In May 2024, I wrote about protecting trade secrets in the shadow of the FTC’s newly published Non-Compete Clause Rule.[1] At the time, the rule was set to take effect on September 4, 2024, and many business owners feared it would leave them without a way to protect their most valuable information. My answer then was that it would not.

The rule never took effect. A federal court in Texas set it aside nationwide in August 2024.[2] In September 2025, the FTC voted to drop its appeals and accept that result,[3] and in February 2026 it formally removed the rule from the Code of Federal Regulations.[4]

So the threat that prompted my 2024 article is gone. The underlying problem is not.

Non-competes are often framed as the first line of defense for confidential information. Increasingly, they are the least reliable one. The FTC is pursuing non-competes case by case, several states have moved in opposite directions, and trade secret litigation has hit record levels. Courts, meanwhile, are focusing less on what companies say about protection and more on what they can prove they did. “Reasonable measures” in practice means the mix of policies, culture, and technology that holds up when a key employee walks out the door.

This update builds on my earlier piece and offers practical guidance for both startups and established companies. The core message has not changed: you do not need a perfect program to preserve trade secret status, but you do need thoughtful, documented measures that fit your size, industry, and risk profile.

What Has Changed Since 2024

The federal rule is dead, but federal scrutiny is not. Rather than a blanket ban, the FTC has turned to targeted enforcement. In September 2025, it brought an action against Gateway Services, a pet cremation company, over one-year nationwide non-competes imposed on roughly 1,800 employees; the final order was entered in November 2025.[5] In April 2026, the FTC ordered Rollins, Inc. (the parent of Orkin) to stop enforcing two-year, 75-mile non-competes against more than 18,000 employees, sent warning letters to 13 other pest-control companies, and finalized the order in June 2026.[6] Notably, the Gateway order still permits non-competes tied to the sale of a business and to senior employees receiving equity, as well as customer non-solicits. The message from FTC Chairman Andrew Ferguson is straightforward: a company that wants a non-compete “had best be prepared to defend it.”[5]

The NLRB stepped back. In February 2025, the NLRB’s Acting General Counsel rescinded the prior General Counsel’s memos treating most non-competes and “stay-or-pay” provisions as violations of the National Labor Relations Act.[7] It is unlikely that the NLRB will pursue or rule against employers based on their use of restrictive covenants.

The states are pulling in opposite directions. For example:

• Washington State enacted ESHB 1155 in March 2026. Effective June 30, 2027, it voids employee and independent contractor non-competes, including existing agreements, and requires notice to affected workers by October 1, 2027. Narrow non-solicits and sale-of-business non-competes are still permitted. Washington joins California, Minnesota, North Dakota, and Oklahoma.[8]

• Wyoming made most non-competes void effective July 1, 2025, with exceptions for the sale of a business, the protection of trade secrets, the recovery of certain training and relocation costs, and executive and management personnel.[9]

• Florida went the other way. Its 2025 CHOICE Act creates a presumption of enforceability for covered non-competes (up to four years) and garden leave agreements for higher-earning employees, and it requires courts to issue preliminary injunctions in many cases.[10]

• Texas narrowed non-competes for physicians and certain other healthcare practitioners in agreements entered into on or after September 1, 2025, capping them at one year and five miles and capping the buyout amount.[11] Texas also added non-compete protection for other categories of health care providers. [11]

  
  

• New York still has no statewide ban despite efforts every legislative cycle. Governor Hochul vetoed a broad ban in 2023, and the latest bill, S9759, passed the Senate in June 2026 but has not passed the Assembly.[12]

For companies operating in more than one state, there is not a single answer to the question “can we use a non-compete?” That makes protections that work everywhere—trade secret law and good internal practices—more important than ever.

Trade secret litigation is busier and more expensive. Federal trade secret filings exceeded 1,550 in 2025, up 20% from 2024 and the highest number since the Defend Trade Secrets Act (“DTSA”) was enacted in 2016.[13][14] Verdicts remain large, although courts have been scrutinizing them; one analysis of the ten largest recent jury awards found judges have reduced compensatory damages by 42% and punitive damages by 45% after post-trial motions and appeals.[14] Plaintiffs who cannot tie their damages to specific, well-defined secrets are increasingly losing those awards. Conversely, where plaintiffs succeed and trial courts tie decisions to specific willfulness findings, exemplary damages awards are upheld on appeal.[25]

A Lesson for Deal Lawyers: Propel Fuels v. Phillips 66

One case deserves a separate mention for anyone who works on M&A. In 2018, Phillips 66 was exploring an acquisition of Propel Fuels, a California renewable fuels retailer, and received Propel’s confidential information under an NDA. Phillips 66 terminated the deal and later launched a competing business. A California jury found willful and malicious misappropriation of Propel’s trade secrets and awarded $604.9 million in compensatory damages. The court added $195 million in exemplary damages, and the resulting judgment exceeds $833 million. Post-trial motions were denied in October 2025, and an appeal is expected.[15]

The court’s order put it plainly: returning confidential information after a failed acquisition and using a clean team for any later, similar venture “ought to have been second nature.”[15] Phillips 66’s failure to follow this basic tenant led directly to this large judgment, which could exceed $1 billion with interest by the time appeals are complete.

