Legal & Privacy Brief - June 11, 2026

Today: The Supreme Court ruled 8-1 to uphold FCC fines against AT&T and Verizon for selling customer location data, rejecting telecom arguments that the penalties violated Seventh Amendment jury trial rights. EFF calls for a warrant requirement before Section 702 reauthorization expires, warning that FBI's warrantless access to Americans' communications collected under foreign surveillance authority must end. Congress rushed through H.R. 6028 to make the Register of Copyrights a presidential appointee and sever Copyright Office oversight from the Library of Congress, consolidating power in an office that already favors entertainment industry interests over public rights.

Enforcement Actions

Supreme Court Backs FCC Fines for AT&T, Verizon Location Data Sales

The Supreme Court ruled 8-1 in favor of the FCC's effort to fine AT&T ($57 million), Verizon ($48 million), and T-Mobile ($91 million) for selling customer location data to third parties without proper disclosure or security controls. The case began after a 2018 New York Times investigation showed stalkers, police impersonators, and prison officials routinely purchased access to real-time location data. The 5th Circuit had previously ruled the fines violated AT&T's Seventh Amendment right to a jury trial, relying on the Supreme Court's 2024 SEC v. Jarkesy decision. Only Justice Clarence Thomas dissented. The Biden FCC proposed these fines six years after the initial revelations, and collection remains uncertain under the current administration.

• Compliance Action: Telecommunications providers should audit third-party data access agreements and implement mandatory disclosure protocols for location data sharing. Document all data broker relationships and security controls.
• Sources: TechDirt

Connecticut AG Investigates Roblox Over Child Safety Allegations

Connecticut Attorney General William Tong launched a major investigation into Roblox over widespread allegations of child exploitation on the gaming and chat platform. The investigation follows mounting concerns about inadequate safety controls for minors using the service.

• Compliance Action: Online platforms serving minors should review child safety protocols, age verification mechanisms, and content moderation systems. Document all safety measures and incident response procedures.
• Source: Top Class Actions

Litigation Updates

$2.5M Esse Health Data Breach Settlement

Esse Health reached a $2.5 million class action settlement covering individuals whose private information was compromised in a 2025 data breach incident. The settlement provides compensation to affected class members for exposure of protected health information.

• Compliance Action: Healthcare entities should verify breach notification compliance, review cyber insurance coverage limits, and update incident response plans. Settlements in the $2.5M range for mid-sized breaches establish baseline exposure expectations.
• Source: Top Class Actions

X.AI Class Action Alleges Grok Shares User Data with Google, Meta, TikTok

A new class action lawsuit alleges X.AI, operator of the Grok chatbot, shares user data and conversations with third parties including Google, Meta, and TikTok without user consent. The complaint challenges the company's data handling practices and third-party disclosure policies.

• Compliance Action: AI service providers should audit third-party data sharing agreements, implement explicit consent mechanisms for training data use, and document all downstream data transfers. Review privacy policies for accuracy against actual data flows.
• Source: Top Class Actions

Apartments.com Class Action Challenges Hidden Transaction Fees

A class action lawsuit alleges the owner of Apartments.com charges consumers unlawful transaction fees on rent payments made through the platform. The complaint characterizes these as "junk fees" imposed without adequate disclosure.

• Source: Top Class Actions

John Hancock Voiceprint Collection Investigation (Illinois BIPA)

Illinois residents who called John Hancock may have had voiceprints collected without consent in violation of the Illinois Biometric Information Privacy Act (BIPA). The investigation examines whether Amazon's voice technology used in call centers captured biometric identifiers without required disclosures.

• Compliance Action: Companies operating in Illinois or serving Illinois residents must obtain explicit written consent before collecting voiceprints, fingerprints, or facial scans. Document all biometric data collection, storage, and deletion protocols. BIPA statutory damages are $1,000 per negligent violation and $5,000 per intentional or reckless violation.
• Source: Top Class Actions

Regulatory Guidance

CISA Mandates 3-Day Patching for Critical Vulnerabilities

CISA released a binding operational directive requiring federal civilian agencies to patch certain cyber vulnerabilities within 72 hours. The directive applies to vulnerabilities meeting three of four criteria: internet-exposed, listed in the KEV catalog, automatable exploitation, and potential for adversary control of systems. Agencies have 180 days to implement the new patching timeline. The directive prioritizes vulnerabilities that are currently exploited, automatable, and would grant system control. Non-automatable vulnerabilities meeting other criteria require patching within two weeks. Agencies must check for compromise before patching, as applying patches does not evict threat actors already present.

