Get tomorrow's brief in your inbox
Today: The Fourth Circuit ruled border agents can search phones by hand without suspicion, while DOJ cited fabricated AI-generated cases to keep ICE detainees locked up. France became the first EU country to ban social media for users under 15, and EPIC released a white paper documenting algorithmic unionbusting technologies. Federal agencies expanded warnings about Iran-linked attacks on operational technology beyond Rockwell to include Schneider Electric and Siemens PLCs.
Equifax Fair Credit Reporting Act Settlement
Equifax agreed to a $2.2 million class action settlement over allegations it violated the Fair Credit Reporting Act by reporting the same collection account multiple times on consumer credit reports. The settlement resolves claims that the duplicate reporting practices harmed consumers' credit scores and ability to obtain credit.
Fourth Circuit Permits Warrantless Manual Border Phone Searches (U.S. v. Belmonte Cardozo)
The Fourth Circuit ruled that border agents can conduct manual searches of electronic devices without any suspicion of wrongdoing, distinguishing them from forensic searches that require individualized suspicion. The court held that when officers search by hand rather than with forensic tools, no Fourth Amendment suspicion standard applies, despite the Supreme Court's recognition in Riley v. California that phones contain "the sum of an individual's private life." EFF and ACLU filed an amicus brief arguing the same standard should apply to all device searches regardless of method.
DOJ Cited Fabricated AI-Generated Case in Immigration Detention Brief
The Department of Justice cited a nonexistent Sixth Circuit case (Taylor v. Hott, 724 F. App'x 387) in a habeas corpus proceeding to argue an ICE detainee could not challenge a bond stay. Judge Hala Y. Jarbou discovered the citation was fabricated, with the cited page containing a different case about commercial arbitration. The case involved a detainee whose bond order was automatically stayed for 90 days pending appeal, and the stay expired before the court could rule, mooting the habeas petition.
Trump BBC Defamation Case Forces Financial Records Discovery
Magistrate Judge Enjoliqué Lett ruled that Donald Trump must produce financial records in his $10 billion defamation lawsuit against the BBC, rejecting Trump's attempt to narrow claims to avoid discovery. The court found financial records relevant to both economic and reputational harm claims. Trump had sued over a documentary edit, and the BBC requested financial records after Trump claimed business harm in Florida despite earning approximately $2 billion last year.
Google Nest Facial Recognition Class Actions
Two separate class actions allege Google's Nest security cameras and doorbells systematically collect, store, and use facial recognition data of passersby who never consented to biometric scanning. The lawsuits claim violations of state biometric privacy laws for scanning faces of people who are not Nest customers or users.
EPIC Amicus Brief: Section 230 Does Not Immunize App Store Payment Processing (Ninth Circuit)
EPIC filed an amicus brief in three consolidated Ninth Circuit cases urging courts not to extend Section 230 immunity to app stores that process payments for illegal online gambling. Google, Meta, and Apple argued that processing payments constitutes protected publishing activity. EPIC contends Section 230 protects against the "moderator's dilemma" of content liability but does not immunize payment processing for illegal transactions, which would give platforms broader immunity than traditional payment processors.
France Enacts Social Media Ban for Under-15s
Both houses of the French Parliament voted to block social media access for children under 15, effective September 1, 2026 for new accounts and January 2027 for existing accounts. The law also bans cell phones in high schools (already banned in elementary and middle schools). All users must now verify ages to access social media, with platforms required to have age verification methods approved by France's privacy regulator. France is the first European country in the EU to enact such a ban, following Australia, Turkey, and Indonesia globally. The European Commission is considering a bloc-wide ban for users under 13.
House NDAA Extends CISA 2015 Info-Sharing Protections Through 2037
The House passed the 2027 National Defense Authorization Act (216-212) including the Widespread Information Management for the Welfare of Infrastructure and Government Act, which would reauthorize the 2015 Cybersecurity and Information Sharing Act through 2037. CISA 2015 provides legal protections allowing private sector and federal government to share data on criminal and nation-state hacking threats. The statute briefly expired in 2025, leaving federal officials without visibility into threats to critical infrastructure. The Senate version does not include matching language, and Sen. Rand Paul has vowed to block reauthorization unless language prohibits CISA from counter-disinformation work.
