Get tomorrow's brief in your inbox
Today: Disney settled a $50 million antitrust class action over live TV subscription pricing, Arkansas AG sued Snapchat claiming the platform's disappearing messages expose minors to predators and addiction, and two Scattered Spider hackers received 5.5-year prison sentences for the £29 million Transport for London cyberattack that compromised 27,000 employee accounts and 148 critical systems.
£29M Transport for London Cyberattack Conviction
Two members of the Scattered Spider cybercrime group received 5.5-year prison sentences at Woolwich Crown Court after pleading guilty under Section 3ZA of the Computer Misuse Act. Thalha Jubair, 20, and Owen Flowers, 18, infiltrated Transport for London's network in 2024, causing £29 million in recovery costs, forcing 27,000 employees to reset passwords in person, and taking 148 internal systems offline. The attack compromised TfL's Oyster refund system and suspended photocard applications for children. UK authorities calculated that if the attackers had disabled London's transport network, economic impact could have reached £56 billion. The National Crime Agency called this the largest cybercrime prosecution ever brought before a UK court and only the second case prosecuted under the Computer Misuse Act's most serious offense, which carries a maximum life sentence.
Skims Wage Violations Settlement ($200K New Jersey Tax Penalty)
Kim Kardashian's Skims agreed to pay $200,000 in civil penalties to the New Jersey Attorney General after collecting sales tax on tax-exempt clothing for nearly five years. A separate California PAGA representative action filed in Los Angeles Superior Court alleges Skims engaged in systematic wage violations including unpaid overtime, denied meal and rest breaks, incomplete wage statements omitting total hours worked, and failure to reimburse business expenses. The lawsuit claims Skims withheld wages upon termination and followed a uniform policy of wage abuse against hourly and nonexempt employees.
Disney $50M Antitrust Settlement (Live TV Pricing)
Disney agreed to pay $50 million in a partial class action settlement resolving federal antitrust claims that it raised prices on live TV subscriptions in violation of federal law. The settlement amount and antitrust theory suggest allegations involved market power abuse in the streaming television distribution market, though specific docket information was not disclosed.
TikTok Data Breach Class Action (2.4B Users, Case No. 2:26-cv-06371)
Plaintiff Sean Mortazi filed a class action in the Central District of California alleging TikTok failed to protect private information of 2.4 billion users during a June 2026 data breach. The breach allegedly involved a hacker group posting usernames, email addresses, phone numbers, dates of birth, gender, language, and location information online. Mortazi claims TikTok failed to implement adequate security measures including multi-factor authentication for employees and vendors, access limitations for sensitive data, step-up authentication, and monitoring for unrecognized login locations. The complaint asserts negligence, negligence per se, breach of implied contract, invasion of privacy, unjust enrichment, and violations of California's Unfair Competition Law, Consumer Privacy Act, and Customer Records Act.
DraftKings Data Broker Lawsuit (Case No. 2:26-cv-06768)
Plaintiff Linda Hughes filed a class action in the Central District of California alleging DraftKings used data broker software from NextRoll, Trade Desk, and Comscore to secretly collect device data, location information, and browsing history from website visitors without consent. Hughes claims DraftKings violated California's Trap and Trace Law by installing third-party tracking code that deanonymized visitors and developed clandestine user profiles for targeted marketing. The lawsuit seeks to represent California residents who visited DraftKings' website and were subjected to data broker code operation during the applicable limitations period.
Florida's Stop WOKE Act Blocked Again (Eleventh Circuit, 85-Page Ruling)
The Eleventh Circuit Appeals Court issued an 85-page decision upholding the injunction against Florida's "Stop WOKE Act" (rebranded as the Individual Freedom Act), finding the law unconstitutional for regulating classroom speech based on viewpoint discrimination. The court rejected Florida's argument that public employee speech doctrine and government speech doctrine could support banning professors from expressing "disfavored viewpoints" while permitting "unfettered expression of the opposite viewpoints." Florida first lost injunction challenges in 2022, appealed to the Eleventh Circuit which upheld the injunction in March 2023, and has now lost again after more than three years of litigation. The court previously noted the state's "doublespeak" in claiming professors enjoy "academic freedom" only when expressing state-approved viewpoints.
Ultra-Processed Food Addiction Lawsuit Dismissed (Martinez v. Kraft Heinz, E.D. Pa.)
