State of AG Enforcement Generally
In 2024, state attorneys general (“State AGs”) focused on a broad variety of areas and industries including, in particular, emerging industries such as artificial intelligence (AI) and privacy and social media protections. State AGs have long been active on areas traditionally occupied by the federal government, such as the environment and antitrust, and 2024 saw a continued focus on those areas. Last year also saw State AGs engaging in increased advocacy to influence federal policy and legal frameworks, such as submitting letters to federal agencies and congressional committees as well as filing amici briefs. Below is a summary of some of the most important focus areas for State AGs in 2024.
Artificial Intelligence
In 2024, State AGs increasingly were focused on regulating AI as the technology proliferates.
For example, California joined other states, such as Colorado and Utah, in enacting AI transparency laws. On September 19, 2024, California adopted the California AI Transparency Act, which aims to help the public identify AI-generated content and allow consumers to determine whether content was created/altered using generative artificial intelligence. The AI Transparency act applies to anyone that “creates, codes, or otherwise produces a generative artificial intelligence system that has over 1,000,000 monthly visitors or users and is publicly accessible within [California].”
Additionally, on July 11, 2024, the New York State Department of Financial Services (DFS) published its final guidance on the use of AI in underwriting and pricing insurance policies. The guidance, which outlines the Department’s expectations for all insurers authorized to write insurance in New York, focuses on the risks of unlawful discrimination presented by an insurer’s use of artificial intelligence systems (AIS) and external consumer data and information sources (ECDIS). The final guidance reminds New York insurers that the “Department may audit and examine an insurer’s use of ECDIS and AIS” pursuant to New York state law. The DFS Superintendent Adrienne Harris expressed that the goal of the guidance is to “ensur[e] that the implementation of AI in insurance does not perpetuate or amplify systemic biases that have resulted in unlawful or unfair discrimination, while safeguarding the stability of the marketplace.”
Massachusetts Attorney General Andrea Joy Campbell issued an advisory to provide guidance to developers, suppliers, and users of AI regarding their obligations under Massachusetts state law. The advisory clarifies that existing state laws, such as state consumer protection, anti-discrimination, and data security laws, apply to AI systems and any other emerging technology. AG Campbell noted that AI systems may create certain risks to consumers related to potentially false information or alleged bias or discrimination. The advisory also notes that Massachusetts’s anti-discrimination laws prohibit the use of AI to discriminate against individuals based on legally protected characteristics. AI systems also need to comply with the state’s data privacy laws and safeguard personal data, while companies that operate AI systems must comply with the state’s data breach notification requirements.
This focus on AI is expected to continue in 2025 as a result of additional AI state laws that may be enacted.
Data Privacy/Cybersecurity
In 2024, many states significantly enhanced privacy protections and enforcement, emphasizing data privacy through a number of newly enacted laws. State AGs have been at the forefront of enforcing these laws, often imposing substantial penalties for noncompliance.[1]
State AGs also were proactive in 2024 in reminding companies of their obligations under state law. For example, on June 26, 2024, California AG Rob Bonta announced that his office had sent letters to eight major pharmacies doing business in California and five health data companies, reminding them of their obligations to protect patient privacy under the California Confidentiality of Medical Information Act (CMIA) and new amendments strengthening the law, which went into effect July 1, 2024. The CMIA amendments, proposed through Assembly Bill 352, introduced a host of security measures meant to limit access to patient medical information, including segregating medical information related to abortion and contraception and prohibiting healthcare providers from providing any patient medical information involving abortion-related services to individuals or law enforcement located in another state, unless a warrant is served.
The California AG’s letters asked companies to provide that office with their policies on maintaining medical information, whether they have formalized warrant requirements before disclosures of information are made to law enforcement, and whether they enforce shared obligations with their contractors. Parallel to the broader federal trend of lawmakers interested in holding companies that store patient data to a high standard—especially in their disclosure policies to law enforcement, in light of increased state regulation of abortion—the California AG’s interest signals a new front for data privacy compliance.
