Legal & Privacy Brief

Today: A Belarusian ransomware operator received a 16-year prison sentence for leading Ransom Cartel, while the National Association of Realtors agreed to pay over $120 million to settle antitrust claims over broker commission fixing. ICE is purchasing consumer credit card records through data brokers, raising fresh privacy concerns, and California privacy advocates warn that PatronScan's ID-scanning system at gay bars may violate state law by building databases that track patron movements across venues.

Enforcement Actions

National Association of Realtors Settles Antitrust Commission Conspiracy Claims for $120M

The National Association of Realtors and several real estate brokerages agreed to pay more than $120 million to resolve federal antitrust claims that they conspired to raise and fix real estate broker commissions in violation of federal law.

• Compliance Action: Real estate brokers and trade associations should review commission structures and coordination practices for potential antitrust exposure. Document that commission rates are independently determined and not coordinated with competitors.
• Source: Top Class Actions

Pfizer Settles Chantix Contamination Claims for $44M

Pfizer agreed to a $44 million class action settlement over claims that its Chantix smoking cessation drug was contaminated with nitrosamine, a cancer-causing substance.

• Compliance Action: Pharmaceutical manufacturers and medical device companies should verify that product safety monitoring systems detect and report contamination risks, particularly for carcinogens in long-term use medications.
• Source: Top Class Actions

Belarusian Cybercriminal Receives 16-Year Sentence for Ransomware Cartel

Maksim Silnikau, 40, creator and leader of Ransom Cartel ransomware-as-a-service platform, was sentenced to 16 years in federal prison. Prosecutors said Ransom Cartel targeted at least 18 U.S. organizations between 2021 and 2023, recruiting affiliates through underground forums and providing stolen credentials, network access, and ransomware tools. Silnikau also developed the Angler exploit kit and the Reveton ransomware platform, which extorted approximately $400,000 monthly from victims between 2012 and 2014.

• Compliance Action: Organizations should ensure ransomware incident response plans include coordination with FBI and CISA, maintain offline backups, and implement network segmentation to limit ransomware spread. Review vendor and third-party access to detect compromised credentials.
• Source: The Record

Litigation Updates

Night US Brooklyn Bedding Deceptive Discount Settlement Totals $8.16M

The Night US deceptive discount class action settlement provides $8.16 million in benefits, including cash or store credit for eligible purchases, resolving claims that the company misrepresented discount pricing.

• Source: Top Class Actions

CeraVe, Eucerin Face Class Actions Over Baby Product Price Premiums

Two new class action lawsuits allege major skincare companies charged consumers a premium for "baby" versions of eczema and healing products that are materially identical to standard adult formulas.

• Compliance Action: Consumer product manufacturers should review product labeling and pricing for materially identical formulas marketed at different price points. Document legitimate formula differences or manufacturing costs that justify premium pricing.
• Source: Top Class Actions

Kroger Sued for Alleged Wage Theft Involving Meal Breaks and Security Screenings

A new class and collective action lawsuit alleges Kroger failed to pay hourly workers for time they were required to work, including meal breaks and mandatory security screenings.

• Compliance Action: Employers should audit timekeeping systems to ensure employees are compensated for all working time, including pre-shift and post-shift security screenings, mandatory meetings, and interrupted meal breaks. Review state wage and hour laws for meal break compensation requirements.
• Source: Top Class Actions

Parents Sue Meta, TikTok, YouTube, Snapchat Over Children's Deaths

Parents of four children who died by suicide filed a lawsuit against Meta, Google, TikTok, Snap, and other social media companies, alleging the companies' addictive platform designs and algorithms contributed to their children's deaths.

• Source: Top Class Actions

Privacy Developments

ICE Purchasing Consumer Credit Card Records Through Data Brokers

Immigration and Customs Enforcement is buying consumer credit card application records through data brokers, obtaining personal information individuals provided to open credit card accounts without a warrant.

• Compliance Action: Financial institutions and data brokers should review data sharing agreements and customer privacy disclosures to ensure they adequately notify consumers of potential government access. Companies should assess whether current privacy policies accurately reflect data broker sales to law enforcement.
• Sources: Schneier on Security

PatronScan ID Database System at Gay Bars May Violate California Law

Privacy advocates raised alarms about PatronScan, an ID-checking and face-scanning system used at multiple LGBTQ+ bars in San Francisco. California's ID privacy law, amended in 2018, prohibits businesses from retaining or using information from scanned ID cards except for limited purposes such as age verification, legal compliance, or fraud prevention. PatronScan retains personal information about all customers for 21 days and about flagged customers for up to five years, including names, dates of birth, photographs, gender, zip codes, and venue entry timestamps. The system shares information across participating bars. A 2018 California Senate Judiciary Committee analysis found PatronScan had collected and retained information on 561,087 customers in Sacramento alone during the first five months of 2018.

