For the last couple of years, the copyright world has been grappling with the latest generation of AI, as numerous posts on Walled Culture attest. That’s hardly surprising, since AI is currently delivering the greatest challenge to the foundations of copyright since the arrival of the computer, which was discussed at length in Walled Culture the book (free digital versions available). Although this is the main focus, the copyright industry continues to pursue some of its other traditional obsessions. For example, calls for ever-more stringent Net blocks are still being made. France is leading the way once again, reported here by TorrentFreak:

French lawmakers have officially adopted a new sports law that replaces manual domain checks with support for automated, real-time piracy blocking. The system allows for instant blockades during live sports broadcasts, with oversight checks from regulator ARCOM being applied afterward rather than before.

A new study commissioned by the European Parliament calls for something similar:

The study recommends a swift takedown obligation for streaming intermediaries, requiring these to take action within a certain time limit. As an example, it mentions 30 minutes, following the example of Italy’s Piracy Shield.

This takedown requirement should not only apply to Internet providers. Other intermediaries including third-party DNS resolvers such as Google and OpenDNS, VPN providers, and CDNs such as Cloudflare, should also take action.

The suggestion therefore is to adopt all the bad ideas that EU countries such as Italy, France and Spain have been trying out recently, with no sign that any of them actually help.

The copyright companies also continue to chip away at the surprisingly resilient Anna’s Archive. In January, the site lost its main .org domain; in April, Spotify secured secured a $322 million default judgment against the still unknown operators of Anna’s Archive. More recently, the site was hit with what it calls a “coordinated attack” that took it offline for a while, although it is not clear whether anyone in the copyright world was involved.

Against the background of those recurrent copyright topics, it is interesting to see a less familiar issue crop up recently. It concerns large-scale protests taking place in Albania. They were triggered by revelations that Jared Kushner, Donald Trump’s son-in-law, planned luxury tourism developments in two important Albanian natural habitats. One of them, the Vjosa–Narta wetland ecosystem, is the home of flamingos. This has led to the mass protests being given the name the Flamingo Revolution.

The protests against the proposed developments have been on a very large scale – some estimate 250,000 participants at times – and have rocked the Albanian government, which was caught completely off-guard by the widespread objections to the plans, and which has struggled to counter them and the widespread support they have received online. That makes the sudden mass suspension of Instagram accounts posting about anti-government protests in Albania because of alleged copyright infringement suspicious, to say the least. Martha Dimitratou, founder of Repro Uncensored, a nonprofit organization that tracks digital censorship, spoke to Wired about what has been happening in Albania:

Dimitratou told WIRED they had verified around 100 cases of account restrictions connected to protests. “We continue to receive additional reports and, based on the volume and patterns we are seeing, estimate that the true number could be several hundred,” she says.

“We also identified that multiple posts on an account would receive copyright complaints, often five to 10 in a relatively short period, followed by escalating enforcement and, in some cases, the disabling of the entire account,” Dimitratou says. “Taken together, the alleged paid reporting, the repeated sequence of copyright complaints followed by account enforcement, the concentration of targets around the same movement, and the repeated targeting of replacement accounts strongly indicate coordinated activity,” Dimitratou added.

Arjan Koçi, who had multiple posts taken down, managed to contact the person behind those copyright complaints. Koçi asked why he was making these false claims against him:

To his surprise, Koçi received a response. “He asked for my contact and then texted me.” The person told Koçi that he had been paid $1,800 to report these accounts and would withdraw his complaints if Koçi paid him. “He said he would accept crypto as payment.”

This kind of coordinated copyright abuse is a well-known phenomenon:

“This tactic of mass copyright reporting, commonly called brigading, is an abuse of the systems that Meta has in place for people to report genuinely problematic, abusive, dangerous, or illegal content on their platforms,” said Kian Vesteinsson, deputy director for tech policy and digital rights research at Freedom House. “We’ve even seen this sort of brigading happen at scale in the context of a war or a conflict. Certainly, it’s a tactic that we saw carried out by the Myanmar military, for example, to go after people criticizing the government’s conduct,” he told WIRED.

As that indicates, this is not a new problem. Walled Culture the book discusses similar cases of copyright being abused for the purposes of censorship, notably as part of online “reputation management” services. These often use false claims of copyright infringement to remove material that is damaging or embarrassing to their clients. The application of similar censorship techniques on a large scale against politically inconvenient material in Albania shows how copyright continues to be perverted for purposes far from the purported ones of encouraging and rewarding creativity.

Follow me @glynmoody on Mastodon and on Bluesky. Originally published on Walled Culture.

Over the last few years, with Congress completely incompetent and a massive moral panic about tech raging, states have stepped up to try to regulate the internet any way they can. Even after the Supreme Court reminded states that the First Amendment still exists online and their varied attempts to regulate speech faced serious constitutional hurdles, it hasn’t cooled state legislators’ and governors’ enthusiasm for pushing through a patchwork of confusing (and sometimes conflicting) laws. And of course, with the Supreme Court’s prudish ruling in Free Speech Coalition v. Paxton, the Court seemed to say states could ignore the First Amendment so long as they shouted “porn!” and “children!” in proximity to each other.