Last year also saw the NYAG issuing an advisory warning to businesses that website tracking technology may violate New York consumer protection laws. Certain technologies, such as cookies, help websites recognize a visitor from one webpage to the next and can be used for a range of purposes from fraud detection and analytics, to creating user profiles for ad targeting and marketing. According to the NYAG, these technologies also can infringe on consumer privacy. The NYAG cited its investigation that identified more than a dozen popular websites with allegedly broken privacy controls in that visitors to these websites who attempted to disable tracking technologies continued to be tracked. The NYAG also noted that it believed the privacy controls and disclosures of certain websites to be confusing and misleading. According to the NYAG, such misleading or confusing website disclaimers and privacy actions may be in violation of New York’s consumer protection laws.
ESG/DEI
In 2024, certain State AGs continued to challenge corporate diversity, equity, and inclusion (DEI) practices in the wake of the United States Supreme Court’s decision in June 2023 prohibiting affirmative action in college admissions.[2] On the other hand, other State AGs focused on supporting DEI efforts in the private sector. Given the actions by the new presidential administration, as well as by certain State AGs already active in this space, these efforts will ramp up significantly in 2025.
In March 2024, Texas AG Ken Paxton opened an investigation into Spirit AeroSystems Holdings, Inc. after reports of alleged defects in airplane parts it manufactured for Boeing Co. Among other requests, the Texas AG sought documents from Spirit AeroSystems related to its DEI commitments and announced that his investigation will examine whether those commitments are unlawful or are compromising the company’s manufacturing process. Spirit AeroSystems filed a federal lawsuit to block the Texas AG’s request for documents, calling the investigation “unreasonable and unlawful.” Spirit argued that the Texas AG’s demands violated its “Fourth and Fourteenth Amendment rights to be free from unreasonable searches and seizures” and sought a declaratory judgment that the Texas Request to Examine statute pursuant to which the Texas AG made the documents request is unconstitutional, a preliminary injunction to halt the statute’s operation, and a permanent injunction against the use of this statute moving forward.
Additionally, in June 2024, 19 Democratic State AGs sent a letter to the ABA and Fortune 100 companies, re-affirming the legality of diversity programs and the “narrow reach” of the Supreme Court’s recent affirmative action decision. The letter was in response to a June 3, 2024, letter from 21 Republican State AGs urging the ABA to stop requiring law schools to support diversity and inclusion in their student bodies and faculties and claiming that such practice was illegal following the Supreme Court’s holding in Students for Fair Admissions.
The June 20 Democratic State AGs’ letter defends both the ABA’s accreditation requirement that law schools demonstrate “a commitment to diversity and inclusion” and corporate diversity, equity, and inclusion programs. The Democratic State AGs stated that their Republican counterparts’ letter stretched the holding of Students for Fair Admissions beyond the Court’s holding and claimed that “their challenges are intended to contort and weaponize antidiscrimination statutes to undo decades of progress.” The letter goes on to state that the holding of Students for Fair Admissions “does not require that higher education in institutions [be] barred from undertaking recruitment efforts to encourage a diverse applicant pool, or from creating non‑hostile educational environments for underrepresented groups.” The Democratic State AGs argue that the majority opinion in Students for Fair Admission made clear that the reach of the opinion extended to college admissions and therefore recruitment efforts and aspects of the admissions process that do not determine admittance are not implicated by the holding. The 19 Democratic State AGs also cited to a recent decision by the Supreme Court to decline to rule on a case that argued for a more expansive application of Students for Fair Admission in other admissions contexts.
The letter also addressed other challenges to DEI, including a number of lawsuits filed against corporations and law firms over their DEI efforts and programming. The Democratic State AGs restated their interpretation of Students for Fair Admission, specifically that the Court’s holding did not address or govern the behavior of private-sector businesses. The Democratic State AGs argued that the law as it relates to business had not changed and companies have wide latitude to ensure their applicant pools are diverse and their workplaces are equitable and inclusive. Moreover, companies have an obligation under Title VII to “ensure that their workplaces are equitable, including an obligation to ensure that their workplaces are not hostile environments for racial minorities or other types of protected classes.” The Democratic State AGs also dismissed recent litigation challenging DEI initiatives and noted that “[c]ourts have decisively dismissed other arguments challenging corporate DEI programs, holding that companies retain business judgment as it relates to DEI efforts.”
Again, given the executive orders issued by the new presidential administration, State AGs in blue and red states will continue to be focused and active on DEI. Accordingly, companies should consider taking the action steps discussed in our DEI Strategy + Defense Task Force’s alerts (Unpacking the Trump Administration’s DEI Orders and Actions – FAQs and Action Plans and President Trump’s DEI Certification for Federal Contractors Creates Significant FCA Risk), including auditing their DEI programs under privilege for potential risks while not overcorrecting.
