Our repeat guest is a partner at Stoel Rives in San Francisco. John is co-lead of the firm’s Technology Industry Group. He counsels clients on data privacy, information security, artificial intelligence, and other technology dispute, compliance, and transactional matters.
John has taught Technology Transactions Law at the UC Davis School of Law and Comparative Privacy Law at the Santa Clara University School of Law. John has also guest lectured on technology and privacy law topics at the University of California, Berkeley, Haas School of Business; the University of San Francisco School of Management; and Stanford University.
References:
John Pavolotsky: The Long Arc of Data Breaches: 2006-2026 (May 14, 2026)
Colorado SB 26-189, repealing and replacing Colorado’s original 2024 AI Act
New laws being discussed in California, or just approved:
AB 1542: to prohibit a business, service provider, or contractor from selling or sharing sensitive personal information to a third party.
AB 1898: to require an employer to maintain an updated list of all workplace AI tools currently in use and to provide the list to workers annually.
AB 2021: whistleblower complaints.
AB 2169: social media platforms, artificial intelligence models - to allow a consumer to request a copy of the consumer’s personal information, contextual data, and social graph and require the social media company or model operator to respond to that request within five business days.
SB 300: companion chatbots - transparency and rules of engagement.
SB 574: to obligate an attorney who uses generative artificial intelligence to practice law to ensure that confidential personal identifying, or other nonpublic information, is not entered into a public generative artificial intelligence system.
SB 867: AI-powered toys - to be subject to the same rules proposed for companion chatbots.
SB 923: to expand data deletion requests to any personal information that the business has collected about the consumer (and not just from the consumer).
SB 1000: to require provenance data disclosure in content generated by artificial intelligence as well as tools to facilitate detection.
SB 1142: Digital Dignity Act - to prevent digital replicas for the purposes of impersonation.
