Privacy State of the Union | Key Takeaways

In our latest episode of Privacy Huddle, we’re unpacking what actually stood out from Privacy State of the Union, and what it means for teams navigating privacy in 2026.
stream this episode on

Summary

The episode recaps key sessions from the Privacy State of the Union event held in Washington, DC. A fireside chat with an FTC official revealed that a Republican administration does not mean reduced enforcement — just a different set of priorities. Pricing transparency (including ticketing) and children’s privacy are two areas the FTC is actively prioritizing in 2026. The practice of issuing closing letters is also being discussed as a constructive mechanism to resolve investigations and provide business guidance without a formal settlement order. Companies should not interpret a shift in administration as a signal to deprioritize compliance readiness.

On the state enforcement side, a conversation with the Delaware Attorney General’s office illuminated the growing coordination among state regulators — sharing technology resources, subject matter experts, and investigation targets across a multistate consortium. States are no longer just reading privacy policies for surface-level compliance. Regulators are actively digging into data flows, scrutinizing where data originates and where it is disclosed, and expecting companies to have compliance records demonstrating upstream and downstream diligence. This represents a material escalation from earlier enforcement patterns focused on policy language and update dates.

A recurring theme across the day’s sessions was the need for cross-functional alignment within organizations. Privacy compliance cannot remain siloed within legal or compliance teams — it requires active participation from product, engineering, and government relations. Several brand leaders at the event noted that privacy leaders can feel like they are shouting into a void, underscoring the urgency of breaking down internal silos so that privacy priorities translate into operational decisions across the entire business.

Transript

Colleen

Hi, Alysa. How are you doing?

Alysa

Hi. Good to see you.

Colleen

Good to see you too. What a pleasure to be here with you in the Kelly Dry office. We never get to do these huddles in person.

Alysa

Yes. Welcome.

Colleen

Thank you. And of course, we're here because we had an amazing event yesterday with Privacy State of the Union here in

Alysa

We did. We braved snow and ice and, you know, very scary forecasts to make it happen and it happened. Thank goodness. Because when you put all this energy into playing an event and then it has to suddenly go virtual, it would have been a, you know, a bummer. So it was so nice to have so many people come out. I'm actually amazed that we had so many folks in person.

Colleen

Privacy practitioners are committed.

Alysa

They are a special breed.

Colleen

Committed, loyal, friendly. It was a great day. Yeah. So, of course, we had many folks who couldn't make it. So so I was hoping that on this huddle, we can just kind of recap some of the best sessions from you.

Alysa

Sure. It was such a pleasure, intimate event here in the Keller Dry DC office. And as usual with these intimate events, I think one of the highlights is just getting to hear from the regulators and enforcers in such a small setting.

Colleen

Always, always. I mean, look, what they do matters. What they telegraph or forecast, that helps you prepare. You can't do everything but you can certainly prioritize. So I certainly found each one of those discussions helpful. Exactly. So let's talk through the highlights for folks that couldn't be in the room. Of course, we started the day early with, the fireside chat that you hosted with Chris Moufarej, from the FTC. I thought that was a great behind the scenes look at what he does on a day to day basis and also what he's forecasting to prioritize for twenty twenty six. He highlighted two key things we can expect to see from them this year, which are pricing transparency, including ticketing, as well as children's privacy focus. What else did you take away from that conversation with him?

Alysa

Well, I think sometimes there can be an assumption that a republican administration, certainly this one is, you know, very business friendly which means no And I think what we heard was no, there's just a different set of priorities. And so the price transparency and we've seen it with their actions from a lot of subscription cases, that's gonna continue. The ticketing cases that he was talking about, I mean, really thinking in a time of affordability that we hear about like that is what they're gonna be looking at. Is it clear and conspicuous? Is it accurate? Are there consumer surprises? He pointed out certainly their consumer complaint database and that is driving some of the priorities. That's not a surprise. I thought he was pretty candid about closing letters which was, I mean, that sounds total regulatory DC lawyer nerdy but like, look, companies don't want to necessarily end up in a settlement which is, you know, an important order that they have to usually deal with for many, many years. But a closing letter is another way of resolving an investigation. They don't happen a lot but they do communicate to the business community X, Y, Z is an issue and here were some steps that somebody, company took to address those, and that ends up becoming really helpful business guidance.

