Get tomorrow's brief in your inbox
May 9, 2026
Today: General Motors agreed to pay $12.75 million under the California Consumer Privacy Act for selling driver data without consent, the largest CCPA fine to date. The 8th Circuit struck down the FCC's broadband discrimination complaint process. A federal court rejected the Trump administration's use of ChatGPT to determine if NEH grants were "DEI-related," finding the process arbitrary and capricious and a First Amendment violation.
GM $12.75M California Privacy Settlement
General Motors agreed to pay $12.75 million to settle charges that it violated the California Consumer Privacy Act by collecting driving data through its OnStar product and selling it to data brokers Verisk and LexisNexis Risk Solutions without consumer consent. The settlement is the largest fine issued under CCPA since the law took effect over five years ago. California investigators found that GM sold hundreds of thousands of consumers' geolocations, driving behavior, names, and contact information from 2020 to 2024, earning approximately $20 million nationwide. GM falsely told consumers their data would only be used to provide OnStar services and denied selling driving or location data. The data brokers used the information to create driver rating products sold to insurers.
New Mexico AG Seeks $3.7B from Meta for Public Nuisance
New Mexico Attorney General is asking a state court to order Meta to pay approximately $3.7 billion to address what the state describes as a "public nuisance" caused by Meta's social media platforms. The filing represents an escalation in state-level enforcement against social media companies over platform safety and youth protection concerns.
Virginia Man Convicted of Deleting 96 Government Databases
Sohaib Akhter, 34, was found guilty of conspiracy to commit computer fraud, password trafficking, and firearm possession after deleting 96 government databases and providing unauthorized access to an EEOC discrimination complainant's email account. Akhter and his twin brother Muneem worked at an unnamed Washington D.C. company providing software services to more than 45 federal agencies. After being fired when the employer learned of Akhter's prior felony convictions, the brothers accessed computers without authorization, write-protected databases, deleted databases, and destroyed evidence. Akhter previously served two years in prison after pleading guilty in 2015 to conspiracy to commit wire fraud and unauthorized computer access.
Kingdom Market Administrator Sentenced to 16 Years
Slovakian national Alan Bill, 33, received a 16-year prison sentence for his role in running Kingdom Market, a dark web marketplace operating from March 2021 to December 2023. Bill pleaded guilty in January to conspiracy to distribute controlled substances after admitting he provided web administration services, created forum pages on social media, mediated transactions, and was paid in cryptocurrency. German authorities seized Kingdom Market servers in December 2023, revealing more than 1,500 heroin sales and 600 Oxycodone sales, all cut with fentanyl, along with stolen identity and financial information, counterfeit currency, and fake IDs. The platform operated using Bitcoin, Litecoin, Monero, and Zcash, taking a 3% commission on illegal transactions.
$2.39M Union Bank Data Breach Settlement
Union Bank and Trust Co. agreed to pay nearly $2.4 million to settle a data breach class action. The settlement provides compensation for consumers affected by the Union Bank and Trust data breach.
Apple $250M Settlement Over AI Feature Claims
Apple agreed to a proposed $250 million class action settlement resolving claims it falsely advertised artificial intelligence features for certain iPhone models. The settlement addresses allegations that Apple overhyped iPhone AI capabilities.
$2.6M Freedom Energy Oklahoma Earthquake Settlement
Freedom Energy, Montclair, New Dominion, and H&P agreed to a $2.6 million class action settlement to resolve claims that wastewater disposal wells contributed to earthquakes in Oklahoma. The settlement compensates property owners alleging earthquake damage linked to energy company disposal operations.
Federal Court Blocks ChatGPT-Based Grant Review
Judge Colleen McMahon issued a 143-page ruling finding that the Department of Government Efficiency's use of ChatGPT to review National Endowment for the Humanities grants violated the Administrative Procedure Act and the First Amendment. DOGE officials Justin Fox and Nate Cavanaugh canceled millions of dollars in previously approved grants by asking ChatGPT: "Does the following relate at all to DEI? Respond factually in less than 120 characters." The court found this process met the "arbitrary and capricious" standard, as Fox testified he did not define "DEI" for ChatGPT and had no idea how the AI understood the term. ChatGPT classified grants as DEI-related based on general references to history, culture, or identity, including a project on ancient Jewish writings and a study documenting Chinese persecution of Uyghurs. The ruling makes the grant cancellations unlawful.
