MoFo’s State + Local Government Enforcement Newsletter (Winter 2026)

Keep up with the latest legal and industry insights, news, and events from MoFo

Estimated reading time: 15 minutes

Morrison Foerster’s State and Local Government Task Force is pleased to provide our quarterly newsletter summarizing some of the most important and interesting developments from state attorneys general (“State AGs”) across the country and local government agencies and legislative bodies, with links to primary resources. This quarter’s topics include the following:

Multi-state Matters

1. State AGs Collaborate on Merger Challenges, Antitrust Litigation, and Settlements

State AGs have recently teamed up to challenge mergers and alleged anticompetitive conduct. For example, on November 18, 2025, after the U.S. Department of Justice (DOJ) agreed to settle its challenge to Hewlett Packard Enterprise’s $14 billion acquisition of Juniper Networks, a federal judge in the Northern District of California granted a motion by 13 State AGs to intervene as parties in the case.[1] The State AGs had concerns about possible improper lobbying influence, which a former DOJ official alleged regarding the settlement.[2]

The court granted the State AGs permission to participate as parties in the Tunney Act review, which allows for scrutiny of DOJ settlements related to antitrust cases, to determine whether the settlement is in the public interest. The court did not, however, grant permission for the State AGs to pursue an independent challenge of the merger, ruling that they must file a separate intervention motion to do so. In its motion seeking entry of final judgment, DOJ remarked that the State AGs’ concerns regarding improper lobbying “fall largely outside the scope of the Tunney Act.”[3] The court also denied the State AGs’ hold-separate motion on January 8, 2026, noting that the State AGs failed to identify evidence of a concrete threat to competition in any particular market that would arise if the companies continue to combine during the Tunney Act proceedings.[4]

A similar group of State AGs filed an amicus brief in a lawsuit by junior hockey players alleging that the National Hockey League and its pipeline junior organizations reduce competition for labor.[5] The lawsuit alleges that the defendants violated the Sherman Act by agreeing to allocate the market into exclusive recruiting territories and suppressing competition for player services.[6]

A federal court in the Western District of Washington dismissed the case, ruling that the defendants, many of whom are based in Canada, lacked sufficient contact with Washington, and that even allocating the Washington market was insufficient contact because the scheme targeted all of North America.[7] The plaintiffs appealed to the Ninth Circuit, where the State AGs filed an amicus brief in support of the plaintiffs.[8] The State AGs argued that the dismissal—because the conspirators allegedly targeted the United States and another country—makes it harder for state antitrust enforcers to litigate market allocation claims and protect their citizens and residents. The Ninth Circuit has not yet ruled on the appeal.

Additionally, on November 18, 2025, a bipartisan group of nine State AGs reached a $7 million settlement with Greystar Management LLC, one of the property management companies named as a defendant in a lawsuit against AI software company RealPage.[9] The State AGs and DOJ allege that Greystar and other landlords violated the Sherman Act and state antitrust laws by sharing confidential pricing information and using RealPage’s AI software to raise rents.[10] As part of the settlement, Greystar agreed to stop using software offered by any company that uses competitively sensitive information to align rent prices and to cooperate in the ongoing prosecution of RealPage.

These actions highlight how antitrust risk comes from multiple fronts—not just federal regulators but increasingly assertive coalitions of State AGs—and across sectors, including technology, housing, and sports leagues. States are stepping in to challenge settlements, influence litigation, and extract meaningful remedies. This expanding enforcement landscape can affect deal timing, litigation exposure, and compliance obligations, making proactive, strategic antitrust planning more important than ever.

2. State AGs Target Plastic Waste and Toxic Chemical Contamination

On October 17, 2025, the California AG announced the conclusion of a multiyear investigation into plastic bag producers and whether the bags they sell in California are in fact “recyclable in the state,” as required under SB 270. The California AG reached a settlement with several manufacturers that includes monetary penalties and commitments to cease selling plastic carryout bags in California. The California AG also filed a lawsuit against other plastic bag manufacturers alleging the unlawful sale of non‑recyclable bags marketed as recyclable in violation of SB 270, the Environmental Marketing Claims Act, the False Advertising Law, and the Unfair Competition Law. Relying on CalRecycle data and other studies, the complaint asserts that, despite recyclability labels, plastic carryout bags are not being recycled at any meaningful rate in California and that billions of such bags instead end up in landfills, incinerators, or the environment.

