Get tomorrow's brief in your inbox
Today: Austrian Supreme Court confirms GDPR violations by credit reference agency CRIF, clearing path for class action seeking €500 per affected person. Meta settles social media addiction claims with 52 state AGs for up to $17.1 billion. California legislature passes AB 1709, a sweeping social media ban for users under 16 that requires invasive age verification and restricts basic platform features.
Supreme Court: CRIF illegally collected data of millions in Austria
The Austrian Supreme Court (OGH) ruled that credit reference agency CRIF violated GDPR's purpose limitation principle by collecting personal data from address publishers processing data for marketing purposes and repurposing it for credit assessments. The ruling confirms noyb's June 2026 injunction allegations before the first hearing. CRIF and address broker AZ Direct had refused to comply with Data Protection Authority and Federal Administrative Court decisions restricting data use, prompting civil litigation.
Meta reaches $17B settlement over social media addiction claims
Meta Platforms settled with 52 state and territorial attorneys general for up to $17.1 billion to resolve claims that Meta hid or downplayed harmful impacts of its platforms on minors. The settlement includes age-appropriate content restrictions, feature limitations for verified teen accounts, and age assurance requirements that will likely become industry-standard practice.
Five plead guilty in ATM jackpotting case
Five Venezuelan nationals pleaded guilty to conspiracy to commit bank larceny in Kansas federal court after using Ploutus malware to rob ATMs. Luis Alberto Velasquez-Artigas received nine months; four others await sentencing. FBI reports over 1,900 ATM jackpotting incidents since 2020, with more than 700 in 2025 totaling over $20 million in losses. The scheme involved breaking into ATMs and installing malware to empty the machines.
$40M San Diego water rates class action settlement
The City of San Diego agreed to pay $40 million to resolve claims it charged unconstitutional single-family residential water rates. The settlement addresses allegations that the city's rate structure violated constitutional protections.
$2.5M Palm Beach Tan TCPA class action settlement
Palm Beach Tan will pay $2.5 million to settle claims it sent unsolicited text messages in violation of the Telephone Consumer Protection Act. Claim form deadline is October 4, 2026.
Supreme Court allows White House ballroom construction to continue
By 5-4 vote, the Supreme Court paused a district court preliminary injunction that would have halted above-ground construction of a White House ballroom project. The unsigned majority opinion emphasized the National Trust for Historic Preservation likely lacks standing to challenge the project. Chief Justice Roberts and the three Democratic appointees dissented, stating the construction "is likely unlawful."
Republican groups seek emergency stay on political ad rate ruling
The National Republican Congressional Committee and National Republican Senatorial Committee asked the Supreme Court to pause a 4th Circuit ruling they claim "rewrote longstanding rules about preferential broadcast rates for political ads." The 4th Circuit held that federal law gives preferential rates only to individual candidates, not political parties or joint fundraising committees. The dispute affects advertising rates during the 45-day primary window and 60 days before the general election, with midterm elections two months away.
Trump administration appeals mail-in voting rules injunction
U.S. District Judge Indira Talwani blocked President Trump's executive order on mail-in voting, preventing the U.S. Postal Service from imposing new restrictions on mail-in ballots. The Trump administration appealed to the 1st Circuit on August 29. The USPS sought to enforce rules requiring voter data sharing and specific envelope criteria. Talwani found the rule likely unconstitutional and exceeding agency authority. The issue will likely reach the Supreme Court.
Federal judge questions but won't block Trump's new birthright citizenship order
U.S. District Judge Deborah Boardman in Maryland declined to immediately block President Trump's newest executive order limiting birthright citizenship eligibility, even while sharply questioning its viability after the Supreme Court rejected his previous 2025 executive order. Boardman determined she could not impose a temporary restraining order because the plaintiffs' existing lawsuit did not mention the 2026 order. She allowed groups to supplement their complaint and set a swift briefing schedule.
9th Circuit rules against prediction markets in fight over state gambling jurisdiction
The 9th Circuit rejected prediction market platforms' requests for injunctive relief against the Nevada Gaming Control Board, concluding that sports-related event contracts are not derivatives regulated by the federal government but are subject to state gambling laws. The dispute centers on whether the Commodity Futures Trading Commission has exclusive jurisdiction over event contracts or whether state gaming regulators can classify them as sports betting. Legal experts expect the issue will reach the Supreme Court.
EFF urges California to regulate location tracking, not ban social media for teens
EFF published detailed analyses on two major privacy fronts. "Privacy on the Map (Part 2)" examines new consumer privacy laws in Connecticut, Maryland, New Jersey, Oregon, and Virginia that restrict commercial location tracking, while identifying significant gaps still requiring legislative action. EFF demonstrated how advertising SDKs in Android apps automatically collect and share location data whenever app-level permissions are granted, feeding data into systems used by brokers to track individuals attending reproductive health clinics, protests, and other sensitive locations.
EFF separately urged Governor Newsom to veto AB 1709, which passed the California legislature and would ban social media use for users under 16. The bill prohibits platforms from offering recommendation algorithms and basic features to anyone under 16, effectively locking young people out of major digital services. EFF argues the bill creates a "massive privacy and free speech nightmare" by forcing invasive age verification (government IDs or biometric scanning) for all users, not just minors.
EFF publishes doxxing prevention and incident response guides
EFF released two comprehensive guides on doxxing safety. Part I covers prevention through OSINT tools, breach database monitoring, public records cleanup, and footprint reduction. Part II addresses incident response, including incident logging, monitoring hate forums via Tor, setting up Google alerts, and hardening public-facing accounts. The guides emphasize that privacy is a "team sport" requiring designated roles for monitoring, documentation, and law enforcement coordination.
EFF urges courts to reject copyright expansion over AI hype
EFF filed amicus briefs in Concord Music Group, Inc. v. Anthropic PBC and In re Mosaic LLM Litigation, arguing that rightsholders' "market dilution" theory would undermine copyright's constitutional purpose by giving publishers veto power over any expression that might compete with works they own. EFF argues that using copyrighted works to train generative AI models is fair use, and that research shows large models trained on more data are less likely to produce infringing works.
GDPR Purpose Limitation: Review all third-party data acquisition agreements to ensure data collected for one purpose (e.g., marketing) is not repurposed for incompatible uses (e.g., credit scoring) without legal basis under GDPR Article 5(1)(b). Austrian Supreme Court ruling provides clear precedent.
ATM Jackpotting Defenses: Financial institutions must implement anti-jackpotting technology immediately. FBI reports $58 million in losses since 2021 from Ploutus malware attacks targeting 47 states.
Age Verification Preparation: Platforms serving minors should prepare for industry-wide age verification, content filtering, and feature restrictions following Meta's $17.1 billion settlement with 52 state AGs. California AB 1709 (if signed) would require invasive age verification for all users.
Location Data Audits: App developers must audit Android advertising SDKs for default location data collection and disable sharing to ad networks. Five states enacted location privacy restrictions in 2026; more expected to follow.
TCPA Compliance Review: Organizations conducting SMS marketing campaigns must verify proper opt-in consent before October 4, 2026 Palm Beach Tan settlement claim deadline to avoid similar exposure.