California

In April 2026, California’s Department of Motor Vehicles released final rules governing how self-driving vehicles are tested and deployed in the state, capping more than a year of drafting and public comment. The rules separate testing from broader commercial deployment and set up three staged permits: testing with a safety driver, testing with no driver, and full deployment. Most manufacturers must log at least 50,000 autonomous miles before each step up, with a lower 10,000-mile threshold for low-speed vehicles, and a much higher 500,000 miles for heavy trucks, which became eligible in California for the first time. Applicants must also submit a detailed safety case explaining why the vehicle is safe, which the DMV may review with outside experts.

Other changes include a new traffic-violation notice police can issue, triggering 24- or 72-hour reporting deadlines; required first-responder interaction plans and prompt responses to emergency geofencing requests; and training and licensing standards for remote drivers and remote assistants. Large passenger buses remain ineligible, apart from a narrow exception.

Many Delaware-incorporated companies include provisions in their corporate charters or bylaws requiring that stockholder lawsuits be brought in Delaware’s Court of Chancery — a court that decides cases before a judge, with no jury. This creates a tension with California law, which strongly guarantees the right to a jury trial and has a broad “long arm” statute that can pull disputes into California courts even when a company has chosen a different forum. A minority stockholder who was a California resident sued EpicentRX (a Delaware corporation) in California court. The lower courts refused to enforce the Delaware forum selection clause, reasoning that sending the case to Delaware would effectively strip the plaintiff of her California jury trial rights. The California Supreme Court reversed, holding that a forum selection clause is not unenforceable simply because it requires parties to litigate in a jurisdiction that does not provide the same jury trial right as California. The court reasoned that California’s strong public policy favoring jury trials applies to proceedings in California courts, not to courts in other states. It further reasoned that a forum selection clause determines where a dispute is litigated, not how, so it does not constitute a prohibited waiver of jury trial rights. The decision aligns California with the majority of states that enforce Delaware forum selection clauses, reinforcing the ability of Delaware-incorporated companies to channel stockholder disputes to Delaware’s specialized corporate court.

Children’s privacy regulations globally are shifting away from notice-and-consent models toward outright access restrictions, age-appropriate design mandates, categorical advertising prohibitions, and app-store-level age verification, as illustrated by Australia’s December 2025 enforcement of its under-16 social media ban. In the United States, similar legislative efforts have faced significant First Amendment challenges that have stalled most state laws restricting minor access to social media and AI platforms, while age-appropriate design requirements inspired by California’s law have been enacted in several states. Several states, including Oregon, have enacted categorical bans on targeted advertising to known minors, while app-store-level age verification laws imposing age-signal obligations on app developers are also subject to active litigation. Companies operating consumer-facing digital services should map where minors interact with their products, review advertising practices involving teens, and prepare for the eventual downstream effects of age-signal regimes.

Courts are writing their own rules about generative AI, and in patent cases those rules differ sharply from judge to judge. This survey, current as of September 8, 2026, catalogs the generative-AI requirements in the venues where most patent infringement suits land: the Eastern and Western Districts of Texas, the Northern and Central Districts of California, the Northern District of Illinois, the District of New Jersey, and the District of Delaware and the U.S. International Trade Commission, where no AI-specific rules were identified. Only the Eastern District of Texas has a court-wide rule, making every litigant responsible for verifying AI-assisted filings. Elsewhere the obligations come from individual judges’ standing orders and vary widely, from restating the existing duty to verify what you sign to requiring a separate certificate naming the AI tool, confirmation that a human checked every citation, records of the prompts used, or disclosure of AI use in billing. Penalties include US$500 per violation and having the filing struck.

Delaware has long been the default jurisdiction of incorporation of high-growth emerging companies due to its advanced, and evolving, body of corporate law, a specialized Court of Chancery, and decades of corporate law cases and precedents. But that default assumption has now come into question.