One estimate says that over 300 state bills to regulate social media and kid safety on the internet were introduced in 2025 alone. And, from the beginning, some of us have wondered how states could even try to regulate the internet at all, given that the dormant Commerce Clause (DCC) is (in theory) supposed to limit the states’ ability to regulate commerce that runs across state lines, as the internet obviously does. While the DCC has come up in a few cases, it’s mostly been as an extra throw-in and given significantly less attention than other arguments.

So, it’s good, if somewhat surprising, to see that a federal judge in Utah has blocked a key piece of that state’s latest (in a long line) attempt to age verify parts of the internet. Utah already required adult content sites to age verify Utah users back in 2023. This year’s amendment added a provision saying that anyone “actually located” in Utah counts, VPN or no VPN. Aylo, the internet’s largest adult content company, sued to block that new provision. And, so far it has worked, with the court granting a preliminary injunction against that provision. But what’s most interesting is that the ruling relies on the dormant Commerce Clause, though in a very narrow way.

The new law was crazy in all sorts of ways, effectively demanding that websites see through VPN usage to figure out where a person really is, even if they appear to be somewhere else. Even Utah agreed that this isn’t something anyone can actually do with certainty:

However, all the parties agree that IP-based geolocation is underinclusive because it fails to account for technologies that obscure a user’s location. These technologies, including virtual private networks (“VPNs”) and proxy servers, mask a user’s true location by routing traffic through IP addresses corresponding to different geographic locations. VPNs and location-obfuscation technologies have entirely legitimate purposes—such as securing communications on public networks, preventing websites from harvesting personal data, and circumventing censorship by oppressive governments. But these technologies can also be used to circumvent IP-based geolocation restrictions, such as the one used by Aylo for its free sites. Utah presumably passed the actual-location provision to address this issue.

But both parties also agree that there is no way for a website operator to determine a user’s physical location with perfect certainty. Aylo argues that Utah’s actual location requirement means that Aylo must “impose age verification on every user of their platforms, everywhere in the world” because it is impossible to know for sure whether any given user actually is in Utah.

The court then rejects a bunch of Aylo’s other arguments before zeroing in on the one that lands: because Utah’s law demands perfect geolocation — an impossibility — the only way to comply is to age verify absolutely everyone, everywhere. That clearly impacts commerce far beyond Utah’s borders… and thus triggers the dormant Commerce Clause:

The law requires geolocation perfection, but the parties agree that current technological advancements do not allow an entity to perfectly (1) detect VPN/proxy users, or (2) geolocate where all of those VPN/proxy users are accessing the site from. Aylo could not ensure compliance with the law without age-verifying all users. Unlike a law that merely increases a company’s cost of running its business, the actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating their location from Utah. As a result, the law “cannot effectively be limited” to primarily regulating those in Utah obfuscating their location “over the Internet because no such [technology to detect those users in every instance] exist[s].”

Because the actual-location provision, in most cases, directly regulates an entity’s interactions with those who have no connection to Utah, it likely creates too much direct regulation of wholly out-of-state conduct to be lawful under the dormant Commerce Clause.

The court also finds that the law fails the (recently weakened) Pike balancing test, burdening interstate commerce far out of proportion to its local benefits:

As an example, Aylo has approximately 28 million active visitors to its sites each month from the United States. Because the law requires perfection in the absence of perfect geolocation tools, Aylo would need to verify those 28 million users—whether located in Salt Lake City, Boston, New Orleans, Anchorage, or Honolulu—to ensure compliance and avoid liability. Indeed, every entity that hosts material applicable under the actual-location provision would need to age verify all of the entity’s users nationwide or inevitably violate the law. This reach is expansive and would involve massive numbers of wholly out-of-state interactions.

The ruling is fairly narrow, though, and the court more or less tells Utah how to fix it: by adding a reasonableness clause that gives Aylo (and any others under the law) some leeway in how they determine the location of visitors:

Utah argues that the actual-location provision is indirect because technology “allow[s] Aylo to reasonably and feasibly attempt to age assure VPN-using Utahns, [so] any decision by Aylo to instead age-verify all users would be a voluntary business choice, not an effect forced by Utah law.” The court does not doubt that this is the Attorney General’s good faith intention. But, as discussed above, the actual-location provision does not contain a reasonableness or feasibility standard and would therefore impose liability every time an entity did not perform age verification on a user located in Utah. Unlike Online Merchants Guild, the nationwide reach of the actual-location provision would not be due to an entity’s choice on how to structure its business. Rather, it would be “inevitable” that the entity would need to comply by age verifying every outside-of-Utah user on its site to avoid liability.

The court makes the same point again when it notes that there are “less burdensome means” to get what Utah says it wants:

Second, the significant local interests served by the actual-location provision can be achieved through less burdensome means. To be sure, the law involves a substantial safety interest in preventing minors from accessing harmful sexual material, which falls squarely within Utah’s traditional regulatory power. But Utah has represented that a law requiring “feasible and reasonable [geolocation] methods,” instead of perfection, would promote the same interests served by the actual-location provision. Because of this unique posture, Utah’s weighty interests could clearly be “promoted with . . . a lesser impact on interstate activities.” Thus, Aylo has shown that the actual-location provision likely imposes an excessive burden on interstate commerce in relation to its local benefits.

