Insights
California’s ADMT Regulations: New Compliance Obligations and Emerging Enforcement Risk
January 30, 2026
Daniel Coffman (Associate-Washington, DC), Anjali Das (Partner-Chicago, IL), David Ross (Partner-Washington, DC), Kim Viergever (Of Counsel-Denver, CO) and Ryan Williams (Partner-Denver, CO) obtained dismissal with prejudice of a federal data breach class action filed against a services vendor for mental health care providers in the District of Colorado. The case comprised eight consolidated class actions brought by 15 named plaintiffs that arose out of a ransomware incident that involved the personal information of almost 4.3 million individuals and included sensitive information such as health information and Social Security numbers. The court agreed that all of the named plaintiffs lack Article III standing, dissecting each of their alleged theories of harm and coming down on the side of the more reasoned courts that have found these types of theories fail to establish standing – public disclosure of private information, increased spam, diminution in value of PHI/PII, emotional distress and future harm. The court concluded that “Plaintiffs have failed to allege injuries in fact that are fairly traceable to the Defendants’ complained-of conduct,” and issued a judgment dismissing the plaintiffs’ claims with prejudice and closing the case.
Daniel R. Coffman, Anjali C. Das, David M. Ross, Kimberly Viergever and Ryan A. Williams
Anjali Das (Partner-Chicago, IL), Brian Myers (Of Counsel-Washington, DC) and Tommy Spitaletto (Partner-Dallas, TX) obtained dismissal of a data breach class action filed against a mental health care provider in the Western District of Texas. The lawsuit arose out of a cyber-attack that involved personal information that included sensitive information such as health information and Social Security numbers. In support of our client’s motion to dismiss, Wilson Elser argued that the plaintiff lacked Article III standing to sue because she failed to allege any injury-in-fact in the form of identity theft fraud, or misappropriation as a result of the breach. Instead, the plaintiff alleged that her harm consisted of (1) lost time and out-of-pocket expenses spent dealing with the data breach; (2) diminished value of her personal, health and financial information; (3) anxiety; (4) violation of privacy rights; (5) loss of the benefit of the bargain made with our client and overpayment for services intended to include data security; and (6) increased risk of future fraud and identity theft. The District Court agreed with Wilson Elser’s position that the plaintiff lacked standing to bring suit and dismissed the case on the basis that the plaintiff failed to allege any actual injury in the form of identity theft, financial fraud or misuse of personal information that could be traced to the cyber incident.
Anjali C. Das, Brian H. Myers and Thomas M. Spitaletto
Constantina Mirabile (Of Counsel-West Palm Beach, FL), Melissa Murphy-Petros (Of Counsel-Chicago, IL) and Anjali Das (Partner-Chicago, IL) represented an educational technology company that provides subscribers with access to online educational courses in a Video Privacy Protection Act (VPPA) class action filed in the U.S. District Court for the Southern District of Florida. The plaintiff, a subscriber, allegedly viewed online course content offered by our client, and filed a putative class action on behalf of herself and all other subscribers for violations of the VPPA. The plaintiff alleged that Meta Pixel (a snippet of JavaScript code that tracks visitor activity on a website) was installed on our client’s website, which resulted in the disclosure of her personal information to Facebook, including the content she viewed, without her consent. Wilson Elser filed a Motion to Compel Arbitration, noting that the plaintiff (like all subscribers) was required to accept defendant’s Terms of Use, which included a mandatory binding arbitration provision. Moreover, the Terms of Use explicitly stated that all parties waived the right to participate in a class action or representative proceeding with respect to any claim. The court promptly granted Wilson Elser’s motion pursuant to the Terms of Service agreement. The ruling underscores the importance of arbitration and class action waiver language in Terms of Use agreements.
NOTE: The Video Privacy Protection Act (VPPA), enacted in 1998, sought to preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials. Plaintiffs have sought to resuscitate the statute by bringing VPPA claims into the 21st century based on the premise that organizations that offer prerecorded, online audio visual content are “video tape service providers” within the meaning of the statute, the draw being VPPA class actions include statutory damages of up to $2,500 per violation.
Melissa A. Murphy-Petros and Anjali C. Das
Geoffrey A. Belzer (Partner-Chicago), Anjali C. Das (Partner-Chicago), Peter J. Larkin (Partner-White Plains) and Jennifer S. Stegmaier (Of Counsel-Chicago) obtained a data breach class action dismissal in the U.S. District Court for the Southern District of New York on behalf of a radiology facility and archival imaging system that contained protected health information. About a year and a half after receiving notice of a breach, two patients filed a complaint against the firm’s client and its IT service provider for failing to implement adequate cybersecurity measures, alleging multiple unauthorized individuals had accessed their information. Geoffrey, Anjali, Peter and Jennifer prevailed on their motion to dismiss when the court held that allegations of increased risk of future harm alone is not a cognizable injury. The court also rejected each of the plaintiffs' additional theories of injury based on time and money spent on theft and fraud monitoring, “benefit of the bargain” injury, intrusion upon seclusion and statutory violations. Plaintiff’s counsel initially filed a purported class action designating another individual who was ultimately determined to never have been a patient of the radiology practice. Plaintiff’s counsel dismissed that action after the team moved for dismissal, and counsel then instituted the parallel suit involving these two plaintiffs and the motion to dismiss follows.
Geoffrey Belzer, Anjali C. Das, Peter J. Larkin and Jennifer S. Stegmaier