• Compliance Action: State, local, tribal governments and critical infrastructure operators should adopt similar vulnerability management regimes. Establish processes to triage vulnerabilities against the four criteria, prioritize internet-facing assets, and implement forensic triage capabilities to detect pre-patch compromise.
• Source: The Record

Microsoft Ships Record 206-CVE Patch Tuesday, Including Wormable Kernel Flaw

Microsoft released 206 CVEs in its June 2026 Patch Tuesday, the largest monthly release in program history. The surge reflects AI-driven vulnerability discovery across the industry. CVE-2026-45657, rated 9.8/10 severity, is a wormable Windows kernel flaw allowing remote code execution with no user interaction. CVE-2026-41091, actively exploited, affects Microsoft Defender and allows privilege escalation. CVE-2026-50507 is a BitLocker encryption bypass disclosed as a zero-day. CISA added CVE-2026-41091 to its Known Exploited Vulnerabilities catalog on May 20.

• Compliance Action: Prioritize patching CVE-2026-45657 (wormable kernel RCE), CVE-2026-41091 (Defender privilege escalation, actively exploited), and CVE-2026-50507 (BitLocker bypass) immediately. Organizations relying on BitLocker for data-at-rest protection should audit physical security controls until the bypass is patched. Expect continued large-volume Patch Tuesday releases driven by AI-assisted discovery.
• Sources: The Record

Privacy Developments

NSO Group Violates Court Order, Continues WhatsApp Phishing

WhatsApp caught NSO Group phishing its users in violation of an existing court order prohibiting the spyware vendor from targeting WhatsApp users. NSO is appealing the order, arguing it will "suffer irreparable harm" if blocked from accessing WhatsApp communications. CISA lists WhatsApp as a secure messaging service for highly targeted individuals in senior government, military, or political positions.

• Compliance Action: High-risk individuals (senior government officials, executives, journalists, activists) should verify endpoint security controls, enable multi-factor authentication on all accounts, and monitor for unexpected login prompts or suspicious links. Organizations supporting at-risk personnel should provide mobile threat defense tools and security awareness training on spear-phishing indicators.
• Sources: Schneier on Security

EFF Documents ALPR Mission Creep for Noise Complaints

EFF published findings showing automated license plate reader (ALPR) networks are being used for low-level investigations including noise complaints, not just serious crimes. Surveillance companies have deployed tens of thousands of license plate cameras, creating universal people-tracking networks. The investigation reveals significant mission creep beyond original public safety justifications.

• Compliance Action: State and local governments procuring ALPR systems should implement use restrictions limiting queries to specific crime categories, require supervisory approval for non-felony searches, and mandate public reporting of query purposes. Retention limits should align with investigative necessity, not vendor defaults.
• Source: EFF Deeplinks

ICE Plans to Distribute Facial Recognition App to 1,000+ Local Agencies

ICE plans to distribute "Task Force Module," a facial recognition app querying 250+ million DHS and State Department records, to over 1,000 local law enforcement agencies. The app will verify immigration status and provide detention instructions to officers. The underlying Mobile Fortify app was deployed without required privacy impact assessments and exhibits reliability problems. DHS acknowledges the app will be used on U.S. citizens to verify their status.