So, while it’s nice to see one of the many state internet regulations blocked on DCC grounds, it seems incredibly likely that Utah will just have its legislature rewrite the law (again), add a “reasonable” or “feasible” standard, and take another crack at it. While that would have the benefit of not requiring companies to do the literal impossible thing of seeing through VPNs to figure out where people really are, it won’t do much to stop yet another silly age verification law from existing.

flowkey is a fun, interactive piano learning platform that helps anyone go from absolute beginner to confident player — at their own pace. It combines step-by-step courses with thousands of songs you know and love, tailored for every skill level, from first-time learners to advanced pianists. The app listens as you play and gives instant feedback so you can improve faster, practice technique, and master sheet music with confidence. Whether you’re learning scales or your first full song, flowkey makes piano practice easy, fun, and rewarding. A one year subscription is on sale for $40, two years for $60, or five years for $80 for a limited time.

Note: The Techdirt Deals Store is powered and curated by StackSocial. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

On one hand, it’s great to see a ruling like this. On the other hand, it’s not going to set any precedent, not even in its own jurisdiction. But it does push this conversation forward, judicially speaking, which means other cases reliant on ALPR tech have some new reference material to add to challenges of searches.

But that’s the bad news up front. Let’s get to the good stuff. And that stuff is a court recognizing that a license plate reader search doesn’t occur in a vacuum. The government will always argue — as it did here — that there’s no expectation of privacy on public roads. Therefore, any plate read (and any subsequent search of an ALPR database) is no different than a cop physically seeing a license plate on a passing car and then proceeding with whatever information they happen to have on hand.

Except it’s definitely not like that at all, not when plate readers are gathering 20 billion plate/location images a month. And that’s just Flock Safety, whose cameras and constantly swelling database are at the center of this decision [PDF].

What we have here is a pretextual stop that (very) eventually resulted in the discovery of 91 lbs. of meth. This stroke of luck belongs to Tulsa County Deputy Freddie Alaniz, who saw a vehicle drive by with California plates and decided to play the odds. From the federal court ruling:

Alaniz then pulled his vehicle onto the highway to follow the Mazda for no apparent reason other than the fact that it had a California license plate. Alaniz also ran a query on the Flock system for the California license plate number on the Mazda SUV. Both Flock and VehicleManager provide users an option for the reason the query is being run. The reasons Alaniz put in those systems for running the queries were “traffic violation,” and “investigation.” At the time of those queries, all Alaniz knew was that the vehicle had a California license plate.

The eventual traffic stop (for lane change violations and following too closely) quickly became an investigative stop (albeit not officially). The deputy asked the driver several questions about her recent travels, attempting to sniff out any differences between her narrative and the one provided by the Flock ALPR search he had performed while following her down the highway. To do this, Alaniz performed a nationwide search of the database even though he was apparently only troubled by the driver’s semi-carelessness on the road. (Also of note: the deputy was unable to access any Flock data from California because that state appears to have finally succeeded in blocking outside searches.)

Free to go is never free to go, not when an officer has ulterior motives:

Alaniz then completed the stop by returning Kyle’s license to her and giving her a warning. After that was done, Alaniz asked Kyle if she would answer some questions, which Kyle agreed to do.

A few minutes later and it looks like we have an unlawfully extended stop:

Alaniz asked Kyle for consent to search her vehicle, and she denied the request. Immediately after Kyle refused, Alaniz asked for backup and told Kyle that she was detained so he could have his dog sniff her car.

While Alaniz explained the next steps, Kyle disclosed that she had some marijuana in the car. She asked Alaniz if she could give it to him because she knew that Alaniz’s dog would alert to the marijuana. Alaniz stated, “I am not worried at all for a little bit of marijuana, that’s not what I’m looking for,” but he proceeded with detaining Kyle to deploy his dog for a drug sniff. Alaniz also responded to a radio communication by stating “it’s non-pressing, I’ve just got a refusal on k9 deployment.”

Given this development, the court had multiple reasons to toss the evidence. The decision says the stop itself was clean due to traffic violation caught on camera. But the stop was illegally extended. That alone would have been enough, but fortunately the court decided to fully address Kyle’s challenge of the ALPR search. That’s where things get really interesting.

The court says it’s no longer acceptable to maintain the illusion that always-on ALPR systems can be excused with the dated assumption that no expectation of privacy exists when traveling on public roads. And courts certainly don’t need to maintain this pretense on behalf of law enforcement, which has enjoyed an exponential growth in collection/retention abilities with nearly zero added constraints.

The use of the ALPR camera system described by Alaniz in this case credibly invokes concerns raised in both Carpenter and Chatrie. Alaniz had access to an entire month’s worth of location data tied to the license plate on Kyle’s car, including more than fifty sightings across multiple states. This is not the same fine-tuned level of detail that something like a cell phone reveals about the whole of someone’s physical movements. But by virtue of how ALPR technology works, Alaniz and other officers using these systems have access to a continuously updated location history for all vehicles caught on ALPR cameras within the network. This is a type of indiscriminate mass surveillance. It is not targeted on a single individual, as in Carpenter. It is a tool that collects information about all vehicles that pass by any network-connected camera at all times, and it serves up the information to law enforcement on demand.

And because the government likes to play dumb when faced with simple statements like this, the court breaks it down further, making it perfectly clear that what cops think is “reasonable” is nothing any actual reasonable person would agree with, much less consider an acceptable use of law enforcement technology.

