Get tomorrow's brief in your inbox
Today: A DC federal court issued its second order blocking ICE's warrantless arrests after the agency continued using administrative warrants to enter homes and detain people without judicial authorization. EFF released new guidelines for combating digital surveillance abuses across the Americas, calling for prior judicial authorization and independent civilian oversight of all surveillance operations. The Supreme Court agreed to hear arguments on whether Title IX allows employees to sue schools for sex discrimination.
DC Court Orders ICE To Stop Engaging In Warrantless Arrests
Judge Beryl Howell issued a second order directing ICE to cease warrantless arrests after the agency continued detaining people using administrative warrants that lack judicial authorization. The court found that ICE deliberately narrowed its definition of "escape risk" to justify arrests at immigration court check-ins and other locations where migrants are actively participating in naturalization proceedings. ICE's acting director Todd Lyons issued a policy memo after initial court losses, but the memo dropped key language that would have protected migrants who are "unlikely to be located at the scene of the encounter or another clearly identifiable location once an administrative warrant is obtained." The court found this deliberate word-game enabled ICE to treat nearly any migrant as immediately arrestable despite constitutional protections requiring probable cause and judicial warrants for home entries and arrests.
More than 200 arrested in cyber raids aimed at Middle East scam networks
Interpol announced that Operation Ramz resulted in 201 arrests across 13 countries in North Africa and the Middle East between October and February. The operation targeted phishing infrastructure and financial fraud scam operations. Police in Jordan dismantled a compound running financial trading platform scams and determined that 15 individuals found at the site were human trafficking victims who had been recruited on false employment promises, had their passports confiscated upon arrival, and were forced to participate in the schemes. Two people accused of operating the scam center were arrested. Moroccan authorities arrested three people after discovering hard drives containing banking data and phishing software. In Algeria, one person was arrested after investigators traced a phishing-as-a-service platform to a local server. The operation identified 382 additional suspects, seized 53 servers, and identified 3,867 victims.
Fanatics handling fees class action settlement
Consumers who paid handling fees on Fanatics.com can claim two $5 vouchers under a class action settlement. The settlement addresses allegations that Fanatics charged improper handling fees on online purchases.
JetBlue class action alleges airline uses consumer data to set ticket prices
JetBlue Airways faces a class action lawsuit alleging the airline uses consumer data to set personalized ticket prices. The complaint challenges the practice of dynamic pricing based on customer information collected through the airline's website and booking systems.
Papa John's hit with class action over alleged tracking despite users rejecting cookies
A class action lawsuit alleges Papa John's tracks users' data even when they opt out of website cookies. The complaint claims the pizza chain's website continues to collect and use customer data despite users explicitly rejecting cookie consent prompts.
Citizens Bank class action alleges bank failed to protect sensitive information in data breach
Citizens Bank faces a class action lawsuit alleging the bank failed to protect customers' personally identifiable information in a data breach. The complaint claims inadequate security measures allowed unauthorized access to sensitive customer data.
Website tracking and data privacy class action investigation
Class action investigators are examining websites that use tracking pixels and similar technology to collect and share user information with third parties. The investigation focuses on sites that may use tracking technology without proper consent or disclosure.
Trader Joe's sued over 'low acid' coffee allegedly as acidic as regular coffee
Trader Joe's faces a class action lawsuit alleging the company falsely advertises its low-acid coffee as containing lower acidity levels than regular coffee when testing shows comparable acidity levels. The complaint challenges product labeling accuracy.
Grafana refuses to pay ransom after codebase theft
Grafana Labs confirmed that hackers obtained a token with access to the company's GitHub environment and downloaded the codebase. The analytics company investigated the incident and determined no customer data or personal information was accessed and found no evidence of impact to customer systems or operations. An extortion group known as CoinbaseCartel attempted to blackmail Grafana Labs to prevent release of the codebase. Grafana Labs refused to pay the ransom based on FBI guidance that paying cybercriminals provides no guarantees. The company identified the source of the credential leak, invalidated the compromised credentials, and took additional security measures. CoinbaseCartel is a data theft offshoot of the Scattered Lapsus$ Hunters collective and has attempted to extort more than 100 companies since September using stolen credentials and social engineering rather than ransomware.