In recent years, Delaware’s courts have issued a series of decisions that have left some founders of high-growth companies unsettled. See, for instance, the recent Tesla cases, following which Elon Musk publicly blasted Delaware and both Tesla and SpaceX reincorporated in Texas. Musk is not alone in this trend toward “DExit” – TripAdvisor, Dropbox, AMC Networks, and Roblox are among those reincorporating in Nevada, and Dillard’s joined Tesla and SpaceX by reincorporating in Texas. Even Meta publicly announced that it was exploring a move out of Delaware in 2025.

In response, Delaware’s legislature adopted major reforms in 2024 and early 2025 (SB 313 and SB 21) codifying safe harbors for conflicted transactions, narrowing books-and-records access, and strengthening management’s shield against litigation.

More and more founders and GCs of later-stage companies are now wondering if Delaware should still be the default.

So, should you care and, if so, where are companies moving?

“Y’all Street” as an Alternative?

In recent years, Texas lawmakers have aggressively reformed state law to attract corporations. The state’s pitch? A pro-business legal climate, big-market economy, and fewer stockholder hassles. In 2024, Texas launched a new statewide Business Court system modeled on Delaware’s Chancery Court, with specialized judges to handle complex corporate cases. This was quickly followed in May 2025 with sweeping legislated changes (SB 29) to the Texas Business Organizations Code, in a package branded as “Texas: Open for Business." Key provisions include:

Codification of the Business Judgment Rule:

Texas now explicitly codifies the business judgment rule and the high bar to rebut it, giving directors stronger protection when their decisions are challenged.

Limits on Derivative Lawsuits:

Allowing corporations to set a minimum ownership threshold (up to 3%) for stockholder-plaintiffs to bring a derivative suit. This threshold is higher than most states and drastically curbs the ability of small stockholders to sue on behalf of the corporation.

Records and Litigation Procedure:

Limiting what constitutes corporate “books and records” available for stockholder inspection. For instance, emails and electronic communications are excluded. It also allows companies to include provisions in their charters or bylaws waiving the right to jury trials in corporate disputes, meaning cases would be heard solely by judges (as they are in Delaware’s Chancery Court).

In addition to the changes effected by SB 29, Texas later enacted several additional measures to allow certain Texas-listed public companies to adopt higher thresholds for stockholder proposals and to authorize the board of directors to delegate more discretion to the corporation’s executives.

Pros and Cons of the Y’all Street

The Texas proposals seem very attractive, especially to issuers and their insiders, but, in practice, their effectiveness is hard to measure. The new courts lack Delaware’s decades of precedent, making Texas less predictable for companies. So, certainty with respect to a few specific matters is offset by uncertainty with respect to treatment of a myriad of others. Additionally, incorporating in Texas might expose a corporation to Texas venue for certain lawsuits.

Texas has certainly had some luck in attracting private and public companies as of late, and we are working with a number of companies exploring Texas as a potential alternative to Delaware.

The “Silver Sanctuary”?

Like Texas, Nevada’s appeal lies in providing certainty to companies and their insiders with respect to certain specific common transactions. It automatically offers directors and officers strong protections. Key features of Nevada’s corporate environment include:

Robust Liability Shields

Nevada law automatically exculpates directors and officers from personal liability for breaches of fiduciary duty (except in cases of intentional misconduct, fraud, or knowing law violations). In Delaware, by contrast, corporations must opt in to exculpation (and even then, it covers only duty of care, not loyalty, and only recently were officers allowed similar protection). Nevada’s default rule thus gives executives peace of mind that honest mistakes won’t easily lead to personal liability. Likewise, Nevada statutes make it easier to indemnify and protect managers, which can reduce D&O insurance costs.

Consideration of Other Interests

Nevada explicitly permits boards to consider long-term corporate interests and the impacts on employees, customers, the community, etc., when making decisions. Directors are not strictly bound to maximize immediate stockholder value at all costs. This allows directors to justify decisions that favor sustainable growth or other constituencies, without breaching their duty to stockholders. This contrasts with states like Texas or Delaware, where directors must generally act in the best interests of the corporation and its stockholders, with true stakeholder balancing available only if the corporation opts into a Public Benefit Corporation framework.

No Franchise Tax

From a financial perspective, Nevada imposes no corporate franchise tax and so may prove cheaper to operate in, especially for early-stage companies.