Colleen

Yeah. That was fascinating. Interesting new topic. The other thing that I loved yesterday was Michael Mako's keynote at the end of the day. He's he's just such a refreshing, I I think, candid person in these small settings and it was great to hear him talk about specifically the mindset with which he approaches these investigations. Tell me from your perspective just how you thought about that.

Alysa

Well, again, nobody wants to be investigated but I think everybody wants a fair shake and the facts matter. And one of the points that he was very, I would say, crisp about is don't go in it's very dangerous for an enforcer to go in with, here is what the story is gonna look like. They already have the ending in mind as opposed to, no, you have to keep an open mind. You may have a theory but you're asking for information and documents for a reason. You gotta take it all in and evaluate it and give the company a fair shake. And so just to hear that that was front of mind I found was certainly for a lot of the companies in the room, you know, just reassuring to hear. I think he talked about also about his team and he's got, you know, he's been building that team for quite some time. And in the, you know, public facing world, like you don't see all that activity. And I think there's been a multiplier effect in enforcements where I think twenty twenty six is a year where we're just going to hear a lot more settlements, a lot more, you know, potentially litigation. We've already seen some litigation towards the end of December so I think we're going to see a lot more privacy enforcements, yeah.

Colleen

Yeah, no doubt. And then, of course, the last group we heard from on the regulator side was John Ekins from Delaware in conversation with yourself as well as Paul Singer from your team, but, of course, he has the Texas AG office background. That was just a great discussion of how how do they think at the state level went beyond just, for example, the consortium, which of course we saw teased in the press release, but they even gave more behind the scenes details of what that actually looks like across the states. Right. What did you take away from that, Chat?

Alysa

Well, one, we knew that the states, mean, these groups, a lot of them have been talking because they were consumer protection attorneys for well before that consortium was put together but I think he emphasized not only how frequently they're speaking but the shared resources. And Michael Mackow actually mentioned that too, you know, the technology resources, the subject matter experts, that is getting spread among multiple states and so I think what comes from that, you know, that powers, supersize powers enforcement, investigation, investigation targets. I thought the other thing that John Eakin said that was particularly noteworthy, you know, we've heard from him in the past where they were looking at the low hanging fruit. They were reading the privacy policies, they were saying, you know, where rights may not be offered to certain constituents of their state or the last revise date was old. But he talked now about, no, no, we're also prioritizing really getting into the data flows. Where is the data coming from? Where is the data getting disclosed to? What kind of diligence have you done both upstream and downstream? And I think if the takeaway wasn't, how would you answer that question and do you have records and compliance materials to show for it? If you didn't have that yet, that was a really good signal to prepare.

Colleen

Yeah, absolutely. Well, it was such a pleasure to, pull this group of speakers together because it's always nice and reassuring to hear from folks in the room as we did at the end of the day yesterday, just like how nice it is to get together and I think a couple of the panelists even said that on stage, right, when they were asked from a brand leader perspective, what's one practical takeaway you'd give to the room? And everyone was just like, let's just have more conversations like this, right, all figuring it out together.

Alysa

Yeah, I mean, I think even what I heard some of the comments were not just only let's all have this community because it really helps to benchmark in this kind of the arc of where privacy law is going, but a reminder, you have to talk within the company. Yes. And really break through some of those silos because it it cannot be the privacy legal or the privacy, like, compliance side steering the ship on this, you know? You need to be able to have everybody rowing product, government relations. Everyone needs to really understand this is a whole new ballgame.

Colleen

Yes. I think you said yesterday, like, as a privacy leader can sometimes feel like shouting into a void. Right? And so you need to cross those bridges to stop that feeling. Exactly. Well, great catching up with you, of course, Elisa. Folks, drop in the comments if you'd love any other highlights from this event. We covered just a wide range of topics from sensitive data to children's privacy to these enforcer perspectives, we'd be more than happy to share more on future chats. So let us know what you'd love to hear. Elisa, thank you as always for joining me.

Alysa

Thank you, Colleen.

Subscribe
to the
Ketch Up newsletter

Trend watching, best practices, case studies, latest Privacy Huddles and more. Once a month, straight to your inbox:

Related episodes

view all episodes