US Citizens In ICE Detention Centers Is The New Normal In Trump's America
Border czar Tom Homan acknowledged that ICE has detained US citizens but claimed they are not deported. A Florida-born US citizen, Garcia Venegas, was detained by ICE three separate times despite showing identification and offering to provide his US passport. The Institute for Justice is handling Venegas's civil lawsuit against the government. In the most recent incident, ICE agents pulled Venegas from a vehicle, shackled him, and questioned him about his place of birth while refusing his offers to prove citizenship. Agents told him he was stopped because the vehicle was registered to his undocumented brother. Previous detentions occurred at construction sites where ICE raided workplaces. The administration previously deported a two-year-old US-born child to Honduras in violation of a federal court order.
Supreme Court agrees to hear case on ability of employees to bring certain suits for sex discrimination
The Supreme Court granted review in Crowther v. Board of Regents of the University System of Georgia for the 2026-27 term. The case addresses whether employees can bring lawsuits for sex discrimination under Title IX of the Education Amendments of 1972, which bars sex discrimination by schools receiving federal funding. The U.S. Court of Appeals for the 11th Circuit threw out claims by an art professor and women's basketball coach at Georgia public universities, with Chief Judge William Pryor concluding that Title IX's text does not indicate congressional intent to provide a private right of action to employees of educational institutions. U.S. Solicitor General D. John Sauer agreed the court should take the case and sided with the university's interpretation, but contended the justices should grant review due to circuit splits on the question.
Court sends Voting Rights Act cases back for reconsideration
The Supreme Court sent Turtle Mountain Band of Chippewa Indians v. Howe and State Board of Election Commissioners v. Mississippi State Conference of the NAACP back to lower courts for reconsideration in light of the court's April 29 decision in Louisiana v. Callais, which substantially narrowed Section 2 of the Voting Rights Act. Justice Ketanji Brown Jackson dissented, arguing she would have left the Mississippi ruling in place and reversed the Native Americans' case based on the 1996 decision in Morse v. Republican Party of Virginia. Jackson wrote that the cases present only the question of Section 2's private enforceability, which the Callais decision did not address.
Supreme Court requests views on private prison minimum wage case
The Supreme Court asked the Trump administration for its views on The GEO Group v. Nwauzor, a case brought by immigration detainees and Washington state arguing that private prison contractor GEO Group violated state minimum-wage law by paying detainees only $1 per day for their work at an ICE facility. The U.S. Court of Appeals for the 9th Circuit allowed the lawsuit to proceed.
We Must Not Normalize Digital Surveillance Abuses. EFF's New Guide Underlines Concrete Steps to Fight Back.
EFF released Tackling Arbitrary Digital Surveillance in the Americas, a guide compiling privacy, data protection, and access to information guarantees established within the Inter-American Human Rights System. The guide provides concrete guidance to governments in the Americas to curb state digital surveillance abuses. It outlines safeguards and institutional measures necessary to protect individuals and details rules, parameters, and standards to overcome current surveillance practices. The guide calls for clear legal frameworks that define surveillance powers and limitations, ensure all surveillance measures pursue legitimate aims without discriminatory ends, subject privacy interference to rigorous necessity and proportionality analysis, require prior judicial authorization for digital surveillance measures, maintain detailed records of surveillance operations, establish independent civilian oversight institutions with technical expertise and enforcement powers, guarantee individuals' right to informational self-determination and proper notification, and provide effective remedies and reparation for victims of surveillance abuses. The great majority of states in Latin America have ratified the American Convention on Human Rights and these parameters stem directly from their obligations under international human rights law.
We Updated Our Privacy Policy. Here's What Changed and Why.
