Morrison Foerster’s State and Local Government Task Force is pleased to provide our bimonthly newsletter summarizing some of the most important and interesting developments from state attorneys general (State AGs) across the country and local government agencies and legislative bodies, with links to primary resources. This month’s topics include the following:
- State AGs Join Anti-DEI Enforcement Efforts Following Executive Orders
- Texas AG Files First Lawsuit Under State Data Privacy Law
- Coalition of State AGs Sues New York Regarding Environmental Fund
- NYAG Sues Nation’s Largest Vape Distributors
- Cryptocurrency Exchange Pleads Guilty to Criminal Charges with $297 Million Fine Following NYAG Enforcement Action
1. State AGs Join Anti-DEI Enforcement Efforts Following Executive Orders
Following a series of executive orders by President Trump related to DEI programs, certain State AGs have intensified attacks on corporate DEI programs. While a federal district court recently issued a nationwide injunction temporarily preventing enforcement of three key provisions of Trump’s executive orders, certain State AGs continue to pursue enforcement actions against companies for their “illegal” DEI programs.
On February 11, 2025, the Missouri AG Andrew Bailey filed suit against Starbucks alleging that Starbucks’s DEI program violates state and federal anti-discrimination laws. More specifically, the lawsuit alleges that the company’s DEI program has led to slower service and higher prices for consumers because the company does not recruit the most qualified workers. The lawsuit further alleges that Starbucks policies violate federal and state civil rights laws by having race- and sex-based preferences in hiring, promotions, and the selection of board members. The Missouri AG relies on the holding in Students for Fair Admissions, Inc. v. Pres. and Fellows of Harvard College,[1] for the proposition that “federal law does not tolerate differential treatment based on race.” Notably, the lawsuit identifies Starbucks as a federal contractor, which could subject its diversity program to additional scrutiny by the federal government.
Previously, on January 23, 2025, a coalition of State AGs from 10 states, led by Texas AG Ken Paxton, wrote a letter to six major U.S. financial institutions, warning that their DEI and ESG commitments could lead to enforcement actions. Specifically, the Texas AG claims that the financial institutions have embraced “race-and-sex-based quotas” and make investment decisions “in the furtherance of political agendas,” which might violate federal and state laws. The Texas AG invited these firms to answer a series of questions regarding their policies “to avoid a lengthy enforcement action.” The letter included an attachment of questions for each specific financial institution related to its DEI and ESG practices.
Although the recent injunction provides a temporary pause at the federal level, the risk of DEI enforcement remains at an all-time high. Accordingly, companies should consider taking the action steps discussed in our DEI Strategy + Defense Task Force’s alerts (here and here), including auditing their DEI programs under privilege for potential risks while not overcorrecting.
2. Texas AG Files First Lawsuit Under State Data Privacy Law
On January 13, 2025, Texas AG Ken Paxton filed a lawsuit against a large insurance company and its subsidiary data analytics company for allegedly collecting, using, and selling the geolocation and movement of Texan drivers. The action is the first lawsuit under the recently enacted Texas Data Privacy and Security Act (TDPSA) and includes alleged violations of the Texas Data Broker Law.[2]
More specifically, the lawsuit alleges that the company developed software that, unbeknownst to the user, harvested data, including geolocation and accelerometer data. According to the Texas AG’s complaint, the company “covertly collected” and shared sensitive consumer data through software embedded in various mobile apps. The complaint further alleges that this software allowed the company to “secretly collect and sell” consumers’ “driving behavior” data, which the company (and competitors) then used to “justify increasing consumers’ car insurance premiums, denying coverage, or dropping them from coverage.” The complaint also alleges that the insurance company, through its subsidiary data analytics company, paid app developers millions of dollars to integrate its software into the developers’ mobile apps.
The TDPSA requires businesses to provide clear privacy notices, obtain explicit consent for collecting sensitive data, and offer consumers an opt-out mechanism for data sales. The Texas AG’s lawsuit alleges that the subsidiary data analytics company failed to provide consumers with a privacy notice and that many, if not all, consumers were unaware that the company was processing their sensitive data. The lawsuit further alleges that the company failed to provide consumers with notice of how to opt out of processing their data and failed to register as a data broker with the Texas Secretary of State.
While this suit is the first lawsuit alleging violations of the TDPSA, the Texas AG has made clear that data privacy compliance is a priority. In June 2024, the Texas AG launched a broad-reaching privacy and security initiative to enforce Texas data protection laws, including, but not limited to, the TDPSA, the Data Broker Law, and Texas’s biometric data privacy statute, namely, the Capture or Use of Biometric Identifier Act.[3] This initiative involved the establishment of a team within the Texas AG’s Consumer Protection Division that will focus on aggressive enforcement of Texas privacy laws. AG Paxton emphasized that this team is “poised to become among the largest in the country focused on enforcing privacy laws.”
3. Coalition of State AGs Sues New York Regarding Environmental Fund
On January 30, 2025, 22 State AGs sued the State of New York regarding a new state law that established a fund to cover alleged damages incurred due to climate change that they claim is unconstitutional.[4] The Climate Change Superfund Act (the Superfund Act), enforced by the New York State Department of Tax and Finance and the NYAG, authorizes the state to levy billions of dollars in penalties on parties “engaged in the trade or business of extracting fossil fuel or refining crude oil” and deemed to account for more than one billion metric tons of certain greenhouse gas emissions.
The 22 State AGs, along with energy industry associations and coal companies, allege that the Superfund Act’s unlawful “overreach” imposes billions in retroactive fines on energy producers and would be “devastating to traditional energy producers” and “could force coal, oil, and natural gas producers to shutter altogether.” The coalition argues that the Superfund Act violates multiple provisions of the U.S. Constitution, including the commerce clause, equal sovereignty, and equal and due process protections.