In a related development that underscores State AG efforts to address perceived downstream environmental harms from manufactured products, on December 1, 2025, the Illinois AG announced a $120 million settlement with a chemical manufacturer and its affiliates over decades of production and disposal of polychlorinated biphenyls (PCBs). The settlement resolves a 2022 lawsuit alleging that the company knew PCBs were toxic while publicly downplaying their dangers, and that its operations enabled PCBs and other hazardous substances to contaminate Illinois waterways, soils, air, and aquatic life, leading to extensive fish consumption advisories and long-term impacts on natural resources. The complaint sought recovery of costs and damages to restore and replace injured natural resources under the Illinois Environmental Protection Act, the Fish and Aquatic Life Code, and common law theories including public nuisance.

Together, these actions illustrate how State AGs are using state consumer protection and environmental statutes to address environmental marketing practices and longstanding contamination, particularly where they perceive gaps in federal regulation or remediation efforts. Companies should ensure that environmental claims address state-specific requirements on recyclability and product stewardship, as State AGs are taking advantage of consumer protection laws to address environmental marketing and to remedy environmental impacts associated with legacy products and operations.

New York and California Developments

3. New York Enacts New Law Expanding New York AG Consumer Protection Authority

On December 19, 2025, the New York governor signed the Fostering Affordability and Integrity through Reasonable Business Practices Act (the “FAIR Business Practices Act”), which updates New York’s primary consumer protection law, General Business Law (GBL) § 349, for the first time in 45 years. In urging the passage of the FAIR Business Practices Act, the New York AG claimed that GBL § 349 failed to adequately cover a broad range of unfair and abusive conduct by companies (such as junk fees, hard-to-cancel subscriptions, and predatory lending tactics) that is covered by consumer protection laws in other states but not previously in New York.

The FAIR Business Practices Act amends GBL § 349 to prohibit “unfair” and “abusive” acts or practices, in addition to deceptive acts or practices. The Act defines “abusive” acts or practices to include conduct that materially interferes with a person’s ability to understand a product or service term or condition, or that takes unreasonable advantage of a person’s lack of understanding, inability to protect their interests, or reasonable reliance. The Act further adopts the Federal Trade Commission (FTC) Act’s “substantial injury” standard, which usually means a non-trivial monetary harm (or significant risk of such harm), such as financial loss or unwarranted charges, and can also include unjustified health or safety risks, and provides that “substantial injury” may include injury to persons other than consumers.

The FAIR Business Practices Act authorizes the New York AG to seek injunctive relief and restitution for acts or practices that violate the law, including against out-of-state entities conducting business or furnishing services in New York and against New York-based entities even where the relevant business or services are conducted outside New York. The Act also provides that violations are actionable by the New York AG regardless of whether the challenged conduct is “consumer-oriented”; however, Governor Hochul’s approval memorandum indicated that she will work with the State Legislature on amending this provision to ensure that the law does not override existing caselaw. Finally, the Act explicitly provides that the private right of action under GBL § 349 applies only to deceptive acts or practices, and not to unfair or abusive acts or practices.

The FAIR Business Practices Act becomes effective on February 17, 2026, 60 days after being signed into law. Especially given the Act’s coverage of “unfair” and “abusive” acts, companies should consider reviewing consumer disclosures, fee and pricing practices, marketing and promotional claims, and customer support and complaint-handling processes for compliance.

4. New York AG Brings Data Security Actions Against Car Insurers and Accounting Firm

On October 14, 2025, the New York AG announced $14.2 million in penalties and mandated remedial security measures for eight car insurance companies whose quote tools were compromised in a hacking campaign that exposed driver’s license numbers, dates of birth, and other data of more than 825,000 New Yorkers. Attackers allegedly exploited “pre-fill” functionality that pulled additional personal information from data brokers, then used some of the stolen data to file fraudulent unemployment claims during the COVID-19 pandemic. The settlements require the insurers to maintain comprehensive information security programs, data inventories, authentication procedures, and logging and monitoring systems, as well as stronger threat response procedures.