EFF updated its privacy policy to introduce opt-in email tracking. The organization will ask subscribers for explicit consent to see whether they open emails and click on links. If users say no or ignore the request, no tracking will occur. Users who consent can opt out at any time by clicking an opt-out link in future emails or contacting [email protected]. EFF will not use tracking pixels and will not build profiles, share data, or sell information. The organization estimates that two-thirds of emails received by users contain tracking regardless of whether senders received explicit consent when recipients signed up. EFF implemented this approach to demonstrate that opt-in consent requirements are viable and can provide email senders with campaign performance data while respecting user privacy.
Experts warn of privacy risks as AI firms looks to connect to financial accounts
OpenAI announced a ChatGPT feature allowing users to connect financial accounts to the chatbot for personal finance advice, powered by Plaid and Intuit. The feature integrates information from more than 12,000 financial institutions including Bank of America, American Express, Robinhood, and Charles Schwab. The platform provides a dashboard showing portfolio performance, spending, subscriptions, and upcoming payments. The feature is available to ChatGPT Pro subscribers and will roll out to Plus users with the goal of making it available to everyone. OpenAI stated users can disconnect accounts whenever they want, delete conversation history, erase "financial memories," and use "temporary chats" that don't access financial accounts. Ridhi Shetty of the Center for Democracy and Technology warned that the financial information collected can reveal deeply personal details about a person's life, habits, vulnerabilities, and relationships. OpenAI's announcement does not address whether the financial data could eventually be used for advertising or commercial targeting. Cybersecurity experts noted that while the "view only" aspect is safer than an agent that can move money, if someone takes over a ChatGPT account they may get a consolidated picture of balances, spending, investments, and debts.
Trump Just Created An Unconstitutional $1.776 Billion Loyalty Rewards Program For MAGA
President Trump created a $1.776 billion fund to issue formal apologies and monetary relief to individuals who claim they were mistreated by the Biden administration. The fund will be drawn from the Treasury Department's Judgment Fund, which is designed to pay court-ordered settlements, not discretionary payments. The fund consists of five members appointed by the Attorney General, with one member chosen in consultation with congressional leadership. The President can remove any member at any time. The settlement agreement states that once funds are deposited into the designated account, the United States has no liability for protection or safeguarding of those funds regardless of bank failure, fraudulent transfers, or other fraud or misuse. The fund will send quarterly reports to the Attorney General outlining who received relief and what form of relief was awarded. Submission of claims is voluntary with no partisan requirements to file, and any money left when the fund ceases operations will revert to the federal government.
Immigration enforcement compliance: Federal and state law enforcement agencies must obtain judicial warrants before arrests or home entries in immigration cases. Administrative warrants signed by agency officials do not satisfy Fourth Amendment requirements. Organizations should train security and HR personnel to verify warrant types before allowing government access to facilities or personnel records.
Cookie consent implementation: Review website cookie consent mechanisms to ensure tracking technologies are fully disabled when users reject cookies. Papa John's lawsuit demonstrates that displaying consent notices without functionally preventing data collection when users opt out creates liability exposure under state consumer privacy laws.
Code repository security: Following the Grafana Labs breach, audit access token management for GitHub and other code repositories. Implement credential rotation schedules, monitor for unauthorized access, and prepare incident response plans that address extortion attempts without relying on ransom payments per FBI guidance.
AI chatbot financial data sharing: Assess whether employees connecting corporate financial accounts to AI chatbots like ChatGPT violates data security policies or creates unauthorized third-party data sharing. Consider whether financial data shared with AI platforms triggers privacy notice requirements under CCPA, VCDPA, or other state consumer privacy laws.
Email tracking consent: Evaluate email marketing practices against EFF's opt-in model. Document explicit consent separately from newsletter signup, provide clear opt-out mechanisms in every communication, and avoid automatic tracking pixel deployment without affirmative user consent to reduce privacy litigation risk.