Think about it this way. We might reasonably expect our friends and family to tell us something like: “Hey, I saw you out driving by the store last week.” But we do not expect people we know—let alone strangers, and especially not law enforcement—to randomly approach us to say: “Hey, I have been following your car for the last 30 days, and here is a detailed log of every place your vehicle has been with supporting photographic evidence. I am also going to share this information with law enforcement throughout the country so they know your whereabouts, too.” Freedom from persistent, dragnet-style surveillance while in public is not a foreign concept in our society, and it is a reasonable expectation that society already accepts.

Still not enough? There’s more, just in case the government thinks it can bluff its way through this by setting its deliberate obtuseness to “MAX.”

To be sure, ALPR technology does not provide the same precision in location information as cell phones. But it could still reveal a lot about a person’s whereabouts, and it is easy to imagine the kinds of sensitive information it collects. It could track and log a couple struggling to start a family at the fertility clinic. It could show how often someone visits a liquor store or casino. It could show which doctor someone goes to or what lawyer’s office someone visits. It also collects mundane information about people’s commutes, but it collects a tremendous amount of such information all the time. It is possible that a dedicated team of law enforcement officers could constitutionally collect this information about one car—and its driver—by following that vehicle on public roadways over a month. But this leaves the question of why is it the government’s business where everyone goes all the time? The government cannot go snooping through our personal lives and business without an adequate basis to do so. That is what the Supreme Court has said since its decision in Katz through its decision in Chatrie this year, nearly sixty years later. It is not too much to draw the line at indiscriminate mass surveillance.

Amen. Of course, I’m sure the government is already crafting the argument that it is too much to draw the line at indiscriminate mass surveillance in preparation for its inevitable appeal. But until then, we have this, which makes all the points the beneficiaries of mass surveillance resolutely refuse to recognize.

Larry Ellison has succeeded in fusing Paramount and Warner Brothers in a $110 billion merger that will culminate in mass layoffs, higher prices, lower-quality product, and news outlets like CNN becoming even more friendly to corporate power and the U.S. right wing.

This enshittification will arrive despite endless promises by the Ellisons that none of these things are happening or will happen.

They’ve renamed the entire giant company Skydance. The bigger Skydance will be born with a giant weight tied around its neck in the form of $82 billion in debt. The Ellisons, who are incredibly over-extended on AI, have to manage that debt load while trying to adapt to a quickly shifting entertainment industry that isn’t being kind to traditional broadcast TV or the brick-and-mortar film industry:

“Those challenges will pose a major test for Mr. Ellison, 43, who until last year had never run a public media company. He and his team must convince Wall Street that the new company can manage those challenges while it pays down $82 billion in debt, a staggering sum for a traditional media company. He must also rally tens of thousands of employees at Warner Bros. and Paramount; both companies have undergone nearly annual layoffs in recent years.”

It’s simply not going to end well. We know this because gigantic “growth for growth’s sake” mergers never end well. Particularly when Warner Brothers is involved. Every single major deal involving this company, from 2000’s superunion with AOL to AT&T’s 2016 acquisition of Warner Bros to Discovery’s 2022 acquisition of Warner Bros, resulted in mass layoffs and shittier overall product.

Generally when I talk about media consolidation, people’s eyes glaze over. Paramount’s acquisition of Warner Brothers was somehow different. I’m not sure if it’s because Trump BFF Larry Ellison was involved, the company engaged in such sleazy tactics to get the deal approved, the Saudi investment and influence angle, or the fact we just lived through a disastrous master class in incompetence by AT&T.

But somehow people generally seemed to understand this deal was particularly bad. This time around, people seemed to understand that these sorts of deals always result in a giant mountain of debt that’s always borne by consumers in the form of higher prices, labor in the form of mass layoffs, or the public and markets in the form of corner cutting and lower-quality overall product.

And yet it still didn’t matter.

Despite a last-ditch attempt by a weak-coalition of 12 state AGs to actually enforce antitrust law for once, the Democratic deal opposition lacked the backbone to stand up to Larry Ellison’s relentless lobbying.

Establishment Republicans love the deal because it cements more of the media into the hands of the right wing. Democrats, once again demonstrating they’re a decorative opposition party, couldn’t muster enough consistent opposition to fight back against the deal; buckling at the last minute to Ellison’s threat that he’d move Paramount out of California if they dare try to protect markets, labor, and consumers.

I’ve covered more major telecom and media mergers than I can even remember, and here’s what happens next:

• Larry Ellison and his Nepobaby son David spend the next 6-12 months pretending that the deal is already delivering all manner of exciting new synergies and innovations as they pretend they have what it takes to “become a tech company.”
• But it won’t take long for thousands of layoffs to drop, as redundancies are eliminated (AT&T’s acquisition of Warner Bros and DirecTV resulted in, you may recall, 50,000 layoffs).
• From there, as we saw with AT&T, you’ll start to see all manner of promising projects cancelled by the kind of folks who only care about lowest-common denominator cack (Stephen Colbert’s Lord Of The Rings movie appears to be an early casualty already).
• You’ll also quickly see even higher prices and new and annoying restrictions imposed on the companies’ streaming video platforms.
• CNN will steadily become shittier and even more friendly to corporate power and right wing ideology, while pretending to be doing “fair and balanced” journalism.
• Ellison will likely move more film and TV production overseas anyway, because that’s been the general trend regardless of his “take my ball and go home” threat.
• In two to three years, after the extraction class has extracted any remaining value, the disastrous mess will be offloaded to some other media giant (Netflix, Disney, Amazon) for a song, resulting in even more layoffs.