• Compliance Action: California businesses using ID scanning systems should immediately review retention practices and data sharing arrangements for compliance with California Civil Code Section 1798.90.1. Limit ID scan data retention to the minimum necessary for age verification. Cease sharing scanned ID data across venues unless legally required.
• Source: TechDirt

Flock License Plate Reader System Shows 71% Misread Rate in California City

Roseville, California police department records show Flock Safety's automatic license plate readers incorrectly read license plates in 71% of alerts flagging vehicles as stolen or used in a felony. In 2023 and 2024, Flock sent 1,427 alerts to Roseville police, with 1,013 containing incorrect license plate reads. Flock attributed the misread problems to Roseville's camera configuration, which captures only the backs of vehicles to avoid capturing faces, and to older hardware and non-standard camera placement.

• Compliance Action: Law enforcement agencies using automated license plate readers should establish accuracy thresholds and validation procedures before initiating vehicle stops based on automated alerts. Document system accuracy rates and require secondary confirmation for automated matches.
• Source: TechDirt

Policy Changes

Trump Administration Redirects $21 Billion in Broadband Funds, Refuses to Disclose Plans

The Trump administration redirected $21 billion in "non-deployment funds" from the Broadband Equity, Access, and Deployment (BEAD) program originally earmarked for internet access infrastructure. The administration stripped affordability and fair deployment requirements and redirected billions toward Low-Earth Orbit satellite services for Elon Musk and Jeff Bezos. Congress specified that the full $42.5 billion BEAD allocation must be spent on internet access or closely adjacent purposes such as digital skills training or telehealth tools. The National Telecommunications and Information Administration has not disclosed plans for the redirected $21 billion despite 13 months passing since the rule change and repeated inquiries from state leaders and members of Congress.

• Source: TechDirt

Trump AI Framework Kept Secret, Excludes Smaller Companies

The White House is not publicly releasing its new framework for evaluating advanced AI models. The administration invited staff from OpenAI, Anthropic, Google, Meta, and Nvidia to the White House to share an overview allowing AI developers to voluntarily submit new models to the federal government up to 30 days before public release. The White House will vet cyber capabilities according to a classified benchmarking system. Open models will reportedly be excluded. The secretive process has left smaller AI startups, safety advocates, and third-party researchers without information about testing criteria or which AI models will be covered.

• Compliance Action: AI developers should monitor for any public release of framework details or voluntary submission procedures. Companies excluded from initial briefings should engage trade associations or legal counsel to seek access to framework requirements.
• Source: TechDirt

State Department Confirms Trump Raised Cyber Scam Compounds with Chinese President Xi

Assistant Secretary for East Asian and Pacific Affairs Michael DeSombre confirmed that President Trump raised the issue of Southeast Asian cyber scam compounds with Chinese President Xi Jinping. The compounds, run by Chinese organized crime groups in Cambodia, Laos, and Myanmar, siphoned billions from Americans through romance and finance scams. DeSombre stated that Chinese crackdowns have decreased scam compounds in Cambodia and Myanmar over the last six months, driven primarily by Chinese desire to protect Chinese nationals who were also targeted. U.S. officials warned that Chinese law enforcement only targets gangs scamming Chinese citizens while allowing others to continue operating against Americans. More than $12 billion was stolen from Americans last year in cyber scams, likely an undercount.

• Source: The Record

Compliance Takeaways

• Ransomware defense: Implement network segmentation, maintain offline backups, review vendor access controls, and establish FBI/CISA incident response coordination procedures in response to increased ransomware-as-a-service prosecution.
• California ID scanning compliance: California businesses using ID verification systems must immediately audit data retention and sharing practices against Civil Code Section 1798.90.1 limitations on scanned ID data use.
• Wage and hour audits: Employers should review timekeeping for all compensable working time, including security screenings, interrupted meal breaks, and pre-shift/post-shift activities, particularly in California and states with strict meal break laws.
• Real estate antitrust exposure: Real estate brokers and trade associations should document that commission rates are independently determined and avoid coordination with competitors on pricing structures.
• Automated surveillance accuracy: Organizations deploying automated license plate readers or facial recognition systems should establish accuracy thresholds, document system performance, and require secondary human confirmation before enforcement action.