If you think misclassifying your workers is just a rounding error, New Jersey’s balance sheet proves you wrong. The New Jersey Labor Commissioner recently reported that New Jersey has collected about $84 million in back wages and penalties since 2018 for violations like wage theft and misclassification. New Jersey also wields powerful enforcement tools. Nearly 200 stop‑work orders have been issued to companies that violated labor laws, and 261 businesses currently sit on the “Workplace Accountability in Labor List” owing a collective $25 million in unpaid wages, fines and penalties. If that’s not enough to get your attention, consider that Lyft alone recently paid $19.4 million to New Jersey’s trust funds after an audit found it misclassified more than 100,000 drivers and failed to pay into unemployment, temporary disability and family leave funds. This figure includes more than $10 million in back contributions plus $8.5 million in penalties and interest. Why Employers Need to Care Proper classification is about protecting your business. If you misclassify an employee as an independent contractor, you will be liable for unpaid wages, overtime, workers’ compensation premiums, unemployment taxes, family‑leave contributions and penalties. Misclassification claims are also routinely rejected by insurance companies under Employment Practices Liability Insurance policies because those policies only cover employees. Worse still, these kinds of issues may make your business unsellable as a prospective buyer gives you a haircut on a sale price or passes altogether as your business model carries too much risk. Knowing your ABCs As in most states, New Jersey automatically assumes a worker is an employee once you pay them anything of value; it’s up to you to prove otherwise. Even having the worker form an LLC, issuing a 1099, or making a worker buy insurance does not magically turn them into a contractor. New Jersey courts interpret the law liberally to protect workers, so borderline cases usually go in favor of employment. New Jersey uses a strict ABC test to determine whether someone is truly an independent contractor. The statute says a worker is an employee unless the business can prove all three of these conditions. A — Free from control. The worker must be free from control or direction over how they perform the service. If you set their hours, supply mandatory tools or software, require uniform check‑ins or supervise their methods, you fail the test. B — Outside the usual course or location of the business. The work must be outside the company’s usual course of business or performed away from all the company’s business location. Hiring someone to paint your office qualifies; hiring someone to do what your company actually sells does not. Work done at customer sites counts as “your place of business” if it is integral to your operations. C — Independently established business. The worker must run their own independently established business that will continue after your project end. Factors include having multiple clients, advertising services, investing in tools or equipment and bearing the risk of profit or loss. If ending the relationship would put them out of work, this prong fails too. Because the law is remedial, courts interpret the ABC test broadly. If you control the worker’s schedule, if the work is part of your business, or if the worker depends on you for their livelihood, you have a misclassified IC. Penalties and Enforcement Tools Are a Major Headache New Jersey backs its rules with hefty penalties. For each misclassified worker, the Commissioner may assess an administrative penalty of up to $250 for a first violation and up to $1,000 for each subsequent violation. There is also an additional penalty of up to 5 % of the worker’s gross earnings over the previous 12 months, payable directly to the worker. Factors like past history, seriousness of the violation and the size of the employer determine the exact amount. Beyond monetary fines, the state can issue stop‑work orders that halt business operations until violations are corrected. Businesses must also post notices informing workers about the ABC test and their right. Failure to post notices or retaliating against employees who complain about misclassification can result in additional fines, reinstatement and punitive damages. Getting Classification Right is Easy Run through the ABC checklist before hiring. If the worker fails any prong, treat them as an employee. When in doubt, err on the side of employment. Match practice to paperwork. A written contract is useful, but it won’t override how you actually direct and pay a worker. Ensure your day‑to‑day practices support independent status. Remove control and promote independence. If you truly need a contractor, make sure they operate as one. Allow them to set their own schedules, work without micromanagement or significant guidance, work for other clients and supply their own tools. Consult official resources. The NJDOL provides a worker‑classification questionnaire and guidance on the ABC test here. You can also contact the Department for advice on specific situations. Email us at employment@olenderfeldman.com with any further questions.