Pros and Cons of the Silver Sanctuary

Nevada offers what Nevada usually offers: more freedom to operate at the expense of less predictability. Nevada’s business courts were established in 2001, but those courts have not published nearly as many written opinions, or as routinely, as Delaware’s Court of Chancery. The law, while more insider-friendly, is also less modernized in other areas.

So, in the end, what should you do?

The answer is not clear-cut. For now, there is no mass flight out of Delaware, but certainly lots of discussions are taking place. No clear winner has emerged for the alternatives, but it does appear that more public companies are leaning towards Texas while more private companies are considering Nevada. But the vast majority of new incorporations are still taking place in Delaware.

It all comes down to perception, expectation, and, perhaps in the future, actual experience. To help your thinking, a chart summarizing some, but certainly not all, of the key features of the three regimes may be found here:

One of the most common legal missteps among emerging companies involves the classification of the people doing the work. In the earliest days of a startup, founders often bring on talented individuals as “consultants” or “independent contractors,” compensating them primarily or exclusively with equity. This arrangement feels natural when cash is scarce and everyone is pitching in to build something from the ground up. But what begins as a practical solution can quickly become a significant legal liability if the company does not revisit these classifications as it matures and secures funding.

This article provides a high-level overview of the risks associated with worker misclassification, the key legal frameworks that govern these determinations, and the steps founders should take to clean up classification issues before they become costly problems.

The Common Pattern: Early “Consultants” Who Are Really Employees

It is extremely common for pre-revenue startups to engage early team members as independent contractors or consultants. The logic is straightforward: The company cannot yet afford salaries, payroll taxes, or benefits, so it issues equity in exchange for labor. On paper, the individual signs a consulting agreement, invoices the company (or doesn’t), and is treated as a 1099 worker for tax purposes.

The problem is that many of these individuals are, as a matter of law, employees regardless of what the agreement says. Classification is not a matter of mutual agreement between the parties. It is determined by the nature of the working relationship under applicable federal and state law. If the engagement looks and feels like employment, then government agencies and courts are likely to treat it as such.

When these individuals are never reclassified, the company accumulates exposure over time. That exposure includes unpaid wages, overtime, employment taxes, penalties, and potential liability under both federal and state law. These issues often surface at the worst possible moment: during due diligence for a funding round, an acquisition, or in response to a complaint filed by a disgruntled former worker.

Why Reclassification Should Be a Priority After Funding

Securing any meaningful financing event should serve as a trigger for the company to revisit every worker classification. There are several reasons for this.

First, the original justification for the consulting arrangement, namely the inability to pay cash compensation, has likely changed. Once the company has capital, it has the resources to bring workers onto payroll and provide the protections required by law. Continuing to classify a worker as an independent contractor when the company now has the means to pay wages and withhold taxes weakens any argument that the arrangement was legitimate.

Second, investors and their counsel will scrutinize the company’s employment practices during due diligence. Misclassification issues are a well-known red flag. Unresolved classification problems can delay or even derail a financing, reduce the company’s valuation, or result in specific indemnification obligations imposed on the founders.

Third, as the company grows, the risks multiply. More workers mean more potential claimants. Longer periods of misclassification mean larger back-pay and tax liabilities. And the shift from a small, informal team to a structured organization makes it increasingly difficult to argue that any given worker was genuinely operating as an independent business.

The bottom line is that reclassification is not merely a housekeeping exercise. It is a critical step in putting the company on sound legal footing for its next phase of growth.

Federal Law: The Key Frameworks

At the federal level, worker classification is governed by several overlapping tests, depending on the statute at issue.

The Fair Labor Standards Act

‍The FLSA uses an “economic reality” test to determine whether a worker is an employee or an independent contractor. The inquiry focuses on whether the worker is economically dependent on the company or is in business for themselves. Factors include the degree of control the company exercises over the work, the worker’s opportunity for profit or loss, the worker’s investment in equipment or materials, the permanence of the relationship, the degree of skill required, and the extent to which the work is an integral part of the company’s business. The Department of Labor has historically taken a broad view of employment under this test, and the consequences of misclassification include liability for unpaid minimum wages and overtime, liquidated damages, and attorneys’ fees.

