Legal & Compliance — September 1, 2026 Monthly

On July 29, 2026, the FTC — joined by Utah and California — filed suit against Hims & Hers alleging the telehealth provider shared consumers' sensitive health information in violation of privacy laws, marking the agency's first major telehealth privacy enforcement action and extending the FTC's portfolio-enforcement model into digital health [1].

On August 7, 2026, the FTC formally announced it will not pursue claims based on disparate-impact or 'unfair discrimination' theories, representing a significant doctrinal shift that narrows the agency's enforcement toolkit and reduces regulatory pressure on companies whose algorithmic systems produce disparate outcomes, while leaving enforcement under other statutes such as the Equal Credit Opportunity Act unaffected [1].

On August 17, 2026, the FTC secured a court victory blocking the Henkel AG merger of Loctite and Liquid Nails construction adhesive brands. On August 19, 2026, the FTC sought public comment on an enforcement policy statement regarding personalized pricing — the use of personal data to set individualized prices — signaling a new enforcement frontier for data-driven pricing practices [1].

On August 27, 2026, the FTC finalized orders requiring Cox Media Group and two other firms to pay a total of $930,000 for falsely claiming to offer an 'active listening' AI-powered marketing service, establishing that unsubstantiated AI feature claims constitute actionable deceptive practices under Section 5 [1].

The Supreme Court's unanimous June 4, 2026 ruling in Sripetch v. SEC confirmed the SEC need not prove investor pecuniary loss to obtain disgorgement, strengthening the SEC's enforcement toolkit. Justice Thomas's concurrence identified a developing circuit split on whether disgorgement is a legal remedy entitling defendants to jury trials under the Seventh Amendment — flagged as ripe for future SCOTUS review [5j].

On July 9, 2026, the SEC Staff issued three new Corporation Finance Interpretations requiring company-specific activist SPVs to disclose investor identities in Schedule 13D filings and treating investors contributing more than $500 as 'participants' in contested proxy solicitations under Schedule 14A, closing a long-standing disclosure gap and materially increasing transparency obligations for activist campaigns [5i].

On July 16, 2026, the SEC proposed Regulation E-Delivery, which would flip the existing opt-in e-delivery model to an opt-out default, requiring covered entities to provide two paper notices (180-day and 30-day) before transitioning paper recipients to electronic delivery, with potential to significantly reduce printing and mailing costs across the securities industry [5k].

On August 5, 2026, the SEC established a Financial Reporting and Accounting Unit in its Enforcement Division, signaling renewed focus on financial reporting integrity. Between August 10 and August 14, 2026, the SEC's Retail Fraud Working Group produced three major fraud charges — Adit Ventures Management (private fund fraud), a $47 million fraud targeting Orthodox Jewish communities, and a $74 million pre-IPO retail investor scam [2].

On August 18, 2026, the SEC proposed new Regulation Crypto Assets, offering a potential safe harbor framework for crypto asset issuers satisfying its exemptions, subject to public comment. On August 18, 2026, the SEC also charged former executives in connection with the $1.9 billion collapse of subprime auto lender Tricolor [2].

The SEC's Spring 2026 Regulatory Agenda catalogued nearly 40 action items — a majority designated deregulatory under President Trump's Executive Order 14192 — covering broker-dealer recordkeeping, investment adviser custody, proxy system modernization, and enhanced retail access to private markets, representing a markedly different set of priorities oriented toward reducing compliance burdens and facilitating capital formation [5a].

The EU's Digital Omnibus on Artificial Intelligence entered into force on July 27, 2026, and the European Commission published practical guidance on the Cyber Resilience Act on the same date. The Commission had also issued EU AI Act transparency guidelines on July 20, 2026. These three instruments are now legally operative, removing the 'awaiting clarity' justification for delayed compliance implementation [4].

On July 31, 2026, the EDPB sent a formal letter to the European Commission requesting examination of whether the U.S. Supreme Court's Trump v. Slaughter decision — which addressed FTC independence — undermines the 2023 EU-US Data Privacy Framework adequacy decision, creating material transatlantic data transfer uncertainty corroborated by multiple law firm analyses [4] [12].

The European Data Protection Board adopted Guidelines 03/2026 on web scraping in the context of generative AI for public consultation on July 7, 2026, signaling that the EDPB is actively working to constrain generative AI training data practices under existing GDPR frameworks, creating compliance obligations for AI developers that predate any new AI-specific legislation [9].

In a March 25, 2026 ruling analyzed in Week 1, the Delaware Supreme Court held 3-2 that courts may consider post-demand evidence in Section 220 books-and-records actions under exceptional circumstances, arising from the Paramount Global sales process. The ruling expands stockholder inspection rights and increases litigation risk for corporations facing books-and-records demands, particularly in M&A contexts [5l].

On July 29, 2026, the Delaware Court of Chancery issued the first-ever decision addressing PBC director fiduciary duties in a change-of-control context in Drakes Landing Associates v. Tilden Park Capital Management, holding that the Revlon doctrine's stockholder-value maximization purpose does not apply to PBC directors, who must instead balance stockholder interests, the corporation's public benefit purpose, and the interests of those materially affected by the corporation's conduct [5b].

On August 13, 2026, the Delaware Court of Chancery dismissed Caremark oversight claims against Boeing directors, holding that extensive board reporting on safety risks cannot itself become evidence of oversight violations. Simultaneously, a split emerged between Brola v. Lundgren and Los Angeles City Employees' Retirement System v. Sanford on whether interpersonal fiduciary misconduct triggers Caremark liability, with the Delaware Supreme Court positioned to resolve the conflict on appeal [5c].

