Legal & Privacy Brief - September 20, 2026

Today: TikTok faces a class action over its Gauth AI homework service allegedly sharing student data with Google without consent. Meta and Luxottica are sued in Colorado for violating the state's right to repair law by withholding repair resources for Ray-Ban Meta smart glasses. Lawfare contributors call for comprehensive privacy law reform to address 25 years of expanding mass surveillance.

Litigation Updates

Meta, Luxottica Sued Over Colorado Right to Repair Violations (Ray-Ban Meta Smart Glasses)

Acme Revival, a Denver electronics repair shop, filed suit against Meta Platforms and Luxottica alleging violations of Colorado's right to repair law. The complaint claims the companies fail to provide repair parts, tools, and documentation for Ray-Ban Meta smart glasses, locking independent shops out of servicing the devices. Colorado's Consumer Right to Repair Act (SB 24-011), effective January 1, 2025, requires manufacturers to make diagnostic tools, parts, and repair documentation available to independent repair providers and consumers.

• Compliance Action: Hardware manufacturers selling in Colorado should audit whether they provide independent repair access as required by the state's right to repair statute. Companies distributing connected devices in other states with pending or enacted right to repair laws should prepare compliance programs now.
• Source: Top Class Actions

TikTok Gauth AI Sued Over Unauthorized Student Data Sharing with Google

A class action complaint alleges TikTok USDS Joint Venture unlawfully transmitted private communications, educational queries, and personal data from users of Gauth, its AI-powered homework help service, to Google without user knowledge or consent. The suit raises claims under federal and state privacy statutes governing the handling of student and children's data. If the allegations hold, this case could set precedent for how AI educational tools handle data sharing with third-party advertising and analytics platforms.

• Compliance Action: Organizations deploying AI-powered educational tools should review data-sharing agreements with third parties. Verify that student data flows comply with FERPA, COPPA, and applicable state student privacy laws. Audit whether analytics or advertising SDKs embedded in educational products transmit protected data without proper consent.
• Source: Top Class Actions

Policy Changes

Lawfare Contributors Call for Comprehensive Privacy Law Reform

Cindy Cohn (EFF) and Bruce Schneier argued that 25 years of expanding mass surveillance since September 11, 2001 have produced a surveillance apparatus that is both harmful to society and legally unsound. They called on Congress to enact comprehensive changes to privacy law, addressing government surveillance programs and the growing role of private companies in collecting and sharing personal data. Separately, Jack Goldsmith argued the 2001 AUMF has outlived its usefulness, with expanded Article II authority making statutory reform largely ineffective without broader Congressional action on war powers.

• Source: Lawfare

Compliance Takeaways

• Right to repair compliance: Manufacturers selling hardware in Colorado must provide independent repair shops with parts, tools, and documentation under SB 24-011. Review your product lines for compliance gaps, especially for connected devices and smart hardware.
• Student data audit: If your organization operates or procures AI educational tools, audit all third-party data sharing. Confirm FERPA and COPPA compliance for any product handling student queries or educational records.
• AI tool data flows: The TikTok/Gauth suit highlights risk in embedding third-party SDKs (analytics, advertising) in products that process sensitive data. Map data flows and verify consent mechanisms cover all downstream recipients.
• Federal privacy legislation watch: Calls from prominent security and civil liberties voices for comprehensive federal privacy reform continue to build. Organizations should track proposed bills and prepare for potential federal baseline privacy requirements that could supersede the current state-by-state patchwork.