The Internal Revenue Code

‍The IRS applies a common-law test that examines the degree of control and independence in the relationship. The IRS groups relevant factors into three categories: behavioral control (whether the company directs how the work is done), financial control (whether the company controls the business aspects of the worker’s role, such as how the worker is paid and whether expenses are reimbursed), and the type of relationship (including written contracts, benefits, and the permanence of the engagement). Misclassification under the tax code can result in liability for unpaid employment taxes, penalties, and interest. In some cases, officers of the company may face personal liability under the trust fund recovery penalty.

Exempt vs. Non-Exempt Classification

‍Once a worker is properly classified as an employee, the company must also determine whether the employee is exempt or non-exempt under the FLSA. Exempt employees are not entitled to overtime pay, but they must meet specific salary and duties tests. The most commonly applicable exemptions for startups are the executive, administrative, professional, and computer employee exemptions. Each requires that the employee be paid on a salary basis at or above a specified threshold and that the employee’s primary duties satisfy specific criteria. Founders should not assume that simply paying a salary or giving someone a managerial title is sufficient. The analysis turns on the actual duties performed, not the job title.

State Law: Where the Rules Get Stricter

Many states impose classification standards that are more restrictive than federal law, and compliance with federal standards alone does not guarantee compliance at the state level.

California’s ABC Test

‍California applies a particularly stringent standard under its ABC test, codified by Assembly Bill 5. Under this test, a worker is presumed to be an employee unless the hiring entity demonstrates that the worker (A) is free from the company’s control and direction in performing the work, (B) performs work that is outside the usual course of the company’s business, and (C) is customarily engaged in an independently established trade, occupation, or business of the same nature as the work performed. Prong B is often the most difficult to satisfy for startups, because early workers are typically performing tasks that are central to the company’s core business. California law also provides for significant penalties for misclassification, including penalties under the Private Attorneys General Act, which allows employees to bring representative actions on behalf of the state.

Other Notable State Frameworks

‍Several other states have adopted or are moving toward ABC-style tests, including Massachusetts, New Jersey, and Illinois. New York applies a similar multi-factor test and has aggressive enforcement mechanisms. States vary considerably in their approaches, and companies with remote workers in multiple states must ensure compliance in each jurisdiction where a worker is located, not merely where the company is headquartered. Founders should be particularly attentive to any state in which the company has workers, as the applicable test is generally determined by the worker’s location.

Cleaning Up Past Misclassification

For companies that have already been operating with misclassified workers, there are several steps to consider when undertaking a remediation effort.

The first step is to conduct an honest internal audit. Identify every individual who has been engaged as a contractor or consultant and evaluate each engagement under the applicable federal and state tests. Determine which individuals are likely misclassified and assess the duration and scope of the exposure.

The second step is to consult with experienced employment counsel. Remediation strategies vary depending on the jurisdiction, the number of affected workers, the duration of misclassification, and the company’s financial position. In some cases, the IRS Voluntary Classification Settlement Program may be available, which allows companies to prospectively reclassify workers with limited look-back liability in exchange for a modest payment. Similar programs or settlement frameworks may exist at the state level.

The third step is to transition misclassified workers to employee status going forward. This includes placing them on payroll, withholding applicable taxes, providing required benefits, and ensuring compliance with wage and hour laws, including proper exempt or non-exempt classification.

The fourth step is to address the equity arrangements already in place. Early equity grants made to individuals who should have been classified as employees may have been structured as contractor grants, which have different tax treatment than employee equity awards. Companies should work with both employment counsel and tax advisors to evaluate whether corrective filings or revised equity documentation are necessary, particularly with respect to Section 409A of the Internal Revenue Code, which governs deferred compensation and imposes significant penalties for noncompliance.

Finally, companies should implement classification policies and procedures that will prevent these issues from recurring as the company continues to hire. A brief intake process for every new engagement, whether employee or contractor, can go a long way toward ensuring that the correct classification is applied from the outset.