As artificial intelligence (AI) and machine learning (ML) become central to modern technology services, vendors increasingly rely on these systems to refine performance and deliver greater value. Yet many customer contracts now restrict or prohibit vendor data use—limiting the very learning that drives product improvement. These provisions can unintentionally compromise a vendor’s intellectual property, scalability, and enterprise value. Vendors should proactively negotiate data-use rights that protect both innovation and customer confidence. Clear, limited licenses—coupled with confidentiality safeguards—allow vendors to evolve their tools responsibly while maintaining legal compliance and client trust. Protecting the Vendor’s Right to Learn Machine learning tools depend on exposure to data to improve accuracy, efficiency, and reliability. In early AI adoption, vendors addressed this need through contractual language granting limited licenses to use customer data for system improvement and benchmarking. This structure balanced the vendor’s need to innovate with the customer’s need for confidentiality and control. In recent years, however, large enterprise customers—particularly in regulated industries such as life sciences and financial services—have adopted more restrictive terms. Many contracts now prohibit any vendor data use beyond the direct performance of services. While the intent is to protect sensitive information, the effect often undermines the vendor’s operating model. Because ML systems cannot easily isolate data on a customer-by-customer basis, these prohibitions can render the technology nonfunctional. Vendors risk breach of contract by allowing their tools to learn, or they must disable learning altogether. Both outcomes reduce system efficacy and long-term value. Addressing Customer Concerns Customer hesitation is understandable. Organizations do not want proprietary data indirectly benefiting competitors. However, most vendor use of data is indirect, anonymized, and statistical. These systems identify trends and performance patterns—they do not expose client-specific information. Effective communication can bridge this gap. When vendors involve both legal and technical stakeholders in negotiation, customers are more likely to appreciate the limited and controlled nature of AI-driven data use. Essential Contractual Safeguards To preserve operational flexibility and enterprise value, vendors should incorporate the following elements into customer agreements: Limited Improvement License – Permit the vendor to use, process, and analyze customer and system-generated data to operate, secure, and improve the services, develop enhancements, and create de-identified analytics or benchmarks. Carve-Out from Conflicting Clauses – Ensure these rights are expressly excluded from broad confidentiality or “sole use for customer” provisions. Defined Safeguards – Require de-identification, aggregation, and strict prohibitions on re-identification or customer-specific disclosures. Ownership Clarity – Confirm that the customer retains ownership of its data, while the vendor owns its models, methodologies, and derivative works (with a license to such data solely to the extent necessary for the use, exploitation, or creation of such models, methodologies, or derivative works). Regulatory Compliance – Align data-use rights with applicable data privacy, protection, and security standards. AI and ML systems deliver continuous value through learning. Restricting that learning not only weakens the technology but also erodes the vendor’s strategic and financial position. Protecting data-use rights through disciplined contract negotiation ensures compliance, builds customer trust, and preserves enterprise value. OlenderFeldman LLP has extensive experience structuring and negotiating these provisions to protect vendor assets and preserve long-term value. For counsel or collaboration, contact Craig D. Bronsnick at cbronsnick@olenderfeldman.com.

While compliance with traditional “Do Not Track” (DNT) browser settings remains optional under U.S. privacy law, and many Privacy Policies still note that DNT signals are not honored, a new and far more consequential requirement has arrived. A growing number of state privacy statutes now mandate compliance with Universal Opt-Out Mechanisms (UOOMs) - browser or device-level settings that automatically communicate a consumer’s request to opt out of the sale, sharing, or use of their personal data for targeted advertising or profiling. When such a signal (for example, the Global Privacy Control (GPC)) is sent, covered businesses must automatically recognize and process that preference without requiring any further action by the user. Failure to do so could expose a company to enforcement risk under multiple state laws. States Where UOOM Compliance Is Required As of October 2025, the following states have enacted laws requiring businesses to recognize and honor universal opt-out signals: California (CCPA / CPRA / California Opt Me Out Act (COMOA)) Colorado (Colorado Privacy Act) Connecticut (Connecticut Data Privacy Act) Delaware (Delaware Personal Data Privacy Act – effective