The Delaware Supreme Court in Paragon Metals v. Smith held that a seller's active concealment defeats anti-reliance provisions and that Delaware fraud claims are subject to the preponderance standard, not a heightened clear-and-convincing standard, sharpening the limits of anti-reliance provisions and forward-looking MAE representations in M&A transactions [5m].

In Cisco Systems, Inc. v. Doe I (June 23, 2026), the U.S. Supreme Court held 6-3 that federal courts may not create new causes of action under the Alien Tort Statute and that the Torture Victim Protection Act does not extend to aiding-and-abetting claims, significantly curtailing human rights litigation exposure for multinationals in U.S. courts, though the TVPRA's express aiding-and-abetting provision remains intact [5n].

The DOJ withdrew the 1987 business review letter issued to ISS, citing the combined market share of ISS and Glass Lewis exceeding 90%, following a November 2025 Florida antitrust lawsuit, a December 2025 presidential executive order, and at least thirteen states proposing or enacting proxy advisory legislation. The withdrawal may accelerate federal and state oversight and prompt proxy advisors to reduce their influence over shareholder voting [5e].

According to a Cooley LLP analysis published August 30, 2026, securities class action filings reached 117 in H1 2026, with AI-related filings reaching 15 — nearly matching 2025's full-year total of 16. AI filings accounted for $385 billion of the Disclosure Dollar Loss Index and $1.3 trillion of the Maximum Dollar Loss Index, representing 73% of each measure, with two AI filings alone contributing $1.2 trillion to the MDL Index [5d].

Full-season data confirmed shareholder proposal submissions fell 40–50% but proposals going to a vote declined only approximately 12.4%, as exclusion notices dropped 48.5% in the absence of SEC no-action guidance. Activism campaigns fell nearly 75% from the 2024 peak but the share directed toward proxy fights rose from 7% in 2024 to 38% in 2026. No environmental or social proposals in the Russell 3000 received passing support [5g].

FinCEN permanently eliminated beneficial ownership information reporting requirements for US companies and US persons under the Corporate Transparency Act, materially reducing anti-money laundering compliance obligations for domestic entities while leaving foreign reporting company obligations intact [5o].

On August 10, 2026, DHS introduced an interim final rule mandating electronic filing for certain immigration forms. USCIS announced revised Form I-539 and I-765 editions effective September 15, 2026 (older editions rejected from that date), and revised Form I-485 effective September 18, 2026. Organizations managing nonimmigrant and adjustment-of-status populations face back-to-back hard compliance deadlines [6].

On August 24, 2026, DHS proposed a $103,265 fee for all H-1B cap-subject petitions. On August 24, 2026, the U.S. District Court for the Northern District of California enjoined USCIS policy memoranda PM 602-0192 and PM 602-0194. The proposed fee increase would represent a dramatic escalation in skilled worker visa costs, while the court injunction signals ongoing judicial pushback against USCIS policy changes [6].

On August 11, 2026, DOJ filed a record 25 denaturalization cases with USCIS partnership, and on August 12, 2026, USCIS supported the indictment of 11 individuals for orchestrating more than 1,000 sham marriages over a decade. The record denaturalization filing volume signals a sustained enforcement escalation treating denaturalization as a mainstream enforcement tool [6].

New York released final rules implementing the Stop Addictive Feeds Exploitation for Kids Act effective January 25, 2027, and New Jersey enacted the Kids Code Act imposing privacy-by-default and safety-by-design obligations on online services likely accessed by minors. The California Privacy Protection Agency also settled with data brokers LocateSmarter LLC and Cybba, Inc. for failing to register under California's Delete Act [4].

On July 24, 2026, China's cyberspace regulator issued an official Q&A clarifying cross-border data transfer requirements, including separate consent obligations and restrictions on overseas transfers of domestic job applicants' resumes. China also issued simplified personal information protection provisions for small-scale handlers on July 22, 2026, creating a tiered PIPL compliance framework [4].

On August 11, 2026, Indonesia became the HCCH's 94th Member, extending Apostille, Service, and Evidence Convention coverage to one of the world's most populous countries. UNCITRAL concluded its 59th session having finalized significant investor-State dispute settlement reforms and adopted electronic arbitral award and notice texts, modernizing the international arbitration framework [14].

On August 20, 2026, the DOJ's National Fraud Enforcement Division issued a memorandum detailing its structure and broad enforcement priorities, with DOJ also publishing a final rule reassigning several Criminal Division fraud functions to the new division, signaling a more coordinated and potentially more aggressive federal fraud enforcement posture [13].

Japan's Ministry of Justice published guidelines on August 21, 2026 on the relationship between AI legal services support and Attorney Act Article 72, clarifying the boundary between permissible AI-assisted legal services and unauthorized legal practice — a significant development for legal technology providers operating in Japan [15].

On July 31, 2026, the ICJ announced public hearings on Germany's preliminary objections in Nicaragua v. Germany will be held September 7–10, 2026, advancing a significant case on third-state responsibility in international humanitarian law with implications for states' arms export and aid policies [8].

Colorado revised its AI law, changing compliance expectations for businesses, and Illinois enacted the Artificial Intelligence Safety Measures Act on July 6, 2026, making it the third state with comprehensive AI safety requirements. The pattern of state-by-state AI law revision with distinct requirements accelerates compliance fragmentation for organizations operating across multiple US jurisdictions [10].

Nasdaq issued a letter of reprimand to The Trade Desk for extending its dual-class structure's sunset provision, while Seer, Inc. dropped a similar proposed amendment after Nasdaq signaled a potential Voting Rights Rule violation, escalating a dispute over whether sunset extensions constitute prohibited midstream recapitalizations with direct implications for dual-class companies with approaching sunset provisions [5p].

The ABA Legal Education council is scheduled to decide on September 8, 2026 whether the DEI standard is repealed, a decision with immediate implications for law school accreditation compliance programs [11].