The Eastern District of Pennsylvania dismissed an amended complaint against eleven food companies (Kraft Heinz, Mondelez, PepsiCo, Coca-Cola, General Mills, Nestlé, and others) for failure to plead but-for causation. Plaintiff Martinez, diagnosed with type 2 diabetes and non-alcoholic fatty liver disease at age 16, alleged defendants manufactured addictive ultra-processed foods using tobacco industry techniques and predatory marketing targeting children. The court held that allegations of "increased risk, biological plausibility, and association do not show that any particular product or any particular defendant's product actually caused Martinez's diagnoses." The court also rejected the alternative joint liability doctrine, finding it inapplicable where plaintiffs cannot establish that each defendant was equally responsible for the harm. This is the second dismissal; the court previously dismissed the original complaint in August 2025 for failure to identify specific products consumed and for filing a "shotgun pleading."
Writers Guild Sues Paramount Over Warner Bros. Merger (Antitrust)
The Writers Guild of America filed a lawsuit challenging Paramount's $111 billion merger with Warner Brothers, warning the combined debt load of $79 billion will result in mass layoffs and wage suppression. The WGA claims the merger will reduce the film industry to four dominant players (Disney, NBCUniversal, Sony, and the merged Paramount-Warner entity), triggering Supreme Court precedent that any merger yielding post-merger market share exceeding 30% is presumptively anticompetitive. The complaint argues the merged entity will have both incentive and ability to suppress writers' wages and reduce output, resulting in fewer jobs and lower pay. Twelve states separately sued Paramount claiming the merger would harm market competition.
SFPD Terminates Flock Safety Access After 299 Illegal Federal Searches
San Francisco Police Department terminated access to its Flock Safety camera network after a routine compliance audit found the Northern California Regional Intelligence Center (NCRIC) performed 299 improper queries on behalf of federal and out-of-state agencies over one year, violating California state law. Each search broke state regulations prohibiting federal access to California Flock networks. Flock Safety disabled its national lookup feature for all California agencies in February 2026. The company confirmed the searches resulted from officers working within the system to run prohibited queries, not from software malfunction, platform issues, or unauthorized access. SFPD identified the violations through internal audit and took immediate action.
Supreme Court Limits Compassionate Release Authority (Rutherford, Fernandez)
The Supreme Court issued decisions in Rutherford v. United States and Fernandez v. United States limiting federal courts' authority to grant compassionate release under 18 U.S.C. § 3582(c). The court abrogated decisions from the 1st, 4th, 9th, and 10th Circuits that construed the First Step Act as conferring nearly unfettered authority to reduce final sentences. While the court did not precisely define "extraordinary and compelling reasons" warranting relief, it emphasized Congressional judgment in criminal sentencing, noting that 28 U.S.C. § 994(t) restricts the Sentencing Commission's definition with one substantive limitation: "Rehabilitation of the defendant alone shall not be considered an extraordinary and compelling reason." The Sentencing Commission's 2007 guidelines provided specific examples including terminal illness, certain permanent physical or medical conditions, and death of the inmate's only family member capable of caring for the inmate's children.
UK Ofcom Investigates TikTok for Age-Verification Failures
UK communications regulator Ofcom launched an investigation alleging TikTok violated the Online Safety Act by failing to effectively verify users' ages, potentially exposing children to harmful content. Ofcom found that age inference models deployed by TikTok "failed to correctly identify a significant proportion of children," despite the Online Safety Act not including age inference on its list of "highly effective" age verification models. Age inference analyzes browsing habits, online interactions, and internet activity rather than directly verifying age through ID, biometrics, or document submission. Ofcom warned social media companies to "switch to other methods listed in our guidance as highly effective without delay." Violations carry fines up to £18 million or 10% of qualifying worldwide revenue, with potential site bans for egregious conduct. The investigation will update in October 2026.
Arkansas Sues Snapchat Over Minor Safety Risks
Arkansas Attorney General Tim Griffin filed a lawsuit in Phillips County Circuit Court alleging Snap designed Snapchat's disappearing messages, cosmetic filters, curated content, and My AI chatbot in ways that expose children to sextortion, online grooming, illegal drug sales, violent content, and unrealistic beauty standards while marketing the platform as safe. The complaint claims Snap knew about these risks but continued to market to minors and parents. Griffin alleges disappearing messages create a false sense of security encouraging minors to share sensitive information while making it difficult for parents and law enforcement to detect harm. The lawsuit claims Snap failed to enforce its minimum age requirement, allowing children under 13 to create accounts by entering false birth dates. The complaint asserts deceptive and unconscionable trade practices, public nuisance, and unjust enrichment, seeking injunctive relief, civil penalties, damages, and restitution.