January 1, 2026) Maryland (Maryland Online Data Privacy Act (MODPA)) Montana (Montana Consumer Data Privacy Act) Oregon (Oregon Consumer Privacy Act – effective January 1, 2026) Texas (Texas Data Privacy and Security Act (TDPSA) Understanding Your Obligations “Do Not Track” vs. Universal Opt-Out Mechanisms: “Do Not Track” (DNT) requests remain optional, but Universal Opt-Out Mechanisms (UOOMs), including the GPC, are legally binding in several jurisdictions (see below). Businesses can no longer disclaim compliance in these states. Controller vs. Processor Responsibilities: UOOM duties generally apply to controllers, entities that determine the purposes and means of processing personal data. However, joint-controller or service-provider relationships may blur this line; both parties should define their responsibilities contractually and ensure their systems implement consistent signal recognition. When the Requirement Does Not Apply: If an organization does not sell or share personal information (which has a broad definition and includes trackers such as cookies – which can make this the key to any analysis), engage in cross-context advertising, or conduct profiling that has legal or significant effects, then UOOM obligations may be largely moot. Nonetheless, your Privacy Policy should still explain that you either recognize such signals but have no qualifying processing activities, or that they are not applicable. Recent Legislative Developments and Effective Dates California In October 2025, California enacted the California Opt Me Out Act (COMOA), making it the first state to require browsers to include a built-in universal opt-out function and obligating websites to recognize those signals. COMOA becomes effective January 1, 2027, and while it does not change the underlying opt-out rights under the CCPA/CPRA, it standardizes the mechanism for communicating them. Delaware and Oregon Both the Delaware PDPA and Oregon CPA will require UOOM recognition starting January 1, 2026, joining states such as Colorado and Connecticut that already mandate GPC recognition. Texas The TDPSA mirrors the Virginia framework but applies to any business operating in or targeting Texas consumers (excluding “small businesses” as defined by the SBA). Texas requires companies to recognize UOOMs such as the GPC beginning January 1, 2025, and to disclose how such signals are handled. Maryland The MODPA has lower applicability thresholds, covering entities that control or process data for more than 35,000 consumers (or 10,000 if 20%+ of revenue derives from data sales), and explicitly requires controllers to recognize UOOMs as a valid opt-out for targeted ads, sales, and profiling that produces legal or significant effects. Practical Compliance Steps Technical Detection and Signal Processing Compliance requires more than a banner or cookie notice. Websites, advertising platforms, and consent management tools must detect, interpret, and apply UOOMs automatically. Work with your web development and ad-tech teams to confirm end-to-end recognition and auditing capability. Update Privacy Policies and User Interfaces Privacy policies should clearly state: that your organization recognizes UOOMs in applicable jurisdictions; the specific signals supported (e.g., GPC); how quickly opt-outs are processed; and how signal-based opt-outs interact with account settings or cookie preferences. Coordinate with Vendors and Downstream Partners Controllers must ensure that processors and third-party vendors honor UOOM choices. Review data-processing agreements to mandate downstream compliance and document signal transmission flows. Maintain Audit and Logging Procedures Regulators increasingly expect documented proof of UOOM recognition and action. Maintain timestamped records of each signal received and system response for audit defensibility. Recommended Implementation Approach Assess Applicability: Identify where you qualify as a controller under each state law and whether the activities involve targeted advertising or data sharing. Design for the Strictest Standard: Many businesses choose to apply the most restrictive rule nationwide (i.e., honor UOOM signals universally) to simplify compliance and reduce risk Implement Technical Recognition: Enable automatic detection of GPC/UOOMs across web properties and tag managers. Review and Update Policies: Clarify your handling of UOOM signals and update your public-facing Privacy Policy accordingly. Test and Train: Run periodic audits and staff training to ensure consistent implementation. Conclusion The era of optional “Do Not Track” compliance is effectively over. Universal Opt-Out Mechanisms are now a binding component of many state privacy laws. Organizations must move quickly to align technical infrastructure and contractual arrangements to meet these new expectations. OlenderFeldman LLP regularly assists clients with privacy policy drafting, cookie and consent management implementation, and cross-state compliance planning. For further guidance or implementation support, please contact: Michael J. Feldman, Esq. (mfeldman@olenderfeldman.com) or Niharika Reddy, Esq. (nreddy@olenderfeldman.com).

