This image is a section of the Detroit Industry Murals by Diego Rivera, created between 1932 and 1933. Rivera, a renowned Mexican muralist, painted these panels inside the Detroit Institute of Arts. They are widely considered one of his greatest works and a landmark of 20th-century art.

The workers shown are laboring on automobile assembly lines, likely at the Ford Motor Company’s River Rouge Plant.

Rivera celebrated the dignity and effort of industrial labor, portraying the workers with strength and unity.

The style is Social Realism, characterized by its focus on working-class subjects and its detailed, lifelike forms.

Photograph of a detail of a 1933 Diego Rivera fresco at the Detroit Institute of Arts. Justin Hendrix/Tech Policy Press

A Labor Day Prescription for Preserving Fair Employment in the Digital Age

A large number of people take part in a gathering of boats and motorbikes in support of the people of Ceuta on 30 August 2026 in Ceuta (Spain). (Europa Press via AP)

A large number of people took part in a gathering of boats and motorbikes in support of the people of Ceuta on 30 August 2026 in Ceuta (Spain). (Europa Press via AP)

How Disinformation Fueled the Latest Ceuta Mass Crossing

Mechanical Turk is Closing. The Workers Who Built AI Are Still Here

Members of California's legal team leave court after a settlement was reached in a multi-state lawsuit accusing Meta of causing harm to children on social media outside the Ronald V. Dellums Federal Building and US Courthouse on Wednesday, Aug. 26, 2026, in Oakland, Calif. (AP Photo/Noah Berger)

August 2026 US Tech Policy Roundup

The Colorado State Capitol is framed by buildings along Sherman Street Friday, June 27, 2025, in Denver. (AP Photo/David Zalubowski)

What 12 State ‘Companion Bot’ Laws Demand of AI Providers

A tic-tac-toe board with human faces as digital blocks, symbolizing how AI works on pre-existing, biased online data for information processing and decision-making.

Amritha R Warrier & AI4Media / Better Images of AI / tic tac toe / CC-BY 4.0

Germany's Draft Law on AI in Migration Raises Rights and Bias Concerns

A collage of circuit boards interwoven with aerial photographs of water treatment facilities, agricultural lands, industrial sites and mining machinery.

Privacy by Architecture Makes AI Compliance Work

A yellow school bus is seen in Chicago, Illinois, United States, on July 28, 2026. (Photo by Marcin Golba/NurPhoto)

In the US, Caution Rules on AI Ahead of K-12 School Year

A young child holds up a smart phone in front of their face using both hands.

This Week's Meta Settlement Will Reverberate Across the World for Years

This image is a collage with a colourful Japanese vintage landscape showing a mountain, hills, flowers and other plants and a small stream. There are 3 large black data servers placed in the bottom half of the image, with a cloud of black smoke emitting from them, partly obscuring the scenery.

Deborah Lupton, "Servers in a Landscape" / 

'Technology Freedom Cooperative' To Build Infrastructure for Human Rights and Justice Groups

Meta CEO Mark Zuckerberg (C) ahead of testifying before the Senate Judiciary Committee hearing on protecting children from sexual exploitation online, in the Dirksen Senate Office Building in Washington, DC, USA, 31 January 2024. (Photo by Ritzau Scanpix/Sipa USA)(Sipa via AP Images)

Meta Owes the Rest of the World Its Teen Protections

A massive sculpture of Icarus lies in front of the Concordia Temple in the Valley of Temples in Agrigento, Sicily, on January 5, 2019. Shutterstock

A massive sculpture of Icarus lies in front of the Concordia Temple in the Valley of Temples in Agrigento, Sicily, on January 5, 2019. 

Make AI Companies Criminally Liable for Preventable Harm

The EU and US flags in front of a European Commission logo.

The EU and US Can’t Agree on Tech — or Trust

Nicklas Akers, California Senior Assistant Attorney General, left, and Deputy Attorney General Megan O'Neill exit court after tech giant Meta reached a settlement to end