CISA Expands Alert on Iran-Linked OT Attacks to Schneider Electric and Siemens PLCs
CISA, FBI, and EPA expanded an April advisory on Iranian regime-affiliated attacks targeting internet-facing operational technology. The revised advisory adds Schneider Electric and Siemens to the manufacturer scope beyond the original focus on Rockwell Automation and Allen-Bradley PLCs. Observed incidents include malicious project file manipulation and data tampering on HMI and SCADA displays, causing operational disruption and financial loss. Federal agencies expect continued pressure from Iran-affiliated attackers on critical infrastructure including power utilities, wastewater treatment, and manufacturing plants.
EU Court of Justice Ruling on Platform Liability May Expand Platform Control Definition (Coyote System)
The EU Court of Justice ruled in Coyote System (Joined Cases C-188/24 and C-190/24) that intermediaries lose liability protection under the e-Commerce Directive when their algorithms determine "under what conditions, how and in which order of priority" information is disseminated. The court held this constitutes "control" over user information, disqualifying the platform as a neutral intermediary. While the case involved navigation systems relaying real-time user alerts about roadside checks, the reasoning could apply to recommendation algorithms on social media platforms. EFF warns this could deprive platforms of Digital Services Act liability protection and encourage proactive content monitoring and removal of lawful speech.
EPIC and NIWR Release White Paper on Algorithmic Unionbusting
EPIC and the National Institute for Workers' Rights released "Who's Got the Power? Restoring Worker Power in the Age of Algorithmic Unionbusting," documenting how employers use surveillance technologies, algorithmic management systems, and worker data to identify, monitor, and interfere with organizing. The paper examines productivity monitoring software, biometric surveillance, AI-powered management tools, and predictive analytics as tools for "algorithmic unionbusting." It concludes that neither labor law nor U.S. privacy laws adequately protect workers from these practices, calling for stronger worker data protections, limits on workplace surveillance, guardrails on automated decision-making, and privacy laws covering workers.
American Academy of Pediatrics Retires Screen Time Limits Framework
In January 2026, the American Academy of Pediatrics retired its decade-old framework organizing advice around hourly screen limits (two hours of entertainment screen time for ages 5-18). The new policy statement on children, adolescents, and digital media recommends parents consider context rather than blanket time restrictions. The shift recognizes that online media includes developmentally beneficial activities (education, socializing, leisure) that extend face-to-face connections, making strict time limits potentially harmful to children's well-being, autonomy, and development.
Sen. Schiff Reintroduces Judicial Ethics Bills on Financial Conflicts and FOIA
Sen. Adam Schiff (D-CA) reintroduced three bills to address judicial conflicts of interest and transparency: (1) expanding executive branch conflict-of-interest rules to the judiciary, (2) requiring justices and judges to place certain financial assets in blind trusts, and (3) allowing public records requests into the federal judiciary. The bills face slim odds of passage in the Republican-controlled Congress but add to ongoing debate over strengthening judicial ethics rules following appearances by Justices Kagan and Barrett before House and Senate spending committees on July 14.
Border device security (immediate): Implement protocols for employees traveling internationally including remote wipe capabilities, encrypted backups, and minimal-data travel policies following the Fourth Circuit's ruling allowing warrantless manual phone searches at borders.
PLC internet exposure (immediate): Audit all programmable logic controllers (Rockwell, Schneider Electric, Siemens) for direct internet access. Implement network segmentation and VPN controls per expanded CISA alert on Iran-linked OT attacks by July 31, 2026.
AI citation verification (immediate): Establish mandatory human verification procedures for all AI-generated legal research and prohibit submission of AI-generated citations without confirmation in primary sources, following DOJ's fabricated case citation in immigration detention brief.
France age verification (September 1, 2026): Social media platforms must deploy French privacy regulator-approved age verification systems by September 1, 2026 for new accounts, with existing account enforcement beginning January 2027.
CISA 2015 info-sharing (monitor): Track NDAA conference negotiations for final status of CISA 2015 reauthorization through 2037. Update information-sharing agreements if enacted to reflect extended liability protections.