We know this, again, because this is what always happens. And while this happens, all the folks that pushed so hard for the merger — including weak-kneed Democrats like Gavin Newsom, Karen Bass, and gubernatorial nominee Xavier Becerra (who all heavily pressured state AGs to back away from enforcing antitrust law) will be nowhere to be found. They’ll simply memory hole the entire experience.

There’s looking a gift horse in the mouth, and then there’s deciding to shoot that gift horse in the face repeatedly for no good reason. Famed West Coast burger chain In-N-Out has an equally robust reputation as a trademark bully and bad actor. Whether it’s the trademark tourism the company engages in, in which it runs popup stores in overseas markets once every couple of years just to keep their trademarks valid in those markets, or the strict enforcement of its marks in ways that defy the law’s requirements, it seems In-N-Out loves its trademarks more than its own reputation and good business.

But the complete lack of business sense on display in this most recent story is simply breathtaking. Lincoln High School out of Lincoln, CA has what appears to be a nice little culture within its football program at the school. Part of that culture is to have post-game get togethers at the local In-N-Out and they managed to work out a plan with that local store to take some pictures of the players there for a larger video showing off how the team spends their time together. And, for reasons that I can’t possibly explain, In-N-Out sent the school a demand to take the pictures and video down.

In-N-Out asked the Fighting Zebras to remove photos and videos from the viral photo shoot at its Lincoln restaurant at 850 Groveland Lane at Ferrari Ranch Road, saying the team’s use of the restaurant crossed a line involving its trademarks.

Photographer Glenn Silva’s photos and video quickly took off online. One video received more than 600,000 views and about 26,100 likes. The company said corporate approval was required for filming and photography at its restaurants and requested that the team and Silva remove the content within three business days.

This is stupid for all kinds of reasons. First, the school did work with the local store and it appears it’s that local store that didn’t follow whatever corporate guidelines the company has for this sort of thing. That’s not on the school. Second, the school actually engaged an IP attorney to try to make the case that none of this is actual trademark infringement, but photos of high school kids having a good time at one of their restaurants, but the lawyers at In-N-Out still refused to budge on their stance.

And, finally, we have the gift horse part of this equation. These were photos and a video of a bunch of kids and other people having a good time at In-N-Out! It’s the kind of organic marketing and goodwill-generating fun that most companies absolutely dream of capturing for their businesses. But here, the company decides that all of that organic marketing and good PR is fit for the dumpster, all in the name of trademark law?

“We appreciate the positive relationship your organization has with INO, and we hope the Fighting Zebras continue to enjoy many more post-game visits,” the email said. “Thank you again, and best of luck with the rest of the season!”

Yeah, and hopefully it’s a season where the local team can find a different post-game hangout spot, one that actually appreciates the team’s presence, fandom, and its willingness to spread the good word about the fun it’s having after games. Because In-N-Out’s deference to corporate lawyers is the opposite of that.

This is what the company wants to be associated with? Really!?!?

I’ve written a few times now about why Meta’s big “settlement” with the states is a bad deal. It’s Meta seeking to control how the rest of the internet is regulated in a way that, as Eric Goldman’s op-ed we republished explains, is anti-competitive. It’s also bad for kids (while everyone is pretending it protects kids). But lots of people have been trying to compare it to the big tobacco settlement from almost three decades ago, or even to the much more recent opioid settlement.

In the past I’ve talked about how dangerous and misleading it is to compare social media to any sort of “consumable” because when we’re talking about social media, we’re inherently talking about speech, not some sort of chemical compound you ingest that makes physical changes to your body.

But the rush to compare the Meta settlement to those others is strong, in part because people like a familiar story: bad industry gets caught, pays up, problem solved. And even if you want to take the analogy further, it fails. Studies show that the claims of social media addiction are massively exaggerated to the point of being harmful, and the claims about the lingering “harms” from social media seem to be lacking in the evidence as well.

The good folks over at the Connected Learning Alliance, an organization that brings together actual experts in how children and technology interact, invited me to do a Q&A about the Meta settlement, and why the comparisons to the tobacco settlement may not be that apt.

I’m not going to post the whole thing, just a clip, but I encourage you to go read all of it:

Question: What’s the critical issue?

Mike Masnick: Social media is not nicotine, and Meta’s recent settlement is not tech’s “Big Tobacco” moment. Meta has spent a decade looking for a regulatory moat to fend off competitors, and with this settlement, they got one. The technology companies are widely disliked, and for good reason, so this settlement can feel like something to celebrate: Meta is being punished and the product changes generally sound positive. But this settlement is no cause for celebration.

For years, Facebook has struggled to get younger users. Instagram has been successful, but even they have struggled at times, especially against upstarts like TikTok. And so Meta initially responded by buying up rivals — Instagram and WhatsApp were acquisitions — and then they copied features from Snap and TikTok. But at Meta’s size, the company can’t keep growing, so they’ve been looking to use regulatory policy to insulate the company from competition. The thinking is: if policy raises compliance costs high enough, then only big companies like Meta and Google can absorb them. The smaller upstarts can’t, and they won’t become a competitive threat.