Six days later, the New York AG announced a settlement with an accounting firm following two cybersecurity incidents: a ransomware attack triggered by a phishing email and a separate incident involving a vendor employee’s unauthorized access to customer files. The firm allegedly took more than a year to notify those impacted, despite state requirements for prompt breach notification. The incidents exposed a range of sensitive data, including Social Security and driver’s license numbers, financial account information, and medical benefits details of more than 4,700 New Yorkers. The settlement requires maintaining a comprehensive information security program that includes encryption of personal information, access and authentication controls, vulnerability management, incident response planning, and employee cybersecurity training, along with a $60,000 penalty.

These actions reinforce the New York AG’s expectation that companies are required to deploy strong security controls for systems that handle New Yorkers’ personal information, such as online quote platforms and environments accessible to service providers, that they maintain robust data governance programs, and that they act swiftly in responding to incidents.

5. Trading Platform Challenges New York Gaming Commission over Federal Preemption

On October 27, 2025, trading platform Kalshi sued the New York State Gaming Commission, alleging that the Commission’s efforts to regulate Kalshi as an unlicensed mobile sports wagering operator intruded on the federal government’s exclusive authority to regulate derivatives trading on exchanges overseen by the Commodity Futures Trading Commission (CFTC).[11] Kalshi filed the lawsuit after receiving a letter from the New York State Gaming Commission on October 24, 2025, demanding that it cease and desist from operating an unlicensed mobile sports wagering platform in connection with any sports event. In the letter, the New York State Gaming Commission argued that, pursuant to New York’s Racing Law, it has general jurisdiction over all gaming activities within New York.[12]

Kalshi seeks a preliminary and permanent injunction and a declaration that New York’s Racing Law and any other law used to regulate its activities violate the Supremacy Clause of the Constitution. It alleges that the Commission’s “actions are preempted under the Supremacy Clause of the U.S. Constitution—both because Congress has expressly and impliedly occupied the field of regulating futures trading on CFTC-approved exchanges, and because Defendants’ acts would squarely conflict with federal law.” Kalshi noted that, earlier this year, federal courts in Nevada and New Jersey granted it preliminary injunctions to prevent similar state overreach.

This lawsuit reflects the uncertainty that can result when states assert jurisdiction in areas traditionally governed by federal law. Companies operating in heavily regulated markets may face overlapping or conflicting regulatory demands, especially as state enforcers seek to rein in the rapid growth of gaming platforms. In such an environment, it is important to continually assess federal preemption issues and monitor divergent state interpretations.

6. New York City Mayor and City Council Signal Intention to Aggressively Investigate Corporations

Newly inaugurated New York City Mayor Zohran Mamdani has signaled that corporate regulation will be a focus of his administration. On January 1, 2026, during his inaugural address, Mayor Mamdani criticized “wages that do not rise and corporations that rip off consumers and employees alike,” noting that his administration will “fight against corporate greed.” This pronouncement followed his earlier decision to name as co-chair of his transition team former Chair of the FTC Lina Khan, who has stated that she is reviewing local laws that Mayor Mamdani can unilaterally deploy to protect consumers, and appointing former FTC Bureau of Consumer Protection Director Sam Levine commissioner of New York City’s Department of Consumer and Worker Protection.

Separately, New York City Council Speaker Julie Menin has announced that she wants to use the Council’s subpoena powers to target “bad actor corporations.”

These developments signal a more aggressive and coordinated corporate regulatory environment in New York City, with heightened scrutiny of corporate practices affecting both consumers and employees. Mayor Mamdani’s focus on consumer protection, combined with the City Council’s intent to use its investigative subpoena powers, increases the likelihood of local investigations that can cause significant risk and reputational exposure.

