August 28, 2026

A coordinated multistate settlement with Meta, valued between $17 billion and $18 billion depending on the source, marks the most consequential US enforcement action against a social media platform on children's safety to date. Attorneys general from nearly all states and territories are parties to the agreement, which mandates daily time limits, school-hour notification bans, algorithmic feed opt-outs, and — most consequentially — tiered age assurance accuracy minimums requiring third-party verification systems to produce false positive rates no higher than 3 percent for users aged 13–15 and 10 percent for users aged 16–17, subject to independent certification and annual audit. New York's SAFE for Kids Act was the only prior statutory source for granular, age-tiered accuracy thresholds; the settlement now extends that structural model across participating jurisdictions and gives regulators in Australia, the UK, and the EU concrete benchmarks to import into their own frameworks. The Electronic Frontier Foundation has cautioned that mandatory age assurance across all Meta products compels data collection from users of all ages, and that data minimization provisions contain no explicit bar on state law enforcement using collected data for investigations into abortion or gender-affirming care — a civil liberties overlay that compliance teams should factor into implementation planning.

Watch level: PREPARE (social media platforms, age verification vendors, children's privacy counsel, US state AG compliance teams)

France's Conseil Constitutionnel has invalidated legislation that would have barred users under 15 from social media, ruling the blanket prohibition disproportionate and incompatible with constitutional free expression protections. The Council found the law failed to differentiate between service types or account for individual user circumstances — age, maturity, and family context. The ruling carries weight well beyond France: legislators in other EU member states and US jurisdictions pursuing comparable age-based access restrictions must now contend with a high-court proportionality standard that categorical bans may not survive. Read alongside the Meta settlement's technically specified, tiered approach, the French decision reinforces that durable age-access policy requires graduated, context-sensitive mechanisms rather than bright-line prohibitions.

Watch level: PREPARE (EU member state legislators, US state legislators advancing social media age bans, platform policy counsel)

The FTC has finalized consent orders requiring Cox Media Group and two affiliated firms to pay $930,000, resolving allegations they falsely marketed an AI service that claimed to target advertisements based on conversations captured from consumers' smart devices. The action reflects the agency's sustained focus on deceptive AI capability claims where firms misrepresent both technical functionality and the existence of consumer consent. Separately, the FTC has issued a proposed policy statement increasing scrutiny of personalized pricing practices, pressing companies toward stronger consumer disclosures and clearer data governance frameworks. Together, the two actions reinforce that AI-driven advertising and algorithmic pricing represent live enforcement priorities at the federal level, not merely emerging risk areas.

Watch level: PREPARE (AI advertising vendors, adtech compliance teams, companies using algorithmic or data-driven pricing models)

The GSA's Login.gov expansion and post-quantum identity overhaul together point to a significant restructuring of federal digital identity infrastructure. A draft OMB memorandum would require agencies to adopt Login.gov as the primary authentication platform for public-facing services, giving agencies 60 days post-finalization to inventory existing authentication systems and six months to complete a digital identity risk management review — an enforcement mechanism for a congressional mandate dating to 2015 that has seen uneven adoption. Simultaneously, GSA has initiated a 17-agency interagency working group to incorporate post-quantum cryptography into Federal Identity, Credential, and Access Management architecture, with civilian agencies required to substantially eliminate quantum cryptographic risk by December 31, 2030. A separate GSA Request for Information on persistent device fingerprinting for Login.gov — with draft requirements covering VPN detection, spoofed device attributes, and pattern-of-life analysis via streaming or batch data transfers — raises data retention and civil liberties questions for the millions of Americans accessing federal benefits through the platform.

Watch level: PREPARE (federal agency CIOs and identity program managers, government IT vendors, civil liberties counsel)

Norway's Digitalisation Minister has announced plans to tighten regulation of AI-embedded smart glasses, including a potential facial recognition ban, with an expert advisory group to be convened. The move reflects growing European regulatory concern that consumer wearables — Meta's Ray-Ban smart glasses have sold roughly seven million units — create structural conditions for covert public surveillance that existing privacy frameworks were not designed to address. Connecticut Attorney General William Tong reached a $275,000 settlement with TaxAct over pixel-based transmission of sensitive taxpayer data to advertising partners between 2018 and 2022, reinforcing that state-level enforcement of pixel tracking practices does not require a dedicated privacy statute. The Alabama Attorney General has opened a formal investigation into an OpenAI data breach, marking another instance of state consumer protection authority being applied to AI platforms absent federal privacy legislation.

Watch level: MONITOR (wearable device manufacturers, smart glasses vendors, tax preparation and fintech compliance teams, AI platform operators in multi-state consumer markets)

ICE and DHS have issued hundreds of administrative subpoenas to technology companies — including Meta, Google, X, and Reddit — seeking subscriber data on individuals who documented ICE activity, criticized government policy online, or participated in protests, according to a compiled record from the Electronic Frontier Foundation drawn from transparency reports and court filings. Courts and companies have in several instances found these subpoenas to exceed statutory authority and infringe First Amendment protections, though the full scope remains difficult to assess given slow FOIA responses from DHS and limited platform-level disaggregation. The GSA's simultaneous RFI on persistent device fingerprinting for Login.gov — with pattern-of-life analysis contemplated as a use case — underscores a broader pattern of federal identity infrastructure being designed with surveillance capabilities that exceed the narrow authentication function originally articulated.

Watch level: MONITOR (technology platform trust and safety teams, First Amendment and civil liberties counsel, federal benefits program counsel)

Still developing: Federal court injunction blocking bulk access to 17 million commercial driver records: no material change since last reported; injunction remains in effect. Meta BIPA voiceprint class certification: no material change since last reported; class certification hearing remains scheduled for December. India DoT mandatory e-KYC rules following removal of centralized biometric database: no material change since last reported; implementation guidance pending. BSI AI-enabled 3D fingerprint spoofing advisory: no material change since last reported; guidance remains active.