Practice Areas The Firm Attorneys Insights Contact Schedule a consultation

Privacy & AI Law

Privacy policies, AI compliance, and data agreements for companies that collect personal information or build and use AI tools.

Schedule a consultation See our capabilities

OVERVIEW

A patchwork of rules, with more on the way.

A hand using a smartphone in the dark, lit by the screen

The United States has no comprehensive federal privacy law. Companies answer to a growing list of state privacy statutes, sector-specific rules such as HIPAA, FTC enforcement, and, more recently, state laws aimed at artificial intelligence, such as Texas’s TRAIGA.

We help clients determine which rules apply and then put them into the policies customers read and the contracts that move data between companies.

We serve as ongoing privacy compliance counsel, tracking which laws apply to each client and updating its practices as new statutes take effect. That includes website notices and tracking tools, along with healthcare consent policies and business associate agreements. For companies building or adopting AI, we handle regulatory compliance under state AI laws such as TRAIGA and draft internal AI use policies.

BY THE NUMBERS

$200KTop civil penalty per uncurable violation of Texas’s AI law, in effect since Jan. 1, 2026.Source: Texas Legislature, H.B. 149

1 in 4Malicious data breaches that were AI-enabled in 2026, up 56% from the year before.Source: IBM Cost of a Data Breach Report

67,456Personal data breach complaints reported to the FBI in 2025.Source: FBI

30,256HIPAA complaints filed with HHS in 2024, the most recent year reported.Source: OCR (HHS)

CLIENTS

Who we work with

Companies that handle personal information or build with AI, from an early-stage product to an established platform.

Digital HealthTelehealth and health tech companies handling data that falls inside or outside HIPAA.

Medical PracticesPhysician groups and MSOs protecting patient records under HIPAA and state privacy laws.

Marketing & AdvertisingAgencies and ad-tech businesses whose tracking and targeting face new opt-out rules.

AI StartupsCompanies training and deploying AI models as state AI laws like TRAIGA take effect.

Small BusinessesOwner-led companies getting their website privacy policies and terms right.

E-Commerce & Consumer BrandsOnline sellers managing customer data and consent for cookies and text marketing.

CAPABILITIES

What we handle

Privacy and data protection

How personal information is collected, used, shared, and secured.

AI compliance and contracts

How companies build and use AI tools.

Privacy notices and website termsWebsite privacy notices, terms of use, and cookie and pixel policies that match how the company collects and shares data.

AI use policiesInternal rules for how employees may use generative AI tools, covering confidential information and review of output.

Health data privacyBusiness associate agreements (BAAs), telehealth consent policies, and compliance with HIPAA and the Texas Medical Records Privacy Act (TMRPA).

AI product complianceReview of AI features against state AI laws such as TRAIGA and anti-discrimination law.

III

Data security complianceRegulatory advice on the security safeguards and breach notification duties set by New York’s SHIELD Act and the Texas Identity Theft Enforcement and Protection Act.

III

AI vendor contractsTerms for AI tools and platforms covering use of customer data for training, confidentiality, output ownership, and indemnities.

Calls, texts, and telemarketingConsent and opt-out practices for marketing calls and texts under the TCPA and Texas SB 140, shaped by experience with TCPA class actions.

AI marketing and disclosuresClaims about what AI products can do and disclosures when customers deal with chatbots or AI-generated content, reviewed against FTC standards and state bot disclosure laws.

Website tracking and pixelsReview of pixels and analytics tools against FTC guidance and the privacy and wiretapping theories behind tracking pixel class actions.

AI in healthcareAI tools used in patient care and telehealth, where HIPAA, professional licensing rules, and state disclosure rules add further limits.

Unfair and deceptive practicesMarketing claims and data practices reviewed against FTC standards for unfair or deceptive acts and practices (UDAP).

Training data and ownershipLicensing of datasets used to train models and ownership of AI-generated output.

INSIGHTS