Get tomorrow's brief in your inbox
Today: California lawmakers exempted open-source operating systems from AB 1043's age-gating regime but expanded age verification requirements to all web browsers and websites via AB 1856. The Supreme Court issued four opinions including a Federal Arbitration Act decision protecting last-mile drivers from forced arbitration. New York's Department of Financial Services released guidance to financial institutions on cybersecurity risks posed by frontier AI models that accelerate exploit identification.
South Central Bank Overdraft Fees Settlement ($2.8M)
South Central Bank will pay $2.8 million to settle a class action lawsuit over retry fees and overdraft fees charged to customers. The settlement covers customers who were charged these fees during the class period. Claims are currently open for eligible customers to submit for compensation.
Best Buy Privacy Class Action (VPIPA)
A new class action accuses Best Buy of selling customers' personal data to third-party advertisers without knowledge or consent in violation of Virginia's Personal Information Privacy Act (VPIPA). The complaint alleges the electronics retailer transmitted customer shopping behavior, browsing history, and personally identifiable information to advertising networks for revenue generation. VPIPA grants Virginia consumers a private right of action and statutory damages for violations.
Bitcoin Depot Impersonation Scam Liability ($76K)
A class action alleges Bitcoin Depot failed to protect consumers from impersonation scams targeting its Bitcoin ATM network. The complaint cites a case where a victim lost $76,000 after scammers impersonating government officials directed the victim to deposit cash into Bitcoin Depot ATMs. The lawsuit claims the company failed to implement fraud detection controls, transaction limits, or consumer warnings despite widespread use of cryptocurrency ATMs in impersonation schemes.
Redfin Data Sharing Class Action (Meta/TikTok)
Redfin faces a class action for allegedly transmitting users' private video-viewing activity and sensitive financial information to Meta and TikTok without consent. The complaint claims Redfin embedded tracking pixels that captured property search behavior, mortgage affordability data, and video engagement metrics, then transmitted this data to advertising platforms for targeting. The lawsuit invokes state wiretap statutes and privacy laws prohibiting third-party disclosure of electronic communications.
Flowers Foods v. Brock (Federal Arbitration Act Exemption)
The Supreme Court unanimously held that the Federal Arbitration Act's exemption for workers "engaged in interstate commerce" extends to last-mile delivery drivers who transport goods on intrastate legs of interstate journeys, even when they never cross state lines. Justice Gorsuch wrote for the court that workers can "take part" in interstate commerce without leaving a state or touching vehicles that cross state lines. The decision protects these workers from forced arbitration clauses and preserves their right to file lawsuits in court rather than private arbitration.
Pitchford v. Cain (Death Penalty Jury Selection)
The Supreme Court held 5-4 that the Mississippi Supreme Court unreasonably determined that Terry Pitchford, currently on death row, had waived his opportunity to rebut the prosecutor's race-neutral justifications for peremptory strikes of four Black prospective jurors. Justice Kavanaugh wrote the majority opinion. Justice Gorsuch dissented, joined by Justices Thomas, Alito, and Barrett. The decision grants relief under federal habeas review and requires Mississippi courts to allow Pitchford to challenge the jury selection process.
Fernandez v. United States (Sentence Reduction Denial)
The Supreme Court ruled 8-1 that doubts about the validity of a conviction do not qualify as "extraordinary and compelling reasons" for sentence reduction under 18 U.S.C. § 3582(c)(1)(A). Justice Barrett wrote the majority opinion. The decision limits the avenue for prisoners to challenge convictions through compassionate release motions rather than direct appeals or habeas corpus petitions.
Rutherford v. United States (Sentencing Disparity)
The Supreme Court held 6-3 that a sentencing disparity created by Congress's nonretroactive change to mandatory penalties for using and carrying a gun during a crime of violence does not qualify as an "extraordinary and compelling reason" to shorten a sentence. Justice Barrett wrote the majority opinion. Justices Sotomayor, Kagan, and Jackson dissented. The decision rejects equal-treatment arguments for retroactive sentence adjustments when Congress declines to make new sentencing laws retroactive.
NYDFS Frontier AI Cybersecurity Guidance (May 21, 2026)
New York's Department of Financial Services issued an advisory to CISOs of regulated financial institutions addressing heightened cybersecurity risks from frontier AI models that accelerate vulnerability discovery and exploit development. The guidance recommends AI-specific controls including secure coding practices for AI-assisted development, privileged access review, network segmentation, phishing-resistant multi-factor authentication, and coordination with third-party service providers to identify dependencies and address vulnerabilities. NYDFS explicitly stated the guidance does not establish new legal requirements but represents recommended practices under existing Part 500 cybersecurity regulations.
California AB 1856 (Age-Gating Expansion and Open Source Exemption)
California's Assembly passed AB 1856 on May 28 in a 68-1 vote, expanding last year's AB 1043 age-bracketing requirements from operating systems and app stores to all web browsers and websites. The bill now requires websites and browsers to request and collect users' ages to segment access to content. Before passage, lawmakers amended AB 1856 to exempt open-source operating systems, defining "operating system provider" to exclude entities that distribute software "under license terms that permit a recipient to copy, redistribute, and modify the software." The Electronic Frontier Foundation opposes AB 1856 despite the open-source exemption, arguing the age-gating expansion creates unconstitutional barriers to lawful speech, threatens user anonymity, and pressures online services to collect sensitive personal data. Ambiguity remains about how the exemption applies when open-source operating systems are incorporated into commercial products.