It was a fun discussion, and it includes my suggestions for making a better internet for teens and everyone else.

Thanks again to the Connected Learning Alliance for having me. If you’d like more, they recently also interviewed two of my favorite deep thinkers about internet issues: danah boyd on how social media became parasocial media and Cory Doctorow on how youth and educators can fight enshittified tech.

Trump has declared any non-white migrants to be garbage people from shithole countries (that’s in his own words, believe it or not) and has acted accordingly. Mass deportation efforts are a daily event, randomly punctuated by court order violations and the occasional murders of US citizens.

Trump often wonders why people from Nordic nations aren’t swarming our borders. There’s a really good reason for this: their countries are better than ours for several reasons, not the least of which is the current management.

So, while the DHS, ICE, CBP, and a bunch of other federal officers who definitely have better things to do with their time continue to eject anyone who looks kind of foreign (in terms of skin tone only), the administration has made it almost impossible for anyone living in truly dangerous countries to seek asylum here.

That is, unless, the people complaining about dangerous living conditions happen to be white. In which case, never mind all the visa-strippings and temporary protected status eliminations. Last spring, Trump made it clear he preferred a whiter brand of immigrant, announcing his willingness to accept South African whites by the boatload.

Leveraging a long-running lie about how dangerous it is for white people especially in South Africa, the administration followed through with Trump’s off-the-cuff blathering. Earlier this year, numbers released by the State Department confirmed America now has a whites-only policy when it comes to granting asylum. Of the 4,499 refugees admitted to the United States between October 2025 and the March 2026, every single one of them was a white South African.

And the bleating by administration officials (including Secretary of State Marc Rubio) about “white genocide” in South Africa is nothing but a cheap ruse deployed in support of making the United States whiter and more nationalist. We definitely should be offering refugee status to South African citizens and residents. But not for the pretend violence that’s being used to justify this latest announcement from the Trump administration:

The Trump administration plans to limit the number of refugees admitted to the country to 17,500 mostly white South Africans, the administration told Congress Tuesday, as it continues to transform a program that at one point served as a pathway to safety for people fleeing war and strife from countries around the world.

In a notice to Congress obtained by The Associated Press, the administration said the white South Africans faced seizures of their land and other forms of persecution and would be likely to assimilate when they come to America. 

I can’t tell whether the administration means some non-white South Africans will be granted asylum, or that the ones they’re extending asylum to are “mostly white” enough to be extended a privilege this government definitely isn’t willing to extend to Black South Africans, who are definitely seeing way more violence than the whites Trump is trying to “save.”

In 2024, South African police recorded 26,232 murders nationwide, of which 44 were linked to farming communities and eight victims were farmers, Reuters reported in May 2025. The report also cited Afrikaner farmers’ union TLU-SA’s tally of 1,363 white farmers murdered since 1990: an average of 40 a year, “far less than 1% of total murders.”

The narrative presented by the Afrikaner farmers’ union tries to lay the groundwork for decades of white-targeting violence. But the pervasive violence in the nation targets anyone. If anything, white farmers are a rounding error in a nation that averages 72 murders a day. And for that matter, violence targeting farmers isn’t limited to white farmers.

Of six farm-murder victims recorded from January through March 2025, five were Black, including both farm owners, two employees and a manager. 

Given these numbers, the US should be opening its doors to any refugee from South Africa. A nation that has averaged 19-26,000 murders a year is a danger to everyone who resides there. But this administration has done what it always has done: decided only certain people should be allowed to escape the horrors of their homelands. Worse than that, it has been officially narrowed down to one particular race from one particular nation, proving MAGA is actually fine with “great replacements,” so long as it can replace everyone it doesn’t like with more white folks.

Yet another one of Trump’s many, many, often blatantly illegal playbooks is on display here. It seems Trump really doesn’t know who’s going to be loyal enough to satisfy him and also able to pass the rudimentary screening we generously call the Senate Confirmation Process.

So, what tends to happen is that Trump places someone in a lead DOJ role, bypassing the confirmation process entirely. He is allowed to do this, but only temporarily. If the president fails to get a nominee officially confirmed, the ball is now in the court’s… uh… court. The judges in the affected jurisdiction get to choose their own replacement for the vacant position. If the president wants to replace that person, he’s got to go through the confirmation process.

For the most part, none of that is happening. What is happening is that Trump names someone to the position, the clock runs out, the judges replace the prosecutor with their own selection, and within minutes to hours, Trump fires the court-appointed prosecutor.

It took nearly five hours for Trump to fire Donald Kinsella less than five hours after he was appointed to replace Trump’s unconfirmed appointee (and former personal lawyer) John Sarcone. Roger Rogoff, who was appointed by the court to replace Trump’s past-their-expiration-date personal selection for the Washington (state) US Attorney post, was fired only 54 minutes into his judicial appointment.

Rogoff, however, wasn’t willing to let Trump get away with this. He sued for wrongful termination. And he has emerged victorious, as the Associated Press reports:

A judge on Thursday overturned President Donald Trump’s decision to fire the court-appointed top U.S. prosecutor in Seattle, the latest development in a legal tug-of-war over the administration’s efforts to control who occupies the powerful Justice Department posts.