For many professionals — lawyers, doctors, accountants, architects, and others — being invited to become a partner in your firm is the proverbial brass ring. It signifies the firm’s recognition of your skill, leadership, and individual contribution to the firm’s success. But it’s also a business decision, and one that carries both rights and obligations that will have a lasting impact on your practice. With partnership announcement season underway, now is the ideal time for young professionals to take stock of what joining a partnership means for continued professional growth and financial success. Here are five key issues a young professional should consider before accepting a partnership offer. Governance and Your Voice in the Firm Every firm handles governance differently—some firms centralize decision-making in an executive committee or a managing partner, while others delegate authority more broadly across the partnership based on individual partner expertise and interest. Becoming an owner doesn’t automatically mean having a meaningful voice in how the firm is run. It’s important to get involved in the governance process early – both to demonstrate your commitment to the firm’s long term success and to ensure that your perspective is meaningfully reflected in decision-making. Be sure you understand how decisions are made, where you fit into that process, and how your voice will be heard. Compensation Arrangements and Profit Participation Compensation structures often change at the partner level. For many new partners, compensation transitions from a predictable salary to distributions tied to the firm’s performance. This model creates exciting opportunities to share in the financial upside of the business you help build. Be sure you understand how profits are allocated among partners and whether the firm’s compensation model is formula-based, discretionary, or a hybrid model. Ask to review historical financials and request a pro forma compensation projection. A clear understanding of your compensation package will give you a strong foundation for financial success. Capital Contributions and Financial Commitments Many firms require new partners to make an initial capital contribution — your investment in the firm’s future. Other firms may also ask partners to share financial responsibilities via a personal guaranty of an office lease or line of credit. These obligations represent real financial exposure, however, many firms understand that young partners have limited resources and offer flexible ways to fund these obligations. Ask whether there is a required capital contribution and, if so, how it is funded — through a cash payment, payroll or profit distribution deduction, a personal note or a bank loan. Be sure you understand whether future capital calls may be made, who has the power to call them, and what happens if you don’t (or can’t) fund. Understanding the scope of these commitments will allow you to align your personal financial interests with your professional obligations. Accounts Receivable and Firm Economics A professional firm’s financial health is closely tied to its accounts receivable. Some firms allocate responsibility for uncollected A/R to both current partners and departing (or retiring) partners. Be sure you understand whether partners are personally responsible for bad debt or client write-offs, how receivables are handled when a partner joins or leaves, and whether you could be required to fund reserves or bridge a gap between operating expenses and uncollected A/R, so that you can participate more effectively in your firm’s financial management and strategic planning. Exit Options and Long-Term Flexibility No one joins a partnership expecting to leave, but it’s essential to understand your exit path if life changes and you need to make a move. A transparent, respectful exit structure is often a hallmark of a thriving firm culture. Understanding how resignation, retirement, or removal is handled can provide peace of mind. Look for clear timelines, fair repayment of capital, and thoughtful transition expectations. Review any restrictive covenants to ensure they align with your career goals and industry norms. Final Thoughts Becoming a partner is a major professional achievement, but it’s also an investment — in your firm, in your colleagues, and in your own future. The best partnerships are built on transparency, fairness, and shared expectations. Don’t hesitate to ask questions and consult with your own attorneys or accountants before accepting a partnership offer. Taking the time now to confirm that those principles are reflected in your firm’s partnership agreement will help your new role feel like the milestone it’s meant to be. Proactive legal guidance can help you evaluate a partnership offer with clarity and confidence so you can stay focused on building your practice. OlenderFeldman LLP regularly advises new and prospective partners on the terms of partnership and related risks. If you are considering a partnership opportunity and want a practical, business-minded review of your offer, please contact: Jillian Benda Goldberg (jgoldberg@olenderfeldman.com).

Contracts are designed to bring clarity and structure to business relationships. Yet anyone who has revisited a contract years after it was signed knows that even well-drafted agreements can take on meanings no one anticipated at signing. Most people assume contracts say what they say. Lawyers know better. A contract may look perfectly straightforward on Tuesday afternoon, only to reveal on Wednesday morning that it secretly contains three different meanings, two contradictory obligations, and a clause that suddenly seems to have rewritten itself. Welcome to the world of contract ambiguity, where a single comma can start a dispute and the phrase “and/or” can launch a thousand billable hours. So when does a contract not say what it says? The short answer: whenever the language allows more than one interpretation. The long answer: usually at the worst possible moment. Here are a few examples of how this issue appears in practice. Ambiguity often hides in plain sight. A provision stating that “payment is due after delivery is complete” may appear clear, yet completion may reasonably mean physical delivery to a site, inspection and acceptance, or final installation. Each interpretation is plausible on its face, but each triggers payment at a different time. Ambiguity also arises when provisions quietly conflict with each other. One clause may require performance “in accordance with industry standards,” while another demands “strict compliance with all specifications,” leaving courts to determine which obligation controls when those standards diverge. That determination may not align with either party’s