On July 24, 2025, the California Privacy Protection Agency approved sweeping new regulations covering cybersecurity audits, risk assessments, and automated decisionmaking technologies (ADMT), pending review by California’s Office of Administrative Law. Certain businesses will be required to undergo annual independent cybersecurity audits beginning in 2027, phased in by company revenue, covering 18 components of a cybersecurity program and culminating in executive certification. Businesses must also conduct risk assessments before engaging in activities such as selling personal information, processing sensitive data, or using ADMT for significant decisions, with California uniquely requiring evaluation of “negative impacts” to consumers. Beginning April 1, 2027, businesses using ADMT for significant decisions must provide pre-use notices, access to information about how the ADMT works, and opt-out rights, though the regulations clarify that ADMT excludes technologies where a human retains authority to review and override the output. Additional provisions strengthen opt-out notification requirements and prohibit dark patterns in consent mechanisms, with several of these provisions already in effect as of January 1, 2026.

When it comes to non-competes, the state of California is not like much of the United States. The state maintains one of the most employee-friendly legal regimes in the country when it comes to post-employment restrictions, and those who fail to appreciate the breadth and force of California’s prohibitions risk not only unenforceability but also significant legal exposure.

California’s legal landscape demands that startups and investors approach restrictive covenants with clear eyes. Noncompetition agreements and customer nonsolicitation clauses are void. Employee nonsolicitation provisions are very likely void. And the increasingly popular strategy of repackaging a restrictive covenant as a trade secret protection, including by prohibiting the “use of proprietary information in order to” compete, solicit, or recruit, should be drafted and enforced narrowly to avoid an argument that they are operating as noncompetes in disguise.

The Foundation: Business and Professions Code Section 16600

California’s hostility toward restrictive covenants is rooted in Business and Professions Code Section 16600, which provides, in relevant part, that “every contract by which anyone is restrained from engaging in a lawful profession, trade, or business of any kind is to that extent void.” Courts have interpreted this provision broadly. Unlike jurisdictions that evaluate noncompetition agreements under a “reasonableness” standard, weighing the employer’s legitimate interests against the burden on the employee, California’s statute operates as a near-categorical prohibition. A contractual provision that prevents a former employee, consultant, or advisor from freely pursuing their livelihood is void on its face, regardless of how narrowly it is drafted, how short its duration, or how limited its geographic scope.¹

The California Supreme Court held that the statute prohibits noncompetition agreements except in narrow statutory exceptions such as the sale of a business or the dissolution of a partnership. The court expressly rejected the argument that California should adopt a “narrow restraint” exception permitting noncompetition clauses that impose only limited restrictions on an employee’s future activities. The message was unambiguous: In California, noncompetition agreements with employees are void.

The Legislature also made it unlawful for an employer to enter into or attempt to enforce a noncompete agreement that is void under California law, even if the agreement was entered into outside of California.

Beyond Noncompetes: Employee Nonsolicitation Covenants

Founders and investors often assume that even if noncompetition agreements are off the table in California, employee nonsolicitation provisions, which are clauses that prevent a departing worker from recruiting former colleagues to join a competitor, remain permissible. This assumption is incorrect, or at least highly precarious.

California courts have increasingly treated employee nonsolicitation covenants as restraints on trade that fall within the ambit of Section 16600. The reasoning is straightforward: If a former employee cannot contact or recruit colleagues they previously worked with, their ability to engage in their profession is meaningfully restricted. They cannot freely build a team, they cannot leverage their professional network, and they are placed at a competitive disadvantage relative to others in their field who are not subject to such restrictions. While some practitioners still debate the outer boundaries of the holding (for instance, whether a narrowly drawn “no-raid” provision aimed at preventing the mass departure of an entire team might survive scrutiny), the prevailing trend in California jurisprudence strongly disfavors employee nonsolicitation covenants of any kind.

For startups, this has significant implications. It is common in the technology sector for key engineers, salespeople, or executives to depart and bring colleagues with them to a new venture. While this can be deeply disruptive to a young company, attempting to prevent it through contractual nonsolicitation provisions is unlikely to succeed in a California court and may expose the company to counterclaims.