Other states, including California, are considering similar “superfund” legislation as a way to mitigate the cost of a warming climate. While the ultimate legal status of the Superfund Act remains uncertain and will likely continue to face legal challenges and political barriers, this type of statute marks a significant escalation in environmental regulation. This escalation constitutes an emerging regulatory risk for certain energy sectors, such as fossil fuel companies, the industrial agriculture sector, and the plastics industry.
4. NYAG Sues Nation’s Largest Vape Distributors
New York AG (NYAG) Leticia James filed a lawsuit against 13 e-cigarette manufacturers, distributors, and retailers (the Vaping Companies) for their alleged role in “fueling the youth vaping epidemic.” The lawsuit alleges that the companies are illegally selling and marketing their products—e‑cigarettes or vapes—to underage users and “create[] road misapprehensions about the legality and safety of the Flavored E-Cigarettes.” In a statement announcing the lawsuit, the NYAG stated that the vaping industry was “taking a page out of Big Tobacco’s playbook” by “making nicotine seem cool.” The lawsuit seeks, among other things, an injunction prohibiting the Vaping Companies from selling flavored e-cigarettes in the State of New York.
The 200-page complaint includes allegations that the Vaping Companies used fraudulent commercial and marketing conduct to convince consumers that flavored e-cigarettes are “casual fun” and to “lure impressionable adolescents” with a variety of flavors. The complaint further alleges that the Vaping Companies violate New York law, including several laws enacted recently to curb youth vaping. Moreover, the complaint alleges that the Vaping Companies have ignored FDA warning letters and regulations, as well as the federal Prevent All Cigarette Trafficking (PACT) Act.
Notably, the NYAG is seeking significant financial penalties and restitution from the Vaping Companies. In addition to pursuing disgorgement of all revenue earned as a result of the alleged illegal activity, the NYAG is seeking the creation of an abatement fund with “sufficient capital to eliminate the public nuisance” caused by the Vaping Companies. Overall, the NYAG is seeking hundreds of millions of dollars in penalties and damages from the Vaping Companies.
As vaping continues to be seen as a public health issue, especially for teens and young adults, State AGs are expected to continue targeting distributors and manufacturers in the vaping industry. Earlier this year, California AG Rob Bonta sued popular e-cigarette brands for importing and selling flavored e‑cigarettes in California and targeting youth. Moreover, last September, a coalition of State AGs filed an amicus brief urging the U.S. Supreme Court to uphold the Food and Drug Administration’s (FDA) denials of applications to market flavored e‑cigarettes.[5]
As the FDA’s power to regulate e-cigarettes waits on a decision from the Supreme Court, State AGs are likely to continue to prioritize enforcement actions against flavored e-cigarettes.[6]
5. Cryptocurrency Exchange Pleads Guilty to Criminal Charges With $297 Million Fine Following NYAG Enforcement Action
On January 27, 2025, KuCoin, one of the largest cryptocurrency exchanges in the world, pled guilty in federal court in the Southern District of New York to one count of operating an unlicensed money transmitting business and agreed to pay penalties totaling nearly $300 million. KuCoin, among other things, failed to implement effective anti-money laundering (AML) and know-your-customer (KYC) programs as required by the Bank Secrecy Act, which are designed to prevent financial institutions, such as KuCoin, from being used for money laundering and other criminal activity. KuCoin also pled guilty to failing to register with the U.S. Department of Treasury’s Financial Crimes Enforcement Network (FinCEN).
The criminal charges against KuCoin were filed just a few months after the NYAG secured more that $22 million in a settlement from the crypto exchange. The NYAG brought an enforcement action against KuCoin in 2023 for failing to register as a securities and commodities broker-dealer and for falsely representing itself as a crypto exchange. The ensuing consent order required the company to refund over 150,000 investors more than $16.7 million and pay more than $5.3 million to the state, and the company was prohibited from offering its services in the state of New York.
In connection with the guilty plea, KuCoin agreed to pay monetary penalties totaling more than $297 million, including forfeiting nearly $185 million. While KuCoin’s co-founders were indicted in March 2024, the U.S. Attorney’s Office for the Southern District of New York has agreed to defer prosecution against them for two years.
This case highlights the need for companies to balance both sets of laws and regulations at the federal and state levels as federal regulators and State AGs aggressively pursue enforcement in the cryptocurrency space.
[1] 600 U.S. 181, 206 (2023).
[2] Tex. Bus. & Com. Code § 509.001.
[3] Tex. Bus. & Com. Code § 503.001.
[4] The complaint was filed by the Attorneys General for Alabama, Arkansas, Georgia, Idaho, Iowa, Kansas, Kentucky, Louisiana, Mississippi, Missouri, Montana, Nebraska, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, West Virginia, and Wyoming.
[5]The amicus brief was filed by the Attorneys General for Arizona, California, Colorado, Connecticut, the District of Columbia, Hawaii, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, New Jersey, New York, North Carolina, Oregon, Pennsylvania, Rhode Island, Vermont, and Washington.
[6] See Food and Drug Administration v. Wages and White Lion Investments, LLC, No. 23-1038 (S. Ct. filed Mar. 19, 2024). The Supreme Court will decide the issue of whether the FDA’s denial of White Lion’s application to market flavored e-cigarette products was arbitrary and capricious. The Supreme Court’s ruling in this FDA case is expected to have far-reaching consequences, including clarifying the FDA’s authority under the Tobacco Control Act (TCA) in the wake of the Supreme Court’s decision eliminating Chevron deference in Loper Bright Enterprises v. Raimondo, 144 S. Ct. 2244, 2273 (2024). It is possible that the decision in White Lion could limit the FDA’s ability to regulate tobacco products, especially e-cigarettes and other products.
[View source.]