The question being answered here is who has the power to fire court-appointed prosecutors. Trump seems to think he can, but it’s certainly not because he feels his actions are supported by judicial precedent… because there isn’t any.

Judge Stanley Bastian’s order reinstates Rogoff and forbids Trump or the DOJ from firing him (again) until this case is entirely resolved. The answer Trump doesn’t want to hear is that nothing in the law allows him to fire anyone but his own appointees.

Can the President fire a court-appointed U.S. Attorney? No. The President cannot unilaterally fire a U.S. Attorney appointed by the Court. A court-appointed U.S. Attorney is not an acting U.S. Attorney nor are they an interim U.S. Attorney. Section 546(d) provides that a court-appointed U.S. Attorney serves until “the vacancy is filled,” which can only be done by the nomination/confirmation process.

It also makes it clear that the courts are going to keep doing this if Trump’s continues to bypass this process. Why? Because that’s what the law actually says. It doesn’t provide an exemption for Donald J. Trump and whatever he wants the law to be.

Once that time expires, the District Court may appoint a U.S. Attorney until that vacancy is filled.
It does not say until that person is fired by the President.

Of course, the administration has already appealed. The Ninth Circuit has issued a stay of its own, but it doesn’t undo the lower court’s block of any attempted firings. All it does is prevent anything else from happening until the appellate court hears the case. Roger Rogoff won’t have a final answer on this legal question until later, but for now, it seems pretty clear the law — as usual — isn’t on the side of the self-proclaimed “rule of law” president.

I feel I need to start out posts like this by reminding anyone that nudification apps are bad. They’re almost exclusively used to abuse and harass people, most often women. That said, if you’re going to ban them legally, you can’t just say “nudification apps are illegal.” That’s not how the First Amendment works. And, yet, that’s what the state of Minnesota did earlier this year. The dreadfully bad drafting of the law was also bizarre, because a decade earlier the state had passed a much more carefully crafted anti-nonconsensual intimate imagery (NCII) law, which had gone through a constitutional challenge and survived.

That ruling laid out the conditions as to why the NCII law could survive strict scrutiny (necessary to avoid being found unconstitutional under the First Amendment). Notably, that included things like the law having careful, narrow definitions of what images violated the law, requirements that the sharing be done with knowledge, that the images be non-consensual, and that there were clear exemptions for non-illegal uses like images for medical reasons, journalism, or science.

So the state Supreme Court listed out all these factors which were necessary to make the NCII law abide by the First Amendment. And… the Minnesota legislature decided to… ignore every single one. The law in question is broadly written and applies to plenty of perfectly legal speech. It doesn’t even include requirements for the images to be non-consensual or that there be intent, which means that if you wanted to get any AI tool provider in trouble, you could literally tell it to make a nudified image of yourself, send it to Minnesota’s Attorney General, and technically the company (that simply did what you told it to do with an image of yourself) could face fines of up to $500,000 per use.

So, even as xAI’s Grok tool is being credibly accused of generating non-consensual nudified images of people (in some cases children), we thought that xAI made a reasonable filing to try to block the law from going into effect. Bizarrely, the judge rejected both the Temporary Restraining Order request and the Preliminary Injunction request in short order, but without ever considering the merits of the complaint.

Instead, the judge was laser focused on a single issue: the law was passed in May, and set to go into effect in August, but xAI… had waited until the end of July (nearly three months) to sue. That was effectively the entirety of the judge’s analysis, saying that if you wait too long (how long is too long is not explained) then you can’t have a law blocked, no matter what the merits.

Last week, however, the Eighth Circuit appeals court jumped in and put the law on hold. There’s no explanation. The entire order is literally:

Appellant’s motion for injunction pending appeal is granted.

So, Minnesota’s AG, Keith Ellison, cannot currently enforce the law against xAI, but the case is far from over. It would be nice if at least one court actually looked at the law and asked whether it’s constitutional… but we’ll have to wait on that.

It would also be nice if the Minnesota legislature actually chose to write its laws in a manner compatible with the First Amendment, which I sorta feel shouldn’t require me asking them to do so.

Of course, the cynical take I’ve now heard from multiple people is that the Minnesota legislature deliberately wrote this law badly to bait Elon into suing over it, so they can get all the headlines about how Elon is “suing to protect nudification apps” and to rile people up about the court “blocking” that law. I’ve seen some of that happening on social media, where people are (understandably, but wrongly in this case) quick to condemn Elon and his apps.

The author of the law, state Senator Erin Maye Quade’s statement on the Eighth Circuit ruling completely misses the point:

“This ruling is another devastating reminder of how little the safety of women and children mean to men with money and power. Minnesota is the only state that has cut off predators’ access to technology to commit AI-image sexual abuse — and the Eighth Circuit Court of Appeals just gave child predators their favorite tool back, with no legal reasoning in the ruling. Nudification technology is overwhelmingly used to sexually abuse women and create child sexual abuse material. Since Minnesota’s law passed in May 2026, at least four lawsuits have been filed by children and women accusing Elon Musk’s company of engaging in image-based sexual abuse.

“To Musk, his company and its users: it is still illegal to disseminate nonconsensual sexual deepfakes, and dissemination includes sending to one or more persons. Each and every time his company generates a sexual deepfake and disseminates it to a user, the company is breaking the law.”