expectations at signing. And then there is “and/or.” A phrase intended to cover all possibilities, but which often creates more uncertainty than clarity. If a contract requires a party to obtain “approval and/or certification,” what does that really mean? Approval alone? Certification alone? Both? Either? Or all of the above, depending on the moment? Once a dispute arises, each side will confidently insist that their interpretation is the obvious one. Meanwhile, the court will wonder why this phrase exists at all when the English language already offers clearer alternatives such as “either” or “both.” Once a judge decides a provision is ambiguous, the analysis shifts from “what did the contract say?” to “what did the parties intend?” This is generally the last place anyone wants to be. At that point, old drafts, emails, meeting notes, and memories that nobody planned to revisit become interpretive tools. The goal is to uncover the parties’ shared intent, but relying on recollection and context years later is inefficient, unpredictable, and expensive. The better approach is to prevent ambiguity from sneaking in at all. Clarity is the best antidote. Define the terms that matter. Avoid compound phrasing that tries to be everything to everyone. Ensure provisions are consistent. Use examples when concepts get complicated. And whenever you find yourself typing “and/or,” ask whether you want the future litigators involved to start writing a novel about your intent. A helpful test is this: Would a neutral reader with no context understand this sentence the way you intend? If the answer is yes, you have likely succeeded. If the answer is no, revise now rather than debate later. Contracts work best when they say what they mean. When they don’t, courts must fill in the blanks, and the results may surprise everyone involved. A bit of precision at the drafting stage prevents a great deal of interpretation, and far more headaches, later. If you would like help reviewing language for hidden ambiguity or eliminating potential misunderstandings, our team is here to assist. Thoughtful drafting on the front end ensures agreements perform as intended long after the ink has dried. Clarity is cheaper than interpretation. For more information, contact Margo Kneisser at mkneisser@olenderfeldman.com.

In uncertain economic climates, it’s common to see a rise in demand letters as businesses experiencing or anticipating financial pressure are motivated to pursue faster, lower-cost mechanisms to resolve disputes. A “demand letter” is a formal written communication from a party (often a vendor, current or former business partner, creditor, or other counterparty) asserting a legal claim or grievance and requesting that a specific action, such as payment or performance, be taken within a defined time frame. A demand letter can serve as a strategic tool to prompt engagement and create leverage to obtain an outcome without immediately resorting to costly litigation. Given the number of relationships and moving parts in any business, receiving a demand letter sooner or later is almost unavoidable. So, what should you do if you receive one? 1. Preserve relevant documents. A demand letter signals that there is potential future litigation, so it is critical to identify and preserve all materials that may be relevant to the dispute. Key items include emails, contracts, internal communications, and any other records that pertain to the issues raised in communication. Preserving documents will help ensure compliance with legal obligations, but also, positions the business to respond efficiently should the matter escalate. 2. Assess the merits of the demand. Not every demand has merit. Failing to analyze the demand and determine whether immediate action or a response is needed, however, can turn a small issue into a more expensive problem later. In consultation with your internal legal team or outside counsel, analyze what the sender is asking for, the basis for the claim (contract, statute, prior dealings, etc.), and the overall strength of that basis. For example, if the demand relies on a contract, review the agreement and compare its obligations with what the parties actually did or did not do, based on your records, to determine whether the facts align with the sender’s assertions. 3. Evaluate your business’s position and priorities. Several practical and strategic considerations may influence how a business chooses to respond to a demand letter, including: Timing and urgency: Does the demand impose a strict deadline, and what are the consequences of missing it? Some deadlines are arbitrary and unilateral, while others may require a response by a date certain or risk waiver of certain rights or defenses. Business impact: What is the potential exposure to your business if the demand is valid? A meritorious demand, or subsequent litigation, can threaten a business’s financial health, operational efficiency, and reputational strength. Relationship considerations: Is maintaining the business relationship important and how would a response affect future dealings? A measured or collaborative approach in response may preserve a valuable partnership, while an aggressive stance may strain or end it. Potential escalation: Could ignoring or downplaying the demand invite further legal action? A lack of response can accelerate the dispute, prompting the sender to pursue litigation or other enforcement mechanisms sooner than they otherwise might. 4. Select an appropriate response approach. Once you understand the demand’s ask and its merits, think strategically about how you want to respond. In most cases, the question of how to respond is less about legal obligations and more about how firm or flexible you want to be given the merits of the demand and your broader business objectives. A “softer” approach through engaging in dialogue, negotiating a compromise, or proposing an early resolution can save time, preserve business relationships, and reduce costs. A “harder” approach, such as firmly asserting your position or challenging weak claims via a point-by-point response, may be appropriate if the demand is overreaching. Ultimately, the appropriate “immediate” action will vary and the right choice must balance practical business considerations with the perceived legal risk and exposure. Bottom line: A demand letter, no matter how much legal jargon it contains, is usually a business problem that requires a business-minded response. Handled wisely, an expensive legal fight may be avoided, and in some cases, a damaged business relationship may be repaired. The right approach balancing the relevant factors can make all the difference. If you have any questions about this Alert, please contact Sean Rose, Esq. (srose@olenderfeldman.com).

