August 17, 2026
The Weekly Sweep: Northeast Regulators Focus on Consumer Data, Cybersecurity, and Digital Practices
State regulators and attorneys general across the Northeast continue to focus on the collection, protection, and use of consumer information, while New York regulators are also addressing cybersecurity vulnerabilities and digital subscription practices.
This week's developments include multistate challenges involving access to personal information, cybersecurity actions by the New York Department of Financial Services, and New York City's new "Click-to-Cancel" rule.
Key Developments
Multistate Coalition Challenges Federal Demand for Commercial Driver Data
The Attorneys General of Connecticut, Maine, Massachusetts, New York, and Vermont are part of a coalition challenging federal demands for state-held personal information associated with approximately 17 million commercial driver's license holders.
The states filed actions involving the U.S. Department of Transportation (DOT), Federal Motor Carrier Safety Administration (FMCSA), and Department of Homeland Security (DHS), alleging that disclosure of the requested information is unnecessary and could put sensitive personal information at risk.
Connecticut Attorney General Press Release:
Massachusetts Attorney General Press Release:
New York Attorney General Press Release:
Vermont Attorney General Press Release:
Complaint Against DOT and FMCSA:
Massachusetts and New York Join Challenge to Federal TANF Data-Access Policy
Massachusetts Attorney General Andrea Joy Campbell and New York Attorney General Letitia James have joined a coalition of state attorneys general challenging changes by the federal Administration for Children and Families (ACF) that would provide increased access to personal information concerning families receiving Temporary Assistance for Needy Families (TANF) benefits.
The lawsuit seeks a court order declaring the ACF policy unlawful and injunctive relief preventing its implementation.
Massachusetts Attorney General Press Release:
New York Attorney General Press Release:
New York DFS Issues Cybersecurity Alert Regarding Remote Monitoring Platform Vulnerability
The New York Department of Financial Services (DFS) issued an Industry Letter alerting DFS-regulated entities to an active cyber campaign targeting a known vulnerability in a remote monitoring and management platform.
According to DFS, threat actors are exploiting the vulnerability to compromise managed service provider environments and potentially gain access to customer networks and information systems. DFS urged regulated entities using managed service providers to take steps to assess and mitigate the risk.
New York DFS Imposes $250,000 Penalty for Cybersecurity Deficiencies
The New York Department of Financial Services entered into a consent order with a licensed money transmitter concerning alleged violations of New York's cybersecurity regulation, 23 N.Y.C.R.R. Part 500.
DFS alleged, among other things, that the company failed to maintain adequate cybersecurity policies governing system updates and had inadequate risk assessments, leaving it vulnerable to potential threat actors.
Under the consent order, the company agreed to pay a $250,000 penalty.
New York City Finalizes "Click-to-Cancel" Rule
The New York City Department of Consumer and Worker Protection (DCWP) has finalized a "Click-to-Cancel" rule governing automatic renewal and continuous service agreements.
The rule requires businesses offering covered subscriptions to provide clear disclosures and an easy method for consumers to cancel subscriptions and memberships. The New York City requirements apply in addition to requirements governing similar products under New York state law.
The rule takes effect October 1, 2026.
DCWP Click-to-Cancel Information:
Why It Matters
This week's developments demonstrate the breadth of state regulatory attention being directed toward consumer information and digital practices.
The challenges involving commercial driver and TANF data highlight growing disputes over government access to state-held personal information. At the same time, DFS's cybersecurity alert and recent enforcement action reinforce the importance of maintaining cybersecurity controls that address known vulnerabilities, third-party technology risks, system updates, and ongoing risk assessments.
New York City's Click-to-Cancel rule adds another compliance consideration for businesses offering automatic renewal and continuous service products. Companies operating in New York should review their subscription disclosures and cancellation processes before the rule's October 1 effective date.
Related Content
For additional analysis and ongoing coverage of state and federal developments, explore the following Hudson Cook and CounselorLibrary resources:
CounselorLibrary.com Reporters - In-depth coverage of enforcement, litigation, and regulatory trends impacting consumer financial services.
https://counselorlibrary.com/public/products-lr.cfm
State Watch - Timely updates on state-specific legislative and regulatory activity.
https://hudco.com/insights-subscribe.cfm
Upcoming Webinars - Practical insights and discussion on emerging issues, including recent Attorney General actions.
https://hudco.com/news.cfm?itemType=event
Hudson Cook will continue to monitor regulatory and enforcement developments across the Northeast.