Customer Nonsolicitation Covenants: An Equally Hostile Landscape

Customer nonsolicitation provisions - clauses that prohibit a former employee from soliciting or doing business with the company’s clients or customers - face a similarly difficult road in California. The California courts have confirmed they are just as much a restraint on mobility as an employee noncompete.

Some California courts have drawn a distinction between clauses that prevent a former employee from soliciting customers and clauses that merely prevent the misuse of trade secret information (such as confidential customer lists) to solicit those customers. This distinction brings us to one of the most important, and most misunderstood, issues in this area of law.

The Trade Secret “Workaround” That Isn’t

Precisely because California’s prohibition on restrictive covenants is so broad, creative drafters have long sought workarounds. One of the most common is to frame a restrictive covenant not as a restriction on competition or solicitation, but as a restriction on the use of the company’s proprietary or confidential information. Under this approach, an agreement might provide that the employee or consultant “shall not use Company proprietary information or trade secrets in order to compete with the Company,” or “shall not use Company confidential information to solicit Company employees or customers.”

The logic behind this formulation is superficially appealing. California law does, after all, protect trade secrets through the California Uniform Trade Secrets Act (CUTSA) and does permit employers to require employees to maintain the confidentiality of genuinely proprietary information. If the clause is framed as a trade secret protection rather than a restraint on competition, the argument goes, it should survive scrutiny under Section 16600.

The critical question is whether the clause, as drafted and as applied, operates as a genuine trade secret protection or as a de facto restrictive covenant dressed in the language of trade secret law.

Consider a clause that states: “Employee shall not use Company proprietary information in order to solicit Company’s customers.” On its face, this appears to be a narrow, information-based restriction. But in practice, a former employee who spent years managing a portfolio of customer relationships will find it nearly impossible to demonstrate, to the satisfaction of a litigious former employer, that their solicitation of a customer was based entirely on publicly available information and not, in any respect, on knowledge acquired during their employment. The clause effectively gives the former employer a veto over any customer solicitation by the departing employee, because the employer can always allege that the solicitation was informed by proprietary knowledge. The practical effect may be difficult to distinguish from a customer nonsolicitation covenant.

The same analysis applies to clauses framed as restrictions on using proprietary information to compete. A provision stating that the employee “shall not use Company trade secrets in order to engage in a competing business” may sound like a reasonable trade secret protection, but if the employee’s general knowledge of the company’s business strategies, product roadmap, or market positioning is broad enough, the clause effectively prevents the employee from working in the same industry. At that point, it is a noncompete in all but name. The important takeaway is that the inclusion of trade secret language does not immunize a clause that functions as a restrictive covenant.

This does not mean that employers cannot protect their trade secrets. They absolutely can, but they must do so through mechanisms that California law actually recognizes. A well-drafted confidentiality and nondisclosure agreement that identifies categories of protected information and prohibits its disclosure or use is generally enforceable. An employer can also bring a claim under CUTSA if a former employee actually misappropriates trade secrets to gain a competitive advantage. What an employer cannot do is use the specter of trade secret protection to achieve what amounts to a blanket prohibition on competition or solicitation.

Practical Implications for Consultants and Advisors

Much of the foregoing discussion has focused on employees, but the same principles apply with equal force to independent contractors, consultants, and advisors - relationships that are ubiquitous in the startup ecosystem. Technology companies frequently engage advisors under advisory agreements that include restrictive covenants, sometimes imported wholesale from templates designed for jurisdictions where such provisions are enforceable. In California, these provisions are no more valid when imposed on a consultant than when imposed on an employee.

Indeed, the case for enforceability may be even weaker with respect to independent contractors and advisors, who by definition maintain their own businesses and serve multiple clients. A nonsolicitation or noncompetition clause imposed on a consultant who advises several companies in the same sector would directly restrict the consultant’s ability to carry on their independent business and be squarely at odds with Section 16600.

All parties should review their advisory agreements, consulting agreements, and independent contractor agreements to ensure that they do not contain provisions that California law would render void. The inclusion of such provisions does not merely result in unenforceability; under the 2024 amendments, it can result in affirmative liability.