From a seller’s perspective, the case is a reminder that the NDA is only as good as your ability to show what you shared, with whom, and when. Use a data room with access logs, stage disclosures so that the most sensitive information comes late in the process, and include return-or-destroy and certification obligations that you actually enforce when a deal dies.

From a buyer’s perspective, Propel is a reason to treat clean-team protocols and post-termination certifications as real compliance obligations, not boilerplate. If your business development team could plausibly pursue a competing project, wall off the people who reviewed the target’s information and document it.

The Evolving “Reasonable Measures” Standard

Courts have long evaluated trade secret status by asking whether the information is secret, valuable, and subject to reasonable efforts to maintain its secrecy.[16] That test has not changed, but how courts apply it in a world of remote work, cloud storage, personal devices, and AI tools certainly has.

Recent decisions show a sharp divide between the pleading stage and the merits. In Samuel Sherbrooke Corp. v. Mayer, the Fourth Circuit held in November 2025 that confidentiality provisions in employment agreements can be enough to plausibly allege reasonable measures at the motion to dismiss stage, without cataloging every technical control the company used.[17]

Compare that with Snyder v. Beam Technologies, decided by the Tenth Circuit a few months earlier. There, the plaintiff’s broker list sat on a laptop without password protection, was not marked confidential, and was shared without an NDA, and no effort was made to get it back after it was disclosed. The court affirmed summary judgment against the trade secret claim.[18] Other courts have reached similar results where companies shared information with contractors without confidentiality agreements.[19]

The flip side is also true. Where a company has a clear device policy, violations of that policy become evidence. In eShares, Inc. v. Talton, an employee’s transfer of company files to a personal device, against company policy and minutes before an HR meeting, supported a finding of improper taking of confidential information.[20]

In practice, the baseline tools many companies already have (NDAs, confidentiality policies, basic access controls) will often get a claim past a motion to dismiss.[17] Those tools might not be enough on their own when the claim is tested at the injunction or summary judgment stage. If your business lives in the cloud, your reasonable measures need to live there too.

The New Leak: Generative AI

The biggest change since my 2024 article is one that did not appear in it at all. Employees now routinely paste code, customer data, pricing, and strategy documents into AI tools, and courts are recognizing that as a confidentiality problem.

• In United States v. Heppner, Judge Rakoff held in February 2026 that a defendant’s exchanges with a public AI tool were protected by neither the attorney-client privilege nor the work product doctrine, in part because the tool’s terms did not ensure confidentiality.[21] That was a privilege case, not a trade secret case, but the reasoning travels: information voluntarily shared with a third-party platform on terms that permit its use is hard to describe as secret.

• Similarly, in Trinidad v. OpenAI, a federal court in California dismissed a DTSA claim where the plaintiff developed the alleged trade secrets on ChatGPT and therefore had “‘disclose[d] [her] [alleged] trade secret to others who are under no obligation to protect the confidentiality of the information.’” [22] Using a public AI tool, in the court’s view, meant that the plaintiff had not taken any reasonable measures to keep her “protocols and frameworks” secret from public disclosure. There can be no secrecy when using publicly available AI tools.

The practical response is not to ban AI. It is to decide which tools are approved, use enterprise versions with contractual confidentiality and no-training commitments, tell employees in writing what may and may not be entered into them, and log usage where you can. Be careful with how broadly you draft: an AI acceptable use policy that restricts employees from discussing their own wages or working conditions can create risk under the National Labor Relations Act.

Startups: A Minimum Viable Trade Secret Program

For early-stage companies, the biggest mistake is assuming that a trade secret program is a later-stage problem. Many startups are built around a single algorithm, dataset, model, or process. If that walks out the door and you cannot show that you treated it like a trade secret all along, there may be no meaningful remedy. The good news is that a practical program can be both affordable and effective.

First, identify what you are trying to protect and where it lives. Create a short list of crown-jewel assets (source code repositories, training datasets, model weights and system prompts, pricing models, go-to-market plans) and map each one to specific systems, folders, and people with access. This helps you prioritize. It also lines up your controls, and later your evidence, with the secrets you would claim in a lawsuit. As recent cases show, courts expect that specificity.

Second, turn on the security features you already have before you buy anything new. Most collaboration and document platforms support role-based access, logging, and restrictions on external sharing. Use them to limit access to key assets to employees who need it. For the most sensitive repositories, configure alerts or restrictions on mass downloads.

Third, address personal devices and AI tools directly. Snyder is a cautionary tale for companies that let critical information sit on unprotected devices. Even if you cannot prohibit bring-your-own-device entirely, you can require encryption, mobile device management, and express consent to remove company data when employment ends. Pair that with a short, signed AI use policy.

Fourth, formalize onboarding and offboarding, even if you have only a handful of employees. At hiring, use confidentiality agreements that include the DTSA whistleblower immunity notice (without it, you may lose the ability to recover exemplary damages and attorneys’ fees against that employee)[23] and a representation that the employee will not bring or use a prior employer’s trade secrets. At departure, follow a written checklist: recover devices, terminate access, remind the employee of continuing obligations, and obtain a written confirmation that company information has been returned and deleted from personal accounts and devices. If a dispute arises, that one-page checklist will be far more persuasive than a general assurance that “we always did the right thing.”