Senator Wyden: Canadian Surveillance Bill Threatens US National Security
Senator Ron Wyden (D-OR) warned Secretary of State Marco Rubio and acting Attorney General Todd Blanche that Canada's Lawful Access Act threatens US national security by enabling Canadian intelligence and law enforcement to surveil American citizens. The bill, which passed Canada's House of Commons but requires Senate approval, would require providers to store user metadata including location history for up to one year, force providers to create backdoors or tracking systems, and mandate electronic service providers modify systems to easily share information with law enforcement. Wyden argues US law does not "explicitly prohibit American companies from secretly facilitating foreign surveillance of U.S. citizens, even if the target is the president or another senior U.S. government official," creating a "glaring statutory vacuum." He recommended leveraging US-Canada CLOUD Act negotiations to establish "ironclad, explicit prohibitions against these extraterritorial technical and prospective engineering mandates." Toronto's Citizen Lab called aspects of the plan likely unconstitutional in Canada.
FCC Officials Accepted $75K+ in Paramount Gifts During Merger Reviews
FCC Commissioners Olivia Trusty and Brendan Carr accepted Kennedy Center gala tickets from CBS and Paramount worth over $75,000 while the commission reviewed Paramount's $8 billion merger with Skydance Media and the pending $110 billion Paramount-Warner Bros. Discovery merger. Trusty accepted $12,000 in tickets to the December 2025 Kennedy Center honors after casting the decisive vote approving the Skydance merger five months earlier. Carr has accepted Kennedy Center tickets from CBS or Paramount at least seven times since 2017, totaling over $63,000 according to financial disclosures. Ethics disclosure records show Carr and his wife sat in a private skybox with Paramount CEO David Ellison; such seats sell for $125,000 per ticket. Federal ethics rules ban employees from taking gifts from entities regulated by or seeking official action from their agency. Four ethics experts told ProPublica the commissioners compromised FCC impartiality and should recuse from the pending Paramount-Warner merger decision.
Senator Jim Banks Proposes Birthright Citizenship Restriction Citing Supreme Court Roadmap
Senator Jim Banks (R-IN) introduced legislation defining children of "invaders" as ineligible for birthright citizenship under the 14th Amendment following the Supreme Court's June 30 decision in Trump v. Barbara striking down President Trump's executive order limiting birthright citizenship. The bill declares "any person who enters the United States without authorization or for the purpose of engaging in birth tourism is considered an invader" and amends the Immigration and Nationality Act to exclude their children from citizenship. Banks cited the Supreme Court opinion as leaving "intact the longstanding constitutional exception that children born to foreign invaders are not entitled to birthright citizenship."
Critical infrastructure operators: Implement multi-factor authentication for all employee accounts, conduct quarterly access audits on surveillance and monitoring systems, and establish incident response procedures that can execute mass credential resets without operational shutdown. The Transport for London breach demonstrates that 27,000 compromised accounts and 148 offline systems can cost £29 million in recovery expenses.
California employers: Audit payroll systems to confirm wage statements include total hours worked per pay period, verify meal and rest break tracking systems capture all interruptions and late breaks, and document business expense reimbursement procedures. PAGA representative actions like the Skims lawsuit allow employees to sue on the state's behalf for violations affecting other workers.
Platforms serving minors: Implement age-verification systems beyond self-reported birth dates, document product safety risk assessments for ephemeral messaging features, and review marketing claims about platform safety against state consumer protection laws. UK Ofcom investigation findings indicate age inference models fail to identify "a significant proportion of children," and Arkansas litigation shows disappearing messages create regulatory exposure for facilitating harm to minors.
Organizations deploying third-party tracking: Review California Trap and Trace Law compliance for all data broker integrations, vendor tracking pixels, and behavioral analytics code. Document user consent mechanisms before installing session recording or visitor deanonymization technology. The DraftKings lawsuit demonstrates that partnerships with registered data brokers like NextRoll, Trade Desk, and Comscore create class action exposure when tracking occurs without authorization.
Federal employees and contractors: Consult agency ethics officers before accepting gifts, tickets, or hospitality from regulated entities or parties to pending matters. The Paramount-FCC incident shows that even cultural events like Kennedy Center galas create appearance-of-conflict issues when the gift source has matters pending before the agency, regardless of the ceremonial nature of the benefit.