Get tomorrow's brief in your inbox
Today: The Supreme Court heard arguments on Trump's birthright citizenship executive order with justices appearing skeptical of the administration's position. The DOJ admitted ICE engaged in illegal courthouse arrests for most of the past year, contradicting previous government representations. Privacy organizations called on the FTC to strengthen age assurance standards under COPPA.
Romanian DPA Fines ING Bank €4,000 for Data Confidentiality Breach
Romania's ANSPDCP fined ING Bank NV Amsterdam - Sucursala Bucuresti RON 20,388 (€4,000) after a bank employee at the Focșani branch issued an account statement to a third party without the account holder's consent. The DPA found the controller failed to implement appropriate technical and organizational measures to ensure data confidentiality, violating Articles 32(1)(b), 32(1)(d), 32(2), and 32(4) GDPR. The unauthorized disclosure included the data subject's surname, first name, address, IBAN account, and transaction details.
$299.5 Million Toyota Forklift Emissions Settlement (Case No. 3:24-cv-06640-JSC)
Toyota agreed to a $299.5 million settlement resolving class action claims that it sold defective internal combustion forklifts failing to meet emissions standards. The settlement covers individuals and entities that purchased or leased Toyota forklifts with IC engines built between 2007 and 2021, including 2014-2021 1KD, 2014-2021 1ZS, 2013-2021 1FS, and 2007-2021 4Y engines. Class members can receive between $1,000 and $2,500 per eligible forklift, a service plan visit covering labor and travel costs, and a new parts warranty for recall-related engine parts. Toyota has not admitted wrongdoing but plaintiffs claimed they paid for emissions-related repairs due to non-certified forklifts.
$1.85 Million Walmart TeleCheck Settlement (Case No. 1:22-cv-00016-SPW-TJC)
Walmart agreed to a $1.85 million settlement over claims its check processing disclosures failed to inform customers that multiple bank fees could result from insufficient funds. The plaintiff alleged Walmart and TeleCheck made multiple attempts to cash bounced checks and recover return fees, causing customers to incur repeated bank charges. Under the settlement, Walmart will change check-processing disclosures at point-of-sale terminals and PIN pads in all U.S. retail stores. The settlement provides no monetary relief but affects all past and future customers who wrote checks at Walmart stores. The final approval hearing is scheduled for May 13, 2026.
Fabletics Faces Class Action Over Unlawful Tariff Charges (Case No. 2026CH02139)
Chicago resident Norah Flaherty filed a class action against Fabletics LLC in the Circuit Court of Cook County, claiming the company unlawfully passed Trump's 2025 tariffs onto customers and should refund those charges. The lawsuit follows the Supreme Court striking down Trump's tariffs issued under the International Emergency Economic Powers Act (IEEPA), with the U.S. Court of International Trade ordering the federal government to refund tariffs with interest. Flaherty alleges Fabletics will receive a windfall from refunds while customers who paid the tariff costs receive nothing. The suit asserts violations of the Illinois Consumer Fraud and Deceptive Business Practices Act and unjust enrichment, seeking injunctive relief, damages, and attorney fees.
Weber Grill Brush Class Action (Case No. 1:26-cv-01401)
Plaintiffs Richard Malmstein and Geoffrey vonMaucher filed a class action against Weber-Stephen Products LLC alleging the company failed to warn consumers that metal wire bristle grill brushes pose serious ingestion hazards. The lawsuit cites a February 26, 2026 CPSC recall affecting approximately 3.2 million units (models 6277, 6278, 6463, 6464, 6493, 6494) sold for $10 to $17 each. The complaint alleges small metal bristles can detach, stick to grills or food, and cause serious internal injuries requiring surgery. Plaintiffs claim Weber had notice of the hazard through consumer reviews but continued selling without adequate warnings. The suit seeks damages, restitution, and injunctive relief, alleging violations of Colorado Consumer Protection Act, New York General Business Law, and unjust enrichment.
Burlington Tax Collection Class Action (Case No. 1:26-cv-21436)
Plaintiff Karin Sandquist filed a class action against Burlington Stores Inc. in the Southern District of Florida, claiming the company illegally charged and collected 7% Florida sales tax on purchases of tax-exempt baby and toddler products. Florida law has exempted diapers, baby and toddler clothing, apparel, and shoes from sales tax since July 2022, with the exemption made permanent and expanded in 2023. Sandquist alleges the tax line item on receipts is deceptive and misleading, constituting fraudulent misrepresentation, unjust enrichment, breach of contract, unconscionability, conversion, negligent misrepresentation, negligence, and violation of the Florida Deceptive and Unfair Trade Practices Act. The plaintiff seeks class certification for consumers charged sales tax on exempt products from July 1, 2023 to present.