A Word About Choice of Law and Forum Selection

Some parties sometimes attempt to circumvent California’s restrictions by including choice-of-law provisions that designate a more permissive jurisdiction, for example, specifying that the agreement will be governed by the laws of Delaware or New York. This strategy is largely ineffective for individuals who work in California. California courts have consistently held that Section 16600 reflects a fundamental public policy of the state, and they will apply California law to restrictive covenants affecting California-based workers, regardless of the contractual choice of law. Furthermore, it is unlawful to enforce a void noncompete in California even if the agreement was signed outside of California.

For investors conducting due diligence on California-based portfolio companies, this is an area of particular concern. A company whose key employee agreements rely on restrictive covenants (whether styled as noncompetes, nonsolicitation clauses, or trade-secret-based activity restrictions) may have a materially weaker competitive moat than its cap table suggests. Diligence should specifically address the enforceability of employee and consultant agreements under California law and should flag any provisions that may expose the company to liability under the current statutory framework.

Texas has rapidly emerged as one of the nation’s most aggressive data privacy regulators, surpassing California and New York in the breadth and enforcement intensity of its privacy regime. Over the past two years, the state has enacted a comprehensive suite of laws covering consumer and children’s data privacy, artificial intelligence, and data brokers, and its attorney general has secured multi-billion-dollar settlements against major technology companies for alleged violations. While the federal government and many other states have taken a lighter touch on privacy and AI regulation, Texas is leading the charge with active enforcement that companies operating in the state or collecting data from Texas residents cannot afford to ignore.

Attorney-client privilege is a cornerstone of effective legal risk management, but its application is nuanced — especially for in-house counsel. The privilege protects confidential communications between an attorney and a client made for the purpose of obtaining or providing legal advice. However, courts scrutinize claims of privilege, particularly when in-house counsel are involved or when communications comprise of both legal and business advice. The law governing privilege can vary significantly by jurisdiction; thus, it is important to seek the advice of counsel prior to any communications.

Key Considerations for In-House Counsel:

To maximize protection and avoid inadvertent waiver, legal teams and senior executives should keep the following in mind:

In-house counsel face extra scrutiny

Courts recognize that in-house counsel often wear multiple hats. Privilege will apply only where the primary purpose of the communication was to obtain or provide legal — not business — advice.

Privilege applies only to legal — not business — advice

Privilege attaches only to communications where the predominant purpose is legal advice, such as internal investigations to assess whether employees breached a contractual obligation, reviewing marketing materials for compliance with applicable law, or drafting and analyzing contractual language. Clearly distinguish legal analysis from business discussions, particularly in writing.

Confidentiality underpins privilege

Limit distribution of privileged communications to those who “need to know” and avoid including third parties unless necessary and protected by a recognized exception. This is especially important to keep in mind when discussing privileged information while working remotely. There are no exceptions for spouses, family, roommates, or neighbors.

Common-Interest Exception

For example, in California, generally the common-interest exception extends the privilege to communications between parties and their counsel relating to potential civil litigation provided that:

• The parties have some common litigation interest (a purely personal or business-oriented interest is insufficient); and
• The communications are made to further that shared legal interest.

This exception may also apply where parties maintain separate counsel but coordinate through a joint defense or litigation strategy.

Where it applies, the common-interest exception typically only protects communications involving counsel.

‍

Do not assume privilege exists

Even if you believe a communication is privileged, write with the expectation that it could be reviewed by a court. Privilege does not necessarily extend automatically to subsidiaries or affiliates. Ensure formal retention and clear documentation when representing multiple entities or working with advisors. Additionally, the law governing privilege can vary significantly by jurisdiction; thus, it is important to seek the advice of counsel prior to any communications.

Labels help but don’t control

Mark emails or memos as “Attorney-Client Privileged” and “Confidential,” but remember: substance, not form, determines privilege. Where possible, clearly reference the legal advice sought or provided.

Be explicit in requests for legal advice

Directly address in-house or outside counsel, specify the legal issue, and avoid copying attorneys merely to shield a document.

Separate legal from business content

When communications blend legal and business matters, separate them or document the legal purpose clearly.

By proactively managing privilege, in-house counsel and executives can strengthen the protection of sensitive communications, preserve confidentiality, and reduce litigation risk.