7. California AG and San Diego City Attorney Secure $40 Million Provider-Directory Settlement

On October 13, 2025, the California AG and San Diego City Attorney’s Office announced a $40 million settlement against Health Net LLC and its subsidiaries to resolve allegations that Health Net maintained inaccurate provider directories in violation of the California Unfair Competition Law and False Advertising Law.

The California AG stated that “directories are a critical resource—they tell consumers which doctors and mental health practitioners will accept a particular health plan. If the directories are inaccurate, as Health Net’s were, consumers may suffer delays in finding care, or in some cases, may be unable to get vital care altogether.” The San Diego City Attorney noted that “[a]ccurate provider directories are critical for patients seeking care. When insurance companies misrepresent their networks, they create barriers that leave families scrambling and vulnerable patients without access to doctors they were promised.”

As part of the settlement, Health Net agreed to pay $12 million toward further enhancement of California consumer protection laws and invest $28.5 million in compliance programs to improve and maintain the accuracy of its provider directory. The compliance requirements include creating automated processes to remove duplicate, unlicensed, or deceased provider entries, and leveraging technology to verify the accuracy of providers’ contact information and of representations in each directory entry indicating whether a provider is accepting new patients.

This action underscores that regulators are willing to impose significant monetary remedies and mandate costly, ongoing compliance requirements when consumer-facing information is inaccurate. Companies in regulated industries should expect similar enforcement approaches across jurisdictions and should evaluate the reliability of public‑facing data, the robustness of internal controls, and the defensibility of their compliance programs to mitigate the risk of investigations and settlements.

State-Federal Government Developments

8. Presidential Executive Order Targets State AI Laws amid State AG Opposition

On December 11, 2025, President Trump signed an Executive Order titled “Ensuring a National Policy Framework for Artificial Intelligence,” which seeks to establish a single national standard for artificial intelligence (AI) regulation and to limit what the Order characterizes as “excessive” state AI laws. (Read our full analysis of the Executive Order.) The Order takes the position that competitive AI innovation requires avoiding “cumbersome” regulation, criticizes certain state laws as embedding “ideological bias” or regulating beyond state borders, and directs the attorney general of the United States to create an AI Litigation Task Force to challenge state AI laws viewed as inconsistent with federal policy. The Order also instructs federal agencies, such as the Department of Commerce, to identify “onerous” state AI requirements and to consider using funding conditions, rulemaking, and litigation to address conflicts with federal policy. In addition, the Order calls for a uniform federal AI framework that would preempt conflicting state laws, while specifying that otherwise lawful state measures relating to child safety, state government use of AI, and certain infrastructure issues are exempt from preemption.

The Executive Order follows a November 25, 2025 letter from a bipartisan coalition of 36 State AGs urging congressional leaders to reject a federal moratorium on state AI laws.[13] In that letter, the State AGs warned that AI is already causing serious harm to consumers and children, and argued that states need to be able to enforce existing laws and adopt new ones that respond to emerging risks. The State AGs pointed to state laws addressing these risks, including AI-generated explicit material and deepfakes, deceptive practices targeting voters and consumers, algorithmic rent-setting, spam calls and texts, and disclosures for AI interactions, and cautioned that broad federal preemption would undermine this important work.

The State AGs’ letter and the Executive Order reflect growing momentum toward a federal AI framework but leave unresolved questions regarding the practical reach of federal preemption. The Executive Order seeks to advance a national standard and establishes mechanisms to challenge or limit state AI laws, yet it does not itself displace those laws and expressly contemplates preserving certain areas, such as child safety, where much of the current state-level AI activity is focused. In the near term, companies developing or deploying AI should expect to navigate both a patchwork of state AI requirements and a developing federal effort to centralize AI regulation.