Supreme Court Venue Challenge in Abouammo v. United States
The Supreme Court heard arguments on whether federal prosecutors can try defendants not only where an offense occurs but also where its "contemplated effects" are felt. Ahmad Abouammo was convicted of violating 18 U.S.C. § 1519 for falsifying documents by creating a fake invoice in Seattle and emailing it to FBI agents. The government prosecuted him in San Francisco, where the FBI investigation was based, rather than Seattle where he created the document. Justices appeared skeptical of the government's expansive venue theory, with several pressing on whether the approach is rooted in statutory text and faithful to the Constitution's vicinage requirement. The constitutional guarantee requires defendants be tried where the offense was committed, a reaction to Parliament transporting American colonists to England for trial.
DOJ Admits ICE Engaged in Illegal Courthouse Arrests
The DOJ admitted in a March 24 filing in the Southern District of New York that ICE engaged in illegal courthouse arrests for most of the past year. DOJ counsel informed the court that the May 27, 2025 memorandum entitled "Civil Immigration Enforcement Actions in or Near Courthouses" never applied to civil immigration enforcement actions in or near EOIR immigration courts, contradicting previous government representations. The DOJ acknowledged it must withdraw its primary defense to plaintiffs' claim that the Immigration Court Arrest Policy is arbitrary and capricious under the Administrative Procedure Act. The ACLU noted that defendants have continued arresting noncitizens at immigration court hearings, resulting in detention often hundreds of miles away, while the court relied on the government's false representation to deny preliminary relief.
FCC Chair Approves Nexstar-Tegna Merger Behind Closed Doors
FCC Chair Brendan Carr approved Nexstar Media Group's $6.2 billion purchase of Tegna without a public vote, allowing the merged companies to ignore media consolidation limits preventing one company from reaching more than 39% of households (the combined company reaches 54.5%). The merger creates ownership of 221 Big Four broadcast stations, over half of U.S. stations affiliated with FOX, NBC, ABC, or CBS. Commissioner Anna Gomez criticized Carr's decision to bypass public interest protections through closed-door approval. Eight states filed a lawsuit challenging the merger's legality, citing competition impacts and likely higher cable TV prices from increased retransmission consent fees. California regulators proposed a standard timing agreement to suspend acquisition until state investigation completed, but Nexstar ignored the State AGs for 8 days, ignored their lawsuit for 18 hours, then declared "The relief sought in your Complaint is no longer available."
South Dakota Citizenship Challenge Law
South Dakota Governor Larry Rhoden signed legislation authorizing citizenship challenges to voters by individuals and election officials. The law adds citizenship as justification for challenges, which may be filed by the Secretary of State's Office, the county auditor where the voter is registered, or a voter in the same county. Challenges must be in the form of a signed, sworn statement with documented evidence. State law already allowed challenges to voter registration up to the 90th day before an election for lack of residency or out-of-state registration. A separate law requires new voters to prove U.S. citizenship with passport, birth certificate, or other documents to cast ballots in state and local races, though it does not apply to South Dakotans already on voter rolls.
State Department X Directive Normalizes Platform as Diplomatic Tool
The State Department issued a directive instructing U.S. embassies to use Elon Musk's social platform X in coordinated campaigns to counter foreign propaganda. The directive represents a broader shift in government-tech relationships toward normalization of social media as a tool of statecraft. Until recently, a formal cable endorsing a specific social media platform by name as a diplomatic or military psychological operations tool would have been unthinkable. The structural transformation dismantled legal accountability, operational independence, and institutional resilience that once made such close government-platform relationships inconceivable.
European Parliament Ends Temporary CSAM Scanning Exemption
The European Parliament voted against extending a temporary regulation exempting tech platforms from GDPR-style privacy rules when voluntarily scanning for child sexual abuse material (CSAM). The exemption had been in place and repeatedly extended for years during negotiations for a permanent framework beginning November 2023. Without the exemption, companies now face massive privacy liability under EU law for scanning private messages and stored content. Europol processed around 1.1 million CyberTips from the National Center for Missing & Exploited Children (NCMEC) last year relevant to 24 European countries. Europol warned removal of the legal basis for voluntary detection would seriously reduce CyberTip referrals, undermining capability to detect investigative leads on CSAM and impairing efforts to identify victims and safeguard children.
WhatsApp Warns 200 Users of Fake Spyware-Infected App
WhatsApp alerted approximately 200 users that they were duped into installing a dummy version of the app infected with spyware. The Meta subsidiary alleges Italy's SIO spyware manufacturer designed the phony app specifically for iPhones, with most impacted users in Italy. WhatsApp assessed that threat actors used social engineering tactics to trick people outside the app into downloading malicious software masquerading as WhatsApp. WhatsApp emphasized this was not a WhatsApp vulnerability and end-to-end encryption continues to protect official app users. The security team proactively identified the fake app and blamed SIO subsidiary ASIGINT for creating it. SIO markets itself as a partner of law enforcement, government organizations, police, and intelligence agencies.
