the federal Equal Protection Clause. The decision provides significant guidance for K-12 schools, colleges and universities, athletic departments, and state policymakers navigating participation rules for school-sponsored athletics.

On June 18, 2026, the Illinois Department of Labor took a long-anticipated step by adopting comprehensive amendments to 56 Ill. Adm. Code Part 320, the administrative rules implementing the pay transparency requirements of the Illinois Equal Pay Act of 2003 (820 ILCS 112, the Act).