9. State AGs Challenge Decision Not to Fund the Consumer Financial Protection Bureau

On December 22, 2025, a coalition of 22 State AGs filed a lawsuit in federal court seeking to block the Trump administration’s efforts to withhold funding from the Consumer Financial Protection Bureau (CFPB), arguing that failure to fund the agency undermines its statutory mandate to enforce federal consumer financial laws and assist states in protecting their residents. The complaint, filed in the U.S. District Court for the District of Oregon, targets the White House and the acting CFPB director over an interpretation of the Dodd-Frank Act’s funding mechanism that would effectively leave the CFPB without operating funds as early as 2026. Under their interpretation, the CFPB should not seek funding for its operations because appropriations are unavailable when the Federal Reserve is operating at a loss, which is purportedly the case based on current earnings, because the Federal Reserve has reported no “combined earnings” available for appropriation. The State AGs contest whether such a loss exists, contend that this refusal to seek adequate funding violates the Constitution and Congress’s intent in creating the CFPB, and assert that a functioning CFPB is essential for addressing predatory financial practices and sharing critical consumer complaint information with state authorities.

The state lawsuit argues that without enforcement capacity at the CFPB, millions of consumer complaints go unaddressed, and federal consumer protection efforts are effectively crippled, leaving states to fill the enforcement void. Similar coordinated state actions earlier in 2025 included amicus briefs and litigation opposing efforts to dismantle or defund the CFPB, with 23 State AGs joining in related cases challenging the administration’s shutdown of CFPB activities and warning of harms to consumers in the absence of robust oversight of financial institutions. This lawsuit is indicative of a broader trend in which State AGs and state financial regulators are increasingly stepping into consumer protection matters.

[1] United States v. Hewlett Packard Enter. Co., Case No. 5:25-cv-00951-PCP (N.D. Cal.), Dkt. No. 332. The State AGs that intervened in the action are from the following states: California, Colorado, Connecticut, Hawaii, Illinois, Massachusetts, Minnesota, New York, North Carolina, Oregon, Washington, Wisconsin, and the District of Columbia.

[2] Case No. 5:25-cv-00951-PCP, Dkt. No. 236.

[3] Case No. 5:25-cv-00951-PCP, Dkt. No. 351.

[4] Case No. 5:25-cv-00951-PCP, Dkt. No. 359.

[5] The State AGs that signed the amicus brief are from the following states: California, Colorado, Delaware, Illinois, Maryland, Michigan, Minnesota, New Mexico, New York, Oregon, Pennsylvania, Rhode Island, Vermont, Washington, and the District of Columbia.

[6] World Ass’n Icehockey Players Unions N. Am. Div. v. Nat’l Hockey League, Case No. 2:24-cv-02135 (W.D. Wash.), Dkt. No. 1.

[7] Case No. 2:24-cv-02135, Dkt. No. 169.

[8] World Ass’n Icehockey Players Unions N. Am. Div. v. Nat’l Hockey League, Case No. 25-03929 (9th Cir.), Dkt. No. 31.1.

[9] United States v. RealPage, Inc., Case No. 1:24-cv-00710-WO-JLW (M.D.N.C.), Dkt. No. 159-1. The State AGs that brought the lawsuit are from California, Colorado, Connecticut, Illinois, Massachusetts, Minnesota, North Carolina, Oregon, and Tennessee.

[10] Case No. 1:24-cv-00710-WO-JLW, Dkt. No. 47.

[11] KalshiEX LLC v. Williams, Case No. 1:25-cv-08846 (S.D.N.Y.), Dkt. No. 1.

[12] Kalshi has been embroiled in lawsuits making similar claims to those in the cease-and-desist letter. For example, the Massachusetts AG sued Kalshi in Massachusetts state court in September 2025, alleging that Kalshi is promoting and accepting online sports wagers without a license. Tribes in California and Wisconsin have also brought lawsuits seeking injunctions preventing Kalshi from offering sports contracts on their lands. Blue Lake Rancheria et al. v. KALSHI INC., Case No. 3:25-cv-06162-JSC (N.D. Cal.), Dkt. No. 1; Ho‑Chunk Nation v. Kalshi Inc., Case No. 3:25-cv-00698-WMC (W.D. Wis.), Dkt. No. 1.

[13] The State AGs that did not sign the letter are from the following states: Alabama, Alaska, Arkansas, Colorado, Florida, Georgia, Iowa, Kentucky, Missouri, Montana, Nebraska, North Dakota, Oklahoma, South Dakota, Texas, Virginia, West Virginia, and Wyoming.