Cybersecurity · Industry brief

FINRA enforcement actions increasingly target financial advisory firms using non-compliant chat applications for business communications, with regulators citing failures in message retention, supervision, and audit accessibility. Recent enforcement trends show that firms cannot produce records of communications conducted through unapproved consumer chat platforms during inspections, resulting in fines and remediation mandates. The regulatory message is clear: firms must maintain complete, tamper-resistant, and readily accessible records of all business communications, and the burden of proof falls on compliance leadership to demonstrate that all business exchanges are captured in supervised systems without external channels.

The FTC, along with California and Utah, filed a complaint on July 29, 2026 against Hims & Hers for allegedly promising users their health data would remain private while secretly sharing it with Meta and Snap through tracking pixels, charging consumers without clear consent, and making subscription cancellation difficult. The government seeks financial penalties and injunctive relief. On August 5, 2026, a class action lawsuit was filed against University of Colorado Health in Colorado federal court alleging UCHealth installed Meta's tracking pixel on its website to send patients' health-related searches and identifying information to Facebook without consent, potentially violating the Electronic Communications Privacy Act and HIPAA. On February 10, 2026, a consumer class action was filed against Amazon in Washington federal court alleging Amazon unlawfully harvested sensitive location data through advertising software in mobile apps and violated Washington's My Health My Data Act by failing to obtain proper consent or provide adequate disclosure regarding collection and sharing of consumer health data. These enforcement actions reflect a broader pattern where regulators and private plaintiffs increasingly scrutinize healthcare and digital health companies' use of tracking technologies and third-party data sharing. Regulators are expanding the definition of "health information" beyond traditional HIPAA-covered data to include any health-related information revealed through website activity, and similar state privacy laws are emerging in Nevada, Connecticut, and New York.

Data broker regulation is rapidly expanding across the United States with significant compliance obligations and enforcement risks for businesses handling personal information. Clark Hill highlights emerging state laws and frameworks, particularly California's Delete Act and DROP system, examining how states define "data broker" and which traditional data brokers and businesses engaged in advertising, lead generation, analytics, and data enrichment activities may be affected.