Environmental
Supreme Court decisions in 2024 on environmental law issues as well as the elimination of Chevron deference, coupled with the lack of congressional legislation addressing substantial environmental protection, have left a perceived vacuum in national environmental protection. In response, certain state and local governments focused on safeguarding what they saw as critical environmental resources through amending state constitutions, state statutes, and local regulations.
State constitutional provisions, such as those in Pennsylvania, Montana, and Hawaii, were used in 2024 as bases to challenge statutes covering greenhouse gas emissions, fracking, and other energy policies. For example, in response to Navahine F. v. Hawaii Department of Transportation, a lawsuit alleging that Hawaii’s state transportation system violated two state environmental constitutional provisions, a Hawaii state court approved a settlement in which Hawaii agreed to cut greenhouse gas emissions from transportation.
In August 2024, Ohio AG Dave Yost and Kansas AG Kris Kobach submitted an emergency application to the U.S. Supreme Court to stay the Environmental Protection Agency’s (EPA) Air Quality Final Rule. Earlier this year, a coalition of 24 Republican State AGs filed a petition for judicial review with the U.S. Court of Appeals for the D.C. Circuit, challenging the EPA’s “Reconsideration of the National Ambient Air Quality Standards for Particulate Matter” final rule. In July, the D.C. Circuit allowed the rule to take effect while pending review. The final rule requires, among other things, states and power plants to comply with certain regulations targeting air pollution, which includes a reduction in the annual particulate matter standard and updates to the EPA’s air quality index.
On October 16, 2024, the Supreme Court denied the request for a stay. However the D.C. Circuit rules, it is likely that the non-prevailing party will seek certiorari at the Supreme Court. Moreover, given the implications this case has on the EPA’s statutory authority, the ruling will likely test the boundaries created by the overruling of Chevron deference.
As regulatory power continues to shift, and with a new administration, state and local authorities will continue to focus on environmental issues.
Antitrust
In 2024, State AGs continued to be very active in the arena of antitrust enforcement. Historically, antitrust enforcement investigations and litigation have been led by the DOJ Antitrust Division and Federal Trade Commission (FTC), with State AGs joining in parallel to support those actions. Increasingly, however, numerous State AGs are bringing independent investigations and litigation apart from their federal counterparts.
For example, in 2024, the Washington and Colorado AGs filed lawsuits separate and in front of the FTC’s action to block the proposed merger between grocery store operators Kroger and Albertsons. The proposed transaction, worth nearly $25 billion, would have created one of the largest grocery chains in the United States. Washington AG Bob Ferguson stated that the proposed merger would “severely limit shopping options for consumers and eliminate vital competition that keeps grocery prices low” and “Kroger would enjoy a near-monopoly in many markets in the state.” The FTC followed up with its own suit on February 26, 2024, which was joined by the State AGs of Arizona, California, Illinois, Maryland, Nevada, New Mexico, Oregon, Wyoming, and the District of Columbia.
In December 2024, a Washington state judge ruled in favor of the Washington AG and a federal judge in the District of Oregon ruled in favor of the FTC, issuing injunctions to block the merger. The lawsuit brought by the Colorado AG is still being deliberated.
Additionally, in 2024, California indicated a renewed focus on criminal antitrust enforcement. On March 6, 2024, Senior Assistant AG Paula Blizzard announced that the California AG’s Antitrust Section was renewing its focus on its criminal antitrust program by actively seeking to enforce the California Cartwright Act. While this does not represent new authority for the California AG, the California AG has not brought a criminal Cartwright Act prosecution in more than 25 years. Ms. Blizzard also announced that the California AG intended to coordinate with DOJ, as well as California district attorneys, who have independent authority to charge offenses under the Cartwright Act.
Businesses and consumers should expect to see continued aggressive antitrust enforcement by State AGs this year and also may have to contend with both state and federal antitrust law enforcement efforts that may not always be aligned.
[1] Check out MoFo’s Privacy Minute Q&A for more information on State AGs’ 2025 Data Security Enforcement Priorities.
[2] See Students for Fair Admissions, Inc. v. President and Fellows of Harvard College, 600 U.S. 181 (2023).
[View source.]