Summary As many of you know, there has been a surge in privacy litigation across California and the nation, targeting ordinary business practices involving website tracking and video streaming. With statutory damages ranging from $1,000 to $5,000 per violation, these cases can quickly escalate into seven-figure exposures—even for small businesses. This alert identifies some of the top litigation trends and provides actionable steps to protect your organization. The Rising Threat: Serial Privacy Litigation Serial plaintiffs and specialized law firms are filing hundreds of lawsuits targeting common technologies like website analytics, chatbots, and video players. Many defendants receive pre-suit demand letters seeking $10,000-$30,000 in quick settlements, creating a modern shakedown dynamic. Understanding these trends is the first step in protecting your business. Top Privacy Litigation Trends California CIPA (Invasion of Privacy Act) Cases Meta Pixel/Facebook Pixel Tracking Hundreds of lawsuits have been filed, with thousands more settlement demand letters served, over the past three years targeting websites using Meta Pixel (formerly Facebook Pixel) for analytics and advertising. Plaintiffs allege that these tracking pixels intercept user communications without consent (often on a company’s home page before the user has a chance to review – and agree to – a Privacy Policy), violating California's wiretapping laws. Industries most commonly affected: E-commerce, healthcare, financial services, professional services Session Replay Technology Lawsuits challenge tools that record user sessions on websites, including mouse movements, clicks, and keystrokes. Courts have found these technologies may violate CIPA's prohibition on intercepting communications. Industries most commonly affected: SaaS companies, financial institutions, insurance providers Search Bar "Digital Wiretap" Claims Serial plaintiffs allege that website search bars operate as illegal wiretaps when third-party tracking scripts from services like LinkedIn, AdRoll, or HubSpot simultaneously capture search queries. Industries most commonly affected: Any business with website search functionality Chatbot Tracking Lawsuits A wave of class actions targets websites with chat features that use analytics or customer service platforms. Plaintiffs claim these tools unlawfully intercept conversations between users and the website. Industries most commonly affected: Customer service platforms, e-commerce, healthcare providers Trap and Trace Device Claims Plaintiffs are applying CIPA's prohibition on "pen registers" and "trap-and-trace devices" (originally targeting phone surveillance) to modern web tracking technologies. Specialized law firms have been particularly aggressive in sending pre-suit notices for LinkedIn tracking software violations. Industries most commonly affected: B2B companies, recruitment platforms, professional networks Federal VPPA (Video Privacy Protection Act) Cases Video Streaming Pixel Tracking Between 80-100 VPPA class actions have been filed recently, targeting websites that embed video content and use tracking pixels that allegedly disclose user viewing habits to third parties like Meta or Google. Settlements have reached into the millions of dollars. Industries most commonly affected: News outlets, streaming services, healthcare, financial services, sports media Professional "Tester" Plaintiff Cases Courts have identified serial litigants who deliberately seek out privacy violations to file lawsuits. These "testers" visit websites specifically looking for tracking technologies to challenge. While some courts have questioned whether these plaintiffs have legal standing, many cases still proceed to costly litigation or settlement. Industries most commonly affected: All industries with online presence Financial Exposure: Understanding the Stakes The financial risk from these lawsuits can be substantial: CIPA (California): $5,000 per violation VPPA (Federal): $2,500 per violation For class actions, these statutory damages can quickly accumulate into millions of dollars in exposure. Even individual claims can result in significant defense costs and settlement pressure. Immediate Action Steps Conduct a Privacy Audit Identify all tracking technologies on your website (pixels, cookies, session replay tools) Assess video content and associated tracking technologies Review Vendor Relationships Examine contracts with third-party analytics providers, marketing platforms, and HR technology vendors Ensure proper indemnification provisions are in place Verify vendors' compliance with applicable privacy laws Update Consent Mechanisms and Website Privacy Policy Implement clear, conspicuous consent mechanisms for website tracking Update website Privacy Policy to comply with applicable laws based upon your tracking and use of personal data – say what you do and do what you say Consider Technology Alternatives Evaluate first-party analytics solutions that do not share data with third parties Consider server-side tracking instead of client-side pixels Explore consent management platforms for website visitors What to Do If You Receive a Demand Letter DO NOT IGNORE IT. Privacy demand letters often come with tight response deadlines and can escalate quickly to litigation. Contact counsel immediately Preserve all relevant evidence – Including website code, vendor contracts, and internal communications Do not communicate directly with the plaintiff or their counsel Avoid making changes to your website or practices without legal guidance, as this can be used as evidence of wrongdoing Contact Us For more information, questions or if you have any concerns about your own practices, please contact Michael J. Feldman, Esq. (908-964-2486 or mfeldman(at)olenderfeldman.com). This client alert is provided for informational purposes only and does not constitute legal advice. The information contained herein may not reflect the most current legal developments and is subject to change without notice. Readers should not act upon this information without seeking professional counsel.