• Compliance Action: State and local agencies should review proposed federal technology sharing agreements for privacy impact requirements, accuracy validation, and civil rights protections before deployment. Agencies in sanctuary jurisdictions should confirm use restrictions align with state and local immigration enforcement policies.
• Source: TechDirt

Policy Changes

Section 702 Reauthorization Stalled Over Warrant Requirement

Congress continues temporary extensions of Section 702 FISA surveillance authority as negotiations remain deadlocked over FBI warrant requirements. EFF demands the FBI obtain warrants signed by a judge before accessing Americans' communications incidentally collected under foreign surveillance authority. Current practice allows FBI to query and read U.S.-side communications without probable cause warrants. The Trump administration's appointment of Bill Pulte as Director of National Intelligence raises concerns about politicized use of surveillance data, as Pulte previously used private FHFA data to accuse political opponents of mortgage fraud.

• Compliance Action: Organizations handling sensitive communications should assume Section 702 collection includes incidental capture of U.S. person data. Implement end-to-end encryption for privileged communications, attorney-client communications, and trade secret discussions. Monitor for potential reauthorization and prepare compliance updates if warrant requirements are enacted.
• Source: EFF Deeplinks

H.R. 6028 Restructures Copyright Office, Removes Library of Congress Oversight

The House passed H.R. 6028 in a voice vote, removing the Library of Congress's supervisory role over the Copyright Office, transferring rulemaking authority to the Register of Copyrights, and making the Register a presidential appointee confirmed by the Senate. The bill transfers DMCA Section 1201 rulemaking authority (digital lock bypass exemptions for security research, repair, preservation, accessibility) from the Librarian to the Register. EFF warns the changes politicize an office that already favors entertainment industry interests over public rights, citing the Office's support for SOPA and flawed AI fair use guidance.

• Compliance Action: Organizations relying on DMCA 1201 exemptions for security research, device repair, accessibility modifications, or digital preservation should monitor Senate action on H.R. 6028 and prepare comments for future rulemaking proceedings. Expect increased copyright enforcement priorities aligned with presidential administration policy preferences.
• Source: EFF Deeplinks

California AB 412 Requires AI Training Data Disclosure (Unworkable Compliance)

California is reconsidering AB 412, which would require AI developers to identify and disclose all registered copyrighted works used in training. EFF submitted opposition testimony explaining the requirement is technically impossible to comply with: no machine-readable copyright registry exists, registration information is often incomplete or unavailable online, and cross-referencing training data against copyright status at scale is infeasible. The bill's definition of "developer" extends beyond large AI companies to indie developers, open-source projects, and nonprofits. Recent amendments exempt universities and government entities.

• Compliance Action: AI developers offering services to California residents should monitor AB 412 Senate committee progress. If enacted, small developers may need to cease California operations due to impossible compliance burdens. Large organizations should prepare for significant legal and compliance team expansion to attempt good-faith documentation of training data provenance.
• Source: TechDirt

Compliance Takeaways

• Patch wormable Windows kernel CVE-2026-45657 immediately. The 9.8-severity flaw allows remote code execution with no user interaction and can spread across networks autonomously. Microsoft's June Patch Tuesday included 206 CVEs, the largest release in history, driven by AI-assisted vulnerability discovery.

• Audit telecommunications third-party data access agreements. The Supreme Court's 8-1 ruling upholding $196M in FCC fines against AT&T, Verizon, and T-Mobile for selling location data establishes enforcement precedent. Document all data broker relationships, implement mandatory disclosure protocols, and verify security controls on third-party access.

• Implement CISA's 72-hour patching standard for high-risk vulnerabilities. Federal agencies must patch vulnerabilities that are internet-exposed, in the KEV catalog, automatable, and grant system control within three days. State, local, and critical infrastructure operators should adopt similar prioritization frameworks.

• Obtain explicit written consent before collecting biometrics in Illinois. The John Hancock voiceprint investigation highlights BIPA enforcement risk. Companies using voice authentication, facial recognition, or fingerprint scanning for Illinois residents must provide written disclosures and obtain signed consent. Statutory damages are $1,000 per negligent violation, $5,000 per intentional violation.

• Prepare for Copyright Office politicization if H.R. 6028 passes the Senate. The bill makes the Register of Copyrights a presidential appointee and transfers DMCA 1201 rulemaking authority from the Librarian of Congress. Organizations relying on security research, repair, or preservation exemptions should monitor Senate action and prepare for policy shifts aligned with administration preferences.