The thing is, if Senator Maye Quade actually wanted to protect the safety of women and children from “men with money and power,” then why didn’t she follow the roadmap the Minnesota Supreme Court laid out for her regarding how to write a similar law that can pass strict scrutiny? Even her comment regarding the illegality of “nonconsensual sexual deepfakes” shows that she knows about the earlier NCII law and how it was deemed acceptable under the First Amendment. So why didn’t she follow the same path with this law? It’s a question Minnesota journalists should be asking.

But the simple reality here is that Minnesota wrote a really badly drafted law here, which undermines any actual effort to deal with the very real problem of how people use nudification apps for abuse and harassment. Write a law that’s almost certain to get tossed by the courts — as Maye Quade did here — and victims end up with nothing, while abusers get to point to a court ruling and claim the law is on their side.

Writing a thoughtful, careful law that targets the actual harms would take actual work. Writing a poorly drafted law to goad one of the country’s most hated individuals into suing over it to make him look like a creep in headlines that help the politicians is easy. One is politics. The other is actually legislating to help people. Whether by design or by sloppiness, Minnesota went with the politics.

The Salesforce Certification Exam Training Bundle includes practice exam questions and study guides for various certifications, covering a wide range of roles such as administrators, developers, architects, sales representatives, and marketing cloud professionals. With lifetime access to the resources, professionals can continually update their skills and stay ahead in the evolving Salesforce landscape. Regardless of your professional role, ForceDigest provides a tailored path specifically designed for you. It’s on sale for $30.

Note: The Techdirt Deals Store is powered and curated by StackSocial. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Meta’s agentic AI product Muse has had a rocky few weeks since launch. The product, which features an animated avatar named Jolly (one presumes to make mass hyper surveillance seem adorable) is supposed to help you offload busywork like making restaurant reservations, paying bills, or ordering groceries.

Despite Meta having claimed repeatedly that Muse was built with a heavy focus on privacy and security, the AI agent launched with a nasty zero-day flaw that made it possible to spy on Mac users. When one tech YouTuber put Muse in charge of their Facebook Marketplace sales, it sold his stuff way below acceptable rates and doled out their home address (the user apparently didn’t understand the permissions he set).

Somebody else found that you could trick Muse into giving root access on the device it’s running on by simply pretending to be a Muse agent yourself. Others found that Muse software not only accesses people’s private messages without approval, it often ignores all permissions and uploads them to the cloud – even if you specifically tell it not to.

That last problem was bad enough that Apple needed to change its macOS privacy settings to stop third-party app developers from misusing them to access message histories:

“Friday’s announcement comes two weeks after tech columnist Jason Aten said that Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits. Social media last week blew up with masses of people who agreed and said the incident showed that AI assistants given access to calendars, emails, messages, shopping accounts, and other resources are akin to a skill saw or other power tool. While potentially useful, they can do real damage if not used carefully.”

Meanwhile, Wired found that Muse consistently creates detailed profiles of all your friends, family, colleagues, “collaborators,” and people you “follow.” Obviously much of that information is necessary for the agent to get to “know” you, but this being Meta, people are understandably uncomfortable with this sort of massive ramp up of data collection in a country, under authoritarian control, that’s too corrupt to pass a privacy law or regulate data brokers:

“These [AI assistant] tools are actively soliciting users to plug their whole lives in—their emails, calendars, financial institutions, everything in order to be helpful assistance,” Bogen says. “That’s dramatically more information than people might have otherwise given to some of these companies. The breadth of access to information that these tools have will lead to a ballooning of what they know about users.”

But wait, there’s more! 404 Media found that in the weeks before launch, Meta was in a mad dash to quickly and sloppily fix multiple other vulnerabilities but refused to delay Muse’s launch to actually make sure the product was secure:

“The Meta source said they felt security teams were asked to push hot fixes to these bugs as quickly as possible and in a way that wouldn’t delay Muse’s launch, leading to what they described as “half-baked protections being rushed out to enable the launch. Many senior engineers believe it’s inevitable we’re going to have a massive data breach as a result of Hatch.” Muse is called “Hatch” internally and in Meta’s codebase.”

Many folks build their own agentic AI solutions with cobbled together open source hardware and software to ensure they have clear understanding of, and control over, what’s actually happening in their name. Meta, a glorified ad monopoly with a history of ethical “lapses,” not only wants to dominate the space, it will spend a lot of time in the new year lobbying against on device, open source, foreign, and/or open weighted alternatives to Meta.

Despite Meta’s claims that privacy and security would be a priority for Muse that’s clearly not the case; it’s also extremely clear that Meta doesn’t fear any meaningful government accountability or oversight, or the product would have spent significantly more time in the oven. Tech giants that had already clearly abandoned quality control at impossible scale are engaged in a mad dash to the trough with new product launches before their funny math causes a market correction.

Such is life in a country that has had most consumer protection regulators (and cybersecurity standards) lobotomized by corrupt authoritarians. Authoritarians guys like Mark Zuckerberg enthusiastically supported because they didn’t like paying taxes — and hated former FTC antitrust boss Lina Khan.

Muse’s early privacy and security problems are the kind of stuff anybody with a head on their shoulders could see coming miles over the horizon. And it’s all inevitably going to get more dangerous — and ridiculous — over the next year as unethical tech oligarchs fully exploit their successful lobotomization of the federal regulatory state. You know, for the love of innovation.