Happy New Year from OlenderFeldman! As we head into 2026, New Jersey employers should be aware of an important administrative change that may affect how you receive unemployment-related notices and communicate with the State. New Jersey is continuing its push to move employer interactions with the Department of Labor online, and there’s a new requirement that employers should not overlook. The New Jersey Department of Labor and Workforce Development now expects employers subject to New Jersey unemployment insurance laws to register for Employer Access, an online portal used for unemployment-related communications and reporting. If you haven’t registered yet, now is the time. What Is Employer Access? Employer Access is NJDOL’s online system for employer unemployment insurance accounts. It replaces older platforms and is becoming the primary way the State communicates with employers about unemployment matters. Through Employer Access, employers can view unemployment insurance contribution rates, account balances, and payment history, receive official notices electronically, submit Shared Work applications, and report issues such as employees refusing suitable work. Who Needs to Register? Most employers doing business in New Jersey that are required to file quarterly wage and contribution reports (Forms NJ-927 and WR-30) must register for Employer Access. In other words, if you have employees in New Jersey and pay unemployment insurance contributions, this new requirement applies to you. Why Does This Matter? The Department of Labor is moving away from paper correspondence. Important notices (including rate information and account updates) will now be delivered electronically through Employer Access. Employers who are not registered risk missing time-sensitive communications that can affect contribution rates, benefits charges, and compliance obligations. We are also seeing increased enforcement around employer reporting responsibilities, and the State has made clear that electronic reporting will continue to expand. What Employers Should Do Now Employers should register for Employer Access as soon as possible and make sure the account is tied to a current, monitored business email address. You may also want to grant access to payroll staff or third-party administrators so nothing falls through the cracks. Taking a few minutes to register now can prevent much larger issues down the line. For more information on Employer Access, unemployment insurance compliance, or how these changes affect your business, please contact the OlenderFeldman Employment Practices Group here.

On January 20, 2026, the New Jersey Department of Environmental Protection (“NJDEP”) adopted significant amendments to its Resilient Environments and Landscapes (“REAL”) rules, changing how climate risk is evaluated in land use permitting across New Jersey. The amended rules integrate future flooding and sea-level rise projections into NJDEP’s Coastal, Flood Hazard, Wetlands, and Stormwater programs. As a result, climate-adjusted standards will now directly affect how projects are planned, designed, permitted, and constructed—often beyond areas traditionally regulated by FEMA flood maps. Key Impacts for Property Owners and Developers Higher elevation requirements, including construction of certain coastal structures at least four feet above FEMA base flood elevations; Expanded regulated areas, potentially subjecting projects outside current FEMA-designated flood zones to NJDEP jurisdiction and newly applicable permitting requirements. Design and density constraints due to increased setbacks, access requirements, and floodproofing standards; New access and egress requirements, including demonstration of climate-resilient “dry access”; Updated stormwater management and wetlands standards may require larger or additional stormwater facilities, expanded mitigation areas, or revised drainage designs; and Increased engineering and permitting costs, driven by additional modeling, stormwater, and environmental analyses. Early-stage planning will be critical, as these standards are now embedded in NJDEP’s permitting review process. Limited Grandfathering Opportunity Projects with permit applications deemed technically complete within 180 days of adoption (by July 20, 2026) may qualify to proceed under the prior rules. This grandfathering window presents a significant but time-limited opportunity for projects already in design or permitting. This transition window is narrow and eligibility is strictly defined. Planning Ahead Project proponents should review pending and planned projects for REAL rule applicability, evaluate potential grandfathering eligibility, reassess designs and budgets, and engage environmental and land use counsel early to manage permitting risk. Bottom Line The REAL rules make climate resilience a central component of NJDEP permitting. Proactive planning and early regulatory analysis will be essential to minimize delays and avoid costly redesigns. For more information, visit NJDEP’s REAL rule page at https://dep.nj.gov/njreal/ For questions regarding the impact of the REAL rules on a specific project, please contact our land use team, Richard J. Angowski, Jr. and Jason Hawrylak.

