Get tomorrow's brief in your inbox
Today: TRISTAR Insurance Group and Register.com reach $1 million and $1.5 million class action settlements for data breach and robocall violations. OpenAI faces class action for allegedly sharing ChatGPT queries with Meta and Google without user consent. Supply chain attack on TanStack npm library compromises OpenAI's macOS code signing certificates, requiring all macOS users to update by June 12.
OpenAI TanStack Supply Chain Attack (macOS Certificate Compromise)
OpenAI disclosed that two employee devices were compromised in a supply chain attack targeting TanStack, a popular open-source library with over 12 million weekly downloads. The malware exfiltrated limited credential material from internal source code repositories for iOS, macOS, and Windows products, including code signing certificates. The UK government confirmed malicious packages were uploaded in two phases on April 29 and May 11. OpenAI hired an incident response firm, isolated affected systems, revoked user sessions, and rotated credentials.
TRISTAR Insurance Group Data Breach Settlement
TRISTAR Insurance Group reached a $1 million class action settlement for a data breach. Settlement details and eligibility criteria for affected individuals were published.
Register.com Robocalls Settlement
Register.com agreed to a $1.5 million class action settlement for alleged violations of robocall regulations under the Telephone Consumer Protection Act (TCPA). Individuals who received robocalls from Register.com may qualify for compensation.
OpenAI Class Action (ChatGPT Data Sharing)
A new class action lawsuit accuses OpenAI of sharing queries entered into ChatGPT with Meta and Google without users' knowledge or consent. The complaint alleges unauthorized third-party data sharing in violation of user privacy expectations and potentially applicable state privacy laws.
Abbott FreeStyle Libre 2 Product Liability
A class action lawsuit alleges Abbott's FreeStyle Libre 2 continuous glucose monitor is defective and provides incorrect readings that could lead to life-threatening consequences for diabetic users. The complaint centers on product liability and failure to warn claims.
Shein Consumer Protection Lawsuit
Online retailer Shein faces a class action for allegedly using fake discounts based on inflated reference prices to mislead customers into believing items were on sale. The complaint alleges deceptive trade practices in violation of state consumer protection statutes.
Tenth Circuit Rejects Administrative Feasibility Requirement (Rider v. OXY USA)
The Tenth Circuit in Rider v. OXY USA, 2026 WL 1218374 (10th Cir. May 5, 2026), reinforced its holding from Cline v. Sunoco that ascertainability under Rule 23 does not require administrative feasibility for identifying class members. The court reversed a district court's denial of class certification in a royalty payment dispute, holding that a class definition is ascertainable if it is sufficiently definite and defined by objective criteria, even if identifying individual members requires effort at the damages stage. The court noted that administrative feasibility may still be relevant to whether class resolution is superior to individual resolution under Rule 23(b)(3).
Second Circuit Allows Trump to Delay $83M Defamation Payment
The U.S. Court of Appeals for the Second Circuit agreed to let President Trump delay paying the $83 million defamation award to E. Jean Carroll until the Supreme Court reviews or rejects his appeal. The court required Trump to post a $7.4 million bond to cover additional interest during the delay.
Revised GUARD Act (AI Companion Age Verification)
Congress narrowed the GUARD Act following criticism of its original broad application to AI systems. The revised bill focuses on "AI companions" that engage in interactions involving emotional disclosures or present persistent identities, personas, or characters. The bill still requires companies to implement age verification systems tied to users' real-world identities (financial records, government ID, or age-verified accounts). Companies face fines up to $250,000 per violation, enforced by federal and state officials. The Electronic Frontier Foundation notes the revised definition remains unclear at the margins and could apply to customer service chatbots with empathetic responses.
OpenAI KOSA Endorsement
OpenAI endorsed the Kids Online Safety Act (KOSA), citing support for child safety online. Critics argue KOSA functions as a surveillance and censorship bill that will increase compliance costs, creating regulatory barriers that favor large companies over smaller competitors. The endorsement follows a pattern of large tech companies supporting legislation that imposes compliance burdens difficult for startups to meet.
Trump Counterterrorism Strategy (Domestic Extremism Designations)
The White House released a counterterrorism strategy document identifying "Violent Left-Wing Extremists, including Anarchists and Anti-Fascists" as a security threat equal to "Legacy Islamist Terrorists" and "Narcoterrorists and Transnational Gangs." The strategy prioritizes "rapid identification and neutralization of violent secular political groups whose ideology is anti-American, radically pro-transgender, and anarchist." The document does not mention far-right violence. Critics note the policy positions domestic political opposition as terrorism, raising First Amendment concerns.
FDA Commissioner Marty Makary Resigns
FDA Commissioner Marty Makary resigned following conflict with President Trump over authorization of flavored e-cigarettes. Trump reportedly called Makary over a weekend to pressure authorization of menthol, mango, and blueberry vape flavors from manufacturer Glas. The FDA authorized the products days later and issued a new policy making it easier to market flavored vapes. The Department of Health and Human Services currently lacks Senate-confirmed leadership for the FDA Commissioner, CDC Director, and Surgeon General positions.