Finally, adopt a simple incident response plan. It should identify who gets called (outside counsel, an IT or forensics consultant), what logs and access records you can pull quickly, and how you will secure devices and accounts while you investigate. That planning can be the difference between a prompt, targeted TRO and a motion that fails because you cannot show what was taken.

Established Companies: The Bar Is Higher

Larger companies usually have the raw materials of a strong program (policies, training, IT tools) but struggle with consistency, documentation, and trade secret-specific focus. Generic information security is not the same thing as a trade secret program, particularly where the company’s competitive advantage rests on specific technology, data, or processes.

Distinguish “confidential” from “trade secret.” Label specific repositories or files as trade secrets, limit access to named roles, and tie heightened controls (stronger authentication, stricter sharing rules) to that category. When trade secret status is litigated, a defined, consistently applied regime for that subset of information is powerful evidence.

Invest in monitoring and forensic readiness. Data loss prevention and user behavior tools can flag large downloads, transfers to personal email or cloud storage, uploads to unapproved AI tools, and unusual access. Just as important, they create the logs your experts will need to reconstruct what happened and support early injunctive relief.

Treat offboarding as part of your reasonable measures story, not an HR formality. For employees with broad access, consider device imaging or at least a targeted review of recent access and download activity, in addition to credential revocation and exit reminders. Keep a contemporaneous record of what was done for each departing employee.

Prepare to prove damages, not just misappropriation. As post-trial reductions show, courts increasingly require plaintiffs to tie damages to the specific secrets that were taken. Knowing what each crown-jewel asset cost to develop, and what it is worth, is easier to document before a dispute than during one.

Bring trade secret risk into governance. Boards and senior management are routinely briefed on cybersecurity and privacy. In many industries, trade secrets are at least as material. An annual trade secret check-up (policies, incidents, litigation trends, AI use, planned improvements) helps demonstrate that the company takes its obligations seriously and gives you a privileged forum to address gaps before they become exhibits.

Hiring From Competitors: Vicarious Liability and Culture

The hardest problems often arise not when your employees leave, but when you hire someone from a direct competitor. Courts have recognized that an employer can be held liable under the DTSA for misappropriation by its employees under respondeat superior. In xAI v. OpenAI, for example, while recognizing that a new employer might be liable for its new employees’ taking and use of a former employer’s trade secrets, the federal court twice dismissed xAI’s DTSA and unfair competition claims against the new employer because the complaint alleged only that former employees took information, not that the new employer used it.[24] The lesson for hiring companies is that what happens after the employee arrives matters most.

Structured practices can significantly reduce this risk:

• Recruiting. Train hiring managers and recruiters to avoid language suggesting that a candidate should bring or rely on a former employer’s information. Pre-hire emails and texts are among the first documents requested in litigation, and a casual comment about “hitting the ground running” can read badly in hindsight.

• Offer and onboarding. Require new hires to acknowledge in writing that they will not bring, use, or disclose a prior employer’s confidential information, and that they will report any such materials in their possession. Reinforce that commitment in orientation.

• The first few months. Apply targeted monitoring based on the risk of the role, such as uploads involving the prior employer’s name, unusually large file transfers, or use of personal email for work.

• Response. If a problem surfaces, quarantine and remove the materials, document the investigation, and take appropriate action. Prompt, decisive action supports the argument that the company neither participated in nor was willfully blind to misappropriation.

Practical Takeaways

• Do not build your protection strategy around non-competes; enforceability now depends on the state, the employee, and the FTC’s view of your industry.

• Audit existing non-competes against current law in each state where you have employees, particularly Washington before its 2027 effective date.

• Identify your crown-jewel trade secrets with specificity, and map where they live and who has access.

• Adopt a written AI use policy, approve specific enterprise tools, and train employees on what may not be entered into them.

• Include the DTSA whistleblower immunity notice in every agreement that addresses confidential information.

• Use a documented offboarding checklist for every departing employee, and enhanced review for those with broad access.

• In M&A and other transactions, stage disclosures, use clean teams, and enforce return-or-destroy obligations when a deal does not close.

• When hiring from competitors, control recruiting communications, obtain written acknowledgments, and respond quickly to red flags.

• Run a tabletop exercise built around a realistic scenario, such as a key engineer leaving for a competitor, and use the results to close gaps.

Closing Thought

My 2024 article ended with a simple point: losing the non-compete does not mean losing your secrets. Two years later, that is even more true. Courts are not demanding perfection, but they are looking for evidence that a company took trade secret risk seriously, tailored its measures to how the business actually operates, and followed through.

The companies that fare best will be the ones that can show, not just say, that they treated their trade secrets like the crown jewels they are.

About the Author

Kristie M. Blase is a New York and Texas licensed attorney who advises founders, boards, investors, and growth-stage companies on M&A, corporate governance, financing, and regulatory risk. She writes and speaks regularly on trade secrets, emerging technology, and practical legal strategies for protecting competitive advantage.