A wave of demand letters related to cookies, pixels, and other tracking devices that are applied prior to visitor consent is reaching businesses of all sizes across the country right now. We want to help equip you to with what you need to know to protect against them, and if one lands on your desk, we wanted to let you know what sits behind it and what you can do to reduce your exposure. What is happening A small number of people in California, often acting on their own and in some cases working with a few law firms, visit (or use technology to visit) large numbers of business websites and then send near-identical letters to the companies that run them. The claim leans on the California Invasion of Privacy Act, commonly known as CIPA, an eavesdropping law originally from the 1960s, written for telephone wiretaps, that these senders have repurposed to reach the everyday tracking tools almost every website uses. The targets are not chosen for doing anything unusual. They are chosen because their sites run the same ordinary tools nearly every site runs: analytics such as Google Analytics, advertising pixels, chat widgets. If you have a website, you almost certainly have some of these, whether you set them up yourself or a website host installed them for you. The senders send these in high volume, and each one is written to pressure a fast settlement. On their end it is a numbers game. The statute they cite allows a fixed sum per alleged violation, which is what makes mailing in bulk worth their while. There is no reason to panic, and none of this is specific to working with us or with any one vendor. It is about how websites in general load third-party tools, and whether those tools begin collecting visitor data before anyone has agreed to it. That last point is where you have real control. The step that matters most If you do not have a cookie consent banner on your site, this is a good moment to put one in place. If you already have one, it is worth confirming that it is configured to do its job: to hold cookies, pixels, and similar trackers until a visitor has interacted with the banner and consented to them. Many banners are set up, without anyone intending it, to display a notice while the trackers fire the moment the page loads. That gap is precisely what these letters target. A banner that shows a notice but blocks nothing gives the appearance of protection without the substance of it. Why this is bigger than the letters Correcting the banner removes the condition these letters point to. It also reaches a set of obligations that have nothing to do with them, and that apply whether or not a letter ever arrives. Which of these reach you depends on where your visitors are and what your site does. California's own consumer privacy law, the CCPA as amended by the CPRA, governs website data collection directly. It expects businesses to give notice, to let visitors opt out of the sharing of their data for targeted advertising, and to honor browser-level opt-out signals such as Global Privacy Control. Regulators have already brought enforcement actions over cookie and opt-out failures. At present, more than twenty other states now have their own comprehensive privacy laws, several of which require honoring universal opt-out signals and offering an opt-out of targeted advertising. If any of your visitors come from the EU or the UK, a stricter rule applies: there, non-essential trackers generally may not fire until the visitor has given prior consent, and that regime carries its own regulator fines. And if your site touches health information, even indirectly through a pixel, a separate layer of law comes into play, including Washington's health-data statute with its private right of action and federal guidance on tracking technologies. A banner tuned only to the California letters can still leave you out of step with these. The reverse holds as well: a consent setup built correctly for the broader picture addresses those letters as a matter of course. What doing this properly looks like Three pieces work together. An accurate, current privacy policy that reflects what your site actually collects and shares. A distinct cookie notice, kept separate from the general privacy policy and reachable from the banner, that describes the categories of trackers, their purposes, and how a visitor exercises choices. And a consent management platform configured, and worded, to match the laws that apply to you rather than a generic default pulled off the shelf. A note on possible relief You may have heard that California is weighing whether to narrow this law. A bill that would carve routine commercial website tools out of its reach passed the state Senate but stalled in the Assembly and has been carried over for further consideration. Even if it advances, it is drafted to apply going forward rather than to pending matters, so it offers nothing to a business that receives a letter in the meantime. The practical posture is to fix the site now. How we can help Our Privacy, Security & AI team is helping clients review their sites, correct banner configurations, refresh privacy policies, and put a proper cookie notice in place, in alignment with the laws that apply to each business. If you have received a letter, or you would rather get ahead of one, reach out to your OlenderFeldman contact or to SRosenberg@OlenderFeldman.com, who leads our Privacy, Security & AI Practice. This alert is provided for general informational purposes and does not constitute legal advice or create an attorney-client relationship. It may be considered attorney advertising in some jurisdictions.