A GDPR-like privacy bill in Washington State failed to pass the House.

FTC is seeking public comment on whether its COPPA rules need updating. The rules were last updated in 2003—but given the speed at which consumer technology has evolved, FTC is asking for comments ahead of the typical ten-year review cycle.

The U.K.s Information Commissioner’s Office will impose a $123M GDPR fine on Marriott as a result of newly-acquired Starwood’s data breach. For potential M&A implications, see here.

A federal court in California found that customers have the right to sue Facebook over a 2016 data breach—even though the leaked information was publicly available —potentially signaling an expansion of consumers’ ability to maintain data breach class actions.

California’s AG will hold public forums across the state on the California Consumer Privacy Act, which will surely give us clarity on the law.

HHS lowered the maximum fine for HIPAA violations.