Trump Administration Anti-Weaponization Fund ($1.776B Frozen)
A federal judge temporarily froze all activity related to the Department of Justice's $1.776 billion "Anti-Weaponization Fund" pending further briefing. The fund was created to compensate individuals claiming to be victims of government "weaponization," including January 6 defendants and Trump political allies. A coalition of plaintiffs including a former Assistant U.S. Attorney who prosecuted January 6 cases, the city of New Haven, the National Abortion Federation, and Common Cause sued to block the fund. Their complaint argues the fund violates separation of powers by allowing the executive branch to appropriate funds without congressional authorization and constitutes selective enforcement of laws based on political loyalty. The temporary halt applies to all fund disbursements and claim processing until the court completes review.
FCC Transgender Content Rating Proposal
The FCC issued a public notice proposing to require the TV Oversight Management Board (TVOMB) to create new TV content ratings to alert viewers to "transgender and gender non-binary programming" and "the discussion or promotion of gender identity themes" in children's programming. The proposal cites anonymous parent complaints that gender identity content is being included in children's shows "without providing disclosure or transparency to parents." Over 40 public interest groups including Free Press and Public Knowledge condemned the proposal, arguing it exceeds the FCC's legal authority (TVOMB is an independent industry coalition not subject to FCC control), raises First Amendment concerns, and stigmatizes LGBTQ+ individuals by equating gender identity with obscenity and violence. GLAAD stated the proposal "incorrectly equates [transgender and nonbinary characters] to programming with coarse and crude language, sexual situations, or violence."
Knox County, Tennessee Book Ban Reversal (Roots)
Knox County Schools Superintendent Jon Rysewyk reversed the removal of Alex Haley's Roots from school library shelves after swift public backlash from local politicians, school board members, and national advocacy groups. The book was initially removed under Tennessee's book-banning laws after a challenge citing explicit content. Rysewyk's May 26 memo stated the decision to return Roots was "effective immediately" and claimed the removal "was in no way a commentary on the historical, cultural, or literary value of the novel." School board member Katherine Bike wrote that "removing Roots is not a neutral act" and "sends a message to our students, particularly our Black students, about whose history is worth protecting." Over 120 other books remain on Knox County's banned book list.
AI Policing False Arrest Cases
Two recent cases illustrate liability risks from AI misidentification in law enforcement. On October 20, 2025, a 17-year-old Maryland student named Taki Allen was handcuffed at gunpoint after an AI-enhanced surveillance camera falsely identified a Doritos bag in his pocket as a gun. On December 24, 2025, Tennessee grandmother Angela Lipps was arrested at gunpoint and jailed for five months after facial recognition software incorrectly connected her to fraud crimes in North Dakota, a state she had never visited. Both cases involve law enforcement treating probabilistic AI predictions as certainties. Researchers studying AI policing tools note that predictive policing systems generate statistical risk scores, not factual determinations, yet operational decisions treat AI outputs as verified truth.
Microsoft Zero-Day Disclosure Dispute
Microsoft condemned the uncoordinated release of six Windows zero-day vulnerabilities by a pseudonymous researcher known as Nightmare Eclipse, calling such disclosures "never justifiable." The researcher began releasing vulnerabilities with proof-of-concept code in April on GitHub after alleging Microsoft deleted their security researcher account, withheld bounty payments, and removed attribution from advisories. Three of the six vulnerabilities (BlueHammer, UnDefend, RedSun) have been exploited in live intrusions according to Microsoft patch advisories. Three more recent releases (YellowKey, GreenPlasma, MiniPlasma) remain unpatched with no confirmed exploitation. The researcher threatened a seventh release on July 14. Microsoft stated its Digital Crimes Unit will "continue bringing cases against these actors and those that enable their criminal activity" in coordination with law enforcement, stopping short of direct legal threats. Security professionals criticized Microsoft's vulnerability handling processes, citing prior incidents where Microsoft patched researcher-reported bugs without notification or acknowledgment.
Age verification systems (California): Monitor AB 1856 as it moves to the California Senate. If enacted, all websites serving California users will need age-gating systems. Begin scoping implementation costs and privacy impact assessments now.
NYDFS AI cybersecurity (Financial services): Regulated financial institutions should integrate frontier AI threat modeling into existing Part 500 programs by Q3 2026. Priority actions include auditing AI-assisted development workflows, reviewing third-party AI dependencies, and implementing controls for AI-accelerated vulnerability scanning.
Third-party data sharing audits (VPIPA, state wiretap laws): The Best Buy and Redfin lawsuits demonstrate continuing private enforcement of state privacy laws against advertising pixel data sharing. Audit Meta Pixel, TikTok Pixel, and Google Analytics implementations for transmission of personally identifiable information, financial data, or user activity without affirmative consent.
Arbitration agreement review (Transportation/logistics): After Flowers Foods v. Brock, companies using last-mile delivery drivers should review arbitration agreements for enforceability. Drivers handling goods on interstate journeys can now invoke the FAA exemption to litigate in court.
AI policing liability (Municipalities): Law enforcement agencies using AI surveillance or facial recognition must implement mandatory human verification before arrests or use of force. Review qualified immunity protections and update use-of-force policies to account for AI false positives following the Allen and Lipps cases.
Windows vulnerability patching (All organizations): Patch BlueHammer, UnDefend, and RedSun immediately (CISA KEV catalog). Deploy compensating controls for YellowKey, GreenPlasma, and MiniPlasma pending Microsoft patches. Prepare for potential July 14 disclosure.