Privacy Groups Call for Stronger FTC Age Assurance Standards
A coalition of privacy organizations including the Center for Digital Democracy (CDD) and the Electronic Privacy Information Center (EPIC) called on the Federal Trade Commission to revise its enforcement policy statement on age verification under the Children's Online Privacy Protection Act (COPPA). The groups are lobbying for stronger, privacy-protective age assurance standards in the U.S., emphasizing the need to balance child protection with privacy rights.
French Courts Expand VPN Blocking Orders
French courts issued multiple blocking orders requiring VPN providers including NordVPN, ExpressVPN, and ProtonVPN to block access to pirate sites and sports streaming services. The Paris Judicial Court ordered top VPN providers to block sports streaming domains in August 2025, with additional blocking orders issued at the beginning of 2026. ProtonVPN contested the orders raising jurisdictional questions, evidence of rights ownership, net neutrality defenses citing Article 333-10 of the French sports code violating EU Open Internet Regulation, and arguments that blocking measures are technically unrealizable, costly, and unnecessarily complex. The court rejected all defenses. In Spain, similar orders were issued inaudita parte (without hearing the other side), denying NordVPN and ProtonVPN opportunity to contest measures before they were granted.
Supreme Court Appears Skeptical of Trump Birthright Citizenship Order (Trump v. Barbara)
The Supreme Court heard oral arguments on President Trump's executive order ending birthright citizenship, with a majority appearing likely to strike down the order. Trump's January 20, 2025 executive order "Protecting the Meaning and Value of American Citizenship" ended birthright citizenship for children of undocumented immigrants and those legally but temporarily in the U.S. on student or work visas. The 14th Amendment citizenship clause confers citizenship on anyone "born in the United States, and subject to the jurisdiction thereof." Every federal court that previously considered challenges to the order struck it down, including U.S. District Judge John Coughenour calling it "blatantly unconstitutional" and U.S. District Judge Joseph Laplante finding the order "likely contradicts the text of the Fourteenth Amendment and century-old untouched precedent." Trump attended part of the argument session.
Trump Executive Order on Mail-In Ballot Restrictions
President Trump issued a new executive order entitled "Ensuring Citizenship Verification and Integrity in Federal Elections," which purports to expand federal control over state-run elections to crack down on election fraud. The order restricts mail-in ballots, though specific provisions were not detailed in available reporting. Legal experts have questioned the order's authority to override state election administration.
2026 U.S. Cyber Strategy Suggests Private Sector "Hackback" Authorization
The 2026 U.S. "Cyber Strategy for America" document includes language suggesting authorization for private sector offensive cyber operations: "We will unleash the private sector by creating incentives to identify and disrupt adversary networks and scale our national capabilities." Security experts interpret this as a call for hackback, giving private companies permission to conduct offensive cyber operations. Legal scholars warn that privatized cyberwarfare creates cybersecurity risks, complicates oversight mechanisms, provokes unpredictable countermeasures, undermines international norms, and puts civilians at risk. Adversaries including Russia, China, Iran, and the UAE already outsource offensive cyber operations to private firms. U.S. adoption would normalize private-sector OCOs internationally, emboldening authoritarian governments and multiplying negative implications.
Financial institutions: Audit data access controls and employee training programs following the Romanian DPA's €4,000 fine against ING Bank for unauthorized account statement disclosure. Implement regular reviews of data access logs and strengthen procedures for issuing customer information.
Settlement claim deadlines: Equipment purchasers affected by the Toyota forklift emissions settlement should submit claims by September 22, 2026, with objection and exclusion deadlines of June 1, 2026. File necessary documentation early to avoid missing final approval hearing on July 9, 2026.
State sales tax compliance: Retailers in Florida must verify point-of-sale systems correctly exempt baby and toddler products from sales tax following the Burlington class action. Review tax configurations for all state-specific exemptions to avoid similar consumer fraud claims.
Immigration case review: Immigration attorneys should immediately file motions to reconsider in all ICE-related cases following DOJ's admission that ICE engaged in illegal courthouse arrests for most of the past year, contradicting previous government representations and potentially establishing APA violations.
COPPA age verification: Online platforms subject to COPPA should closely monitor FTC proceedings following privacy groups' call for stronger age assurance standards. Review current age verification methods and prepare to implement enhanced privacy-protective measures if new enforcement policies are issued.