Trump E. Jean Carroll Appeals Continue
The Second Circuit denied Donald Trump's requests for en banc rehearing in both Carroll I ($83.3 million defamation verdict) and Carroll II ($5 million sexual assault and defamation verdict). This marks the third and fourth times the court has voted to deny en banc rehearing in the case. Trump and the DOJ petitioned for rehearing on the Westfall Act substitution ruling, while Trump separately petitioned on presidential immunity grounds. A Second Circuit judge noted exhaustion with the proceedings, writing this is "the fifth and sixth opinions by our Court in this case."
MoneyLion Faces Washington TCPA Class Action
A Washington consumer filed a class action lawsuit claiming MoneyLion violated state law by sending unsolicited referral text messages to consumers in the state. The lawsuit alleges violations of Washington's consumer protection statutes governing unsolicited marketing communications.
8th Circuit Strikes Down FCC Broadband Discrimination Rules
The 8th Circuit Court of Appeals struck down the FCC's broadband discrimination rules in their entirety, ruling the agency exceeded its statutory authority. The FCC's 2023 rules acknowledged that telecoms have refused to evenly upgrade broadband in low-income and minority areas and charged those communities higher prices for worse service. The court held the FCC exceeded authority by imposing liability for "disparate impact" instead of only policing "disparate treatment," and by extending the complaint process to subcontractors. The ruling vacates the complaint process for consumers who experienced broadband discrimination based on race or income. The FCC could attempt to re-establish rules, but those efforts face significant obstacles under the post-Chevron legal framework.
EU AI Act Omnibus Delays High-Risk Compliance
The Council of the EU and European Parliament agreed to delay and amend the EU AI Act. Compliance obligations for stand-alone high-risk AI systems will come into effect December 2, 2027 rather than August 2026. High-risk systems embedded in regulated products (medical devices, vehicles, machinery) face deadlines ranging from August 2, 2028 to product-specific carve-outs. The omnibus adds a new prohibited practice covering AI systems generating non-consensual sexual content or child sexual abuse material, effective December 2, 2026. Providers of synthetic content generation systems must ensure outputs are marked in machine-readable format by December 2, 2026. The agreement allows processing of special category personal data where strictly necessary to detect and correct AI bias, reducing tension between the AI Act and GDPR. SME exemptions extend to small mid-cap companies.
Supreme Court Justices to Testify on Budget
Supreme Court justices will testify before the Senate Appropriations Committee on May 20 regarding the Court's FY2027 budget request. The hearing will focus on the Court's request for $14.6 million in additional funding for justices' security. This is the first time justices have testified at a Senate hearing since 2011.
Court Strikes Down Trump Global Tariffs
A split three-judge panel of the Court of International Trade ruled that President Trump overstepped the tariff power available under Section 122 of the Trade Act of 1974 when he imposed 10% global tariffs after the Supreme Court struck down his original tariffs in February. The decision directly blocks tariff collection from three plaintiffs: Washington state, spice company Burlap & Barrel, and toy company Basic Fun. Uncertainty remains whether other businesses must continue paying. The administration is expected to appeal to the U.S. Court of Appeals for the Federal Circuit and potentially to the Supreme Court.
EFF Opposes Revised GUARD Act Age Verification
Congress narrowed the GUARD Act to focus on "AI companions" rather than all AI chatbots, but EFF warns the bill still creates serious privacy, speech, and parental choice problems. The revised bill requires companies offering AI companions to verify users are adults through identity-linked verification systems tied to financial records or mobile operating system accounts. The bill defines AI companions as systems that "engage in interactions involving emotional disclosures" or present a "persistent identity, persona or character," which could sweep in customer service chatbots with empathetic responses. The revised bill increases penalties from $100,000 to $250,000 per violation, creating incentives to over-restrict access. Even parents who want teenagers to use conversational AI for social interaction or creative roleplay would face mandatory age checks tied to sensitive personal information.
Canvas Platform Breach Disrupts University Final Exams
Instructure's Canvas educational platform was targeted by ShinyHunters cybercriminal gang for the second time in one week, forcing dozens of universities to delay final exams. After an initial breach on April 29, hackers exploited Canvas Free-For-Teacher accounts to deface the platform on May 7, displaying a ransom message urging schools to negotiate directly with the gang by May 12. Instructure confirmed hackers stole 3.6 TB of data including names, email addresses, student ID numbers, and messages from more than 9,000 schools. Canvas supports learning at 41% of higher education institutions in North America. Instructure shut down all Free-For-Teacher accounts, notified the FBI and CISA, and stated external experts found no evidence of current threat actor access. The company was removed from the ShinyHunters leak site on May 8, suggesting a possible ransom payment.
Alabama Requests Supreme Court Intervention on Voting Rights Map
Alabama asked the Supreme Court to clear the way for it to use a congressional map with one majority-Black district rather than the court-ordered map with two such districts. Alabama argues its 2023 map complies with the Supreme Court's April 29 ruling in Louisiana v. Callais, which struck down Louisiana's congressional map. Alabama contends it "complied with Callais before Callais" by drawing the 2023 map to achieve neutral goals like protecting incumbents while refusing to let race predominate. Justice Clarence Thomas directed challengers to respond by May 11 at 5 p.m. EDT. Alabama's primary election is scheduled for May 19. The state Legislature held a special session and is ready to pass a bill reinstating the 2023 map if the injunction is lifted. Alabama asserts it could shift election deadlines to conduct special elections under the 2023 map if the injunction is promptly lifted.
War Powers Resolution Compliance Disputed in Iran Conflict
The Trump administration claims it has complied with the War Powers Resolution's 60-day deadline by asserting that hostilities with Iran "terminated" when a ceasefire began on April 7, 2026. President Trump's May 1 letter to Congress states there has been "no exchange of fire between United States Forces and Iran since April 7," when Trump "ordered a 2-week ceasefire" that "has since been extended." The administration argues the War Powers Resolution's 60-day requirement is satisfied because hostilities that began on February 28 with Operation Epic Fury have ended, even though U.S. forces remain deployed. Legal scholars dispute whether pauses in combat reset the 60-day deadline, allowing military operations to continue without formal congressional authorization.
DOJ Indicts Southern Poverty Law Center
The Department of Justice announced wire and bank fraud charges against the Southern Poverty Law Center on April 21, 2026. The SPLC, which dismantled the KKK through civil litigation in the 1980s and tracks violent hate groups, is accused of secretly supporting the groups it has opposed for decades. Critics describe the prosecution as politically motivated, noting it is handled by the same DOJ office that previously attempted to convict Trump political opponents James Comey and Letitia James. The charges relate to the SPLC's designation of certain conservative organizations as hate groups, though labeling non-violent organizations is not a crime.
FBI Raids Virginia Redistricting Leader's Office
The FBI searched Virginia state Senate leader L. Louise Lucas's Portsmouth office and neighboring cannabis shop on May 7, bringing into public view a corruption investigation that sources say began during the Biden administration. Lucas was instrumental in Virginia's recent redistricting effort, a Democrat-led initiative that voters approved in April to counter Republican gerrymandering. The referendum could shift Virginia's Congressional delegation from 6-5 Democratic to 10-1. Fox News correspondent Alex Hogan, based in London, was on scene to cover the raid. Democrats view the investigation against a backdrop of politically charged inquiries during the Trump administration.
Connected vehicle data sales: Obtain affirmative consumer consent before selling driving data to third parties, delete data after 180 days without renewed consent, and implement privacy programs with documented risk assessments. California's $12.75 million GM settlement sets the standard for CCPA enforcement against automotive data practices.
EU AI Act timeline update: High-risk AI system compliance is delayed to December 2, 2027 for stand-alone systems and August 2, 2028 for embedded systems. Synthetic content watermarking and the new prohibition on non-consensual sexual content generation take effect December 2, 2026. Update implementation roadmaps and prioritize watermarking and content safety controls.
Educational platform security: Institutions using third-party learning management systems should review vendor security requirements, breach notification procedures, and contractual remedies. The Canvas incident affecting 9,000 schools demonstrates the systemic risk of centralized educational platforms. Assess whether contracts require prompt breach notification, forensic investigation, and compensatory measures.
Federal grant reviews: The court ruling against ChatGPT-based grant reviews establishes that AI decision-making without human oversight, clear definitions, or consideration of substantive merit violates administrative law. Federal contractors should document decision processes and avoid delegating substantive evaluations to AI systems without defined parameters and human review.
Age verification legislation: Monitor the GUARD Act and similar state proposals requiring identity-linked age verification for online services. If enacted, developers of conversational AI will need identity verification infrastructure, legal analysis of the "AI companion" definition, and risk assessment of $250,000-per-violation liability exposure.