ODNI Coordinates Election Threat Response
Director of National Intelligence Tulsi Gabbard designated Dave Mastro (National Intelligence Council) and James Cangialosi (National Counterintelligence and Security Center) as election threats executives to coordinate intelligence community efforts to monitor foreign threats to the 2026 midterm elections. The pair confirmed ODNI would follow the existing notification framework for foreign interference. Gabbard previously scaled back the Foreign Malign Influence Center as part of a larger reorganization, a move criticized by Democrats but supported by Republicans who argued the center suppressed conservative free speech.
Supreme Court Extends Mifepristone Access (Abortion Pill Mail Order)
The Supreme Court issued an order continuing to block a Fifth Circuit ruling that would have barred mailing of mifepristone, one of two drugs used in medication abortions. Justice Alito had temporarily paused the lower court's order; the Thursday order extended that pause, allowing mifepristone to continue being sent through the mail while litigation continues. Justice Thomas dissented, arguing drug companies "cannot, in any legally relevant sense, be irreparably harmed by a court order that makes it more difficult for them to commit crimes." Justice Alito also dissented, calling the order "remarkable" and contending it perpetuates "a scheme to undermine our decision in Dobbs." The Fifth Circuit had ruled that Louisiana has standing to challenge the FDA's expansion of mifepristone access, including the in-person dispensing requirement, because the FDA "opened the door for mifepristone to be remotely prescribed to Louisiana women" despite Louisiana's abortion ban.
Radiant Mobile MVNO Announces LGBTQ+ Content Filtering
A new mobile virtual network operator called Radiant Mobile, operating on the T-Mobile network, announced plans to censor all LGBTQ+ content at the network level in addition to pornography. Founder Paul Fisher stated the service would create an environment "void of pornography, void of LGBT, void of trans." The MVNO is working with Israeli cybersecurity firm Allot to implement network-level content blocking. Network-level porn filters are known to block unintended content and are often easy to bypass. T-Mobile declined to comment on whether the content blocks violate its policies, stating it does not have a direct relationship with Radiant Mobile but works through MVNO manager CompaxDigital.
Virginia Redistricting Map Dispute (Pending Supreme Court Review)
Virginia Attorney General Jay Jones and Virginia Democrats asked the Supreme Court to block a Virginia Supreme Court ruling that invalidated a constitutional amendment allowing the General Assembly to enact a new congressional map. The state supreme court ruled the amendment referendum was invalid because the General Assembly first approved the amendment on October 31, 2025, after more than 1.3 million votes had already been cast in the 2025 general election, violating the state constitutional requirement that amendments be approved during two legislative sessions separated by a House of Delegates election. Republican legislators urged the Supreme Court to leave the state court's ruling in place, arguing it is too late to intervene (Virginia has indicated it will not use the 2026 map) and that Jones never raised federal claims in state court. A response to Virginia's request was due May 14 at 5 p.m.
DOJ Weaponization Working Group Report
The Department of Justice released the first report from its "Weaponization Working Group," examining alleged political targeting of individuals during the Biden administration. Critics argue the report incorporates government-speak and sourcing to normalize investigating and prosecuting former officials, potentially serving as a framework for future accountability claims against current Trump administration officials.
DHS Administrative Warrant Policy (Home Entry)
Immigration and Customs Enforcement implemented a policy allowing agents to enter homes with administrative warrants, a nonjudicial form that agents themselves sign off on. Legal scholar Lindsay Nash argues the policy misunderstands or misrepresents the legal justifications for administrative warrants. Nash notes that supervisors have issued blank, presigned arrest warrant forms, agents have relied on warrants with factual flaws, and ICE regularly attempts to use warrants that postdate arrests. Nash argues the scale of warrant-issuing and the political agenda driving decisions create a radically different context than the Supreme Court precedent in Abel that originally authorized administrative warrants.
Update OpenAI macOS applications by June 12. All macOS users of OpenAI products must install updates to receive new code signing certificates following the TanStack supply chain attack. After June 12, applications will not function properly. Organizations should verify software authenticity through updated certificates and review use of affected npm packages.
Assess ChatGPT vendor contracts for third-party data sharing. The OpenAI class action alleging unauthorized sharing of ChatGPT queries with Meta and Google requires organizations to review vendor agreements for data sharing clauses and evaluate whether ChatGPT use involves confidential business information or customer data subject to privacy regulations (CCPA, GDPR, HIPAA).
Monitor GUARD Act implementation for AI companion age verification. The revised GUARD Act targets AI companions with age verification requirements tied to real-world identities. AI developers should assess whether conversational systems fall within the bill's definition and prepare for potential $250,000 per violation penalties. Review privacy implications of age verification methods.
Prepare for Supreme Court ruling on mifepristone access. Healthcare providers prescribing mifepristone should continue following current FDA guidance allowing mail delivery, but monitor litigation closely for changes. Providers in states with abortion bans face shifting enforcement risk as standing arguments evolve.
Document ICE administrative warrant encounters. The new ICE policy authorizing home entry with nonjudicial administrative warrants raises Fourth Amendment concerns. Organizations with employees subject to immigration enforcement should consult counsel on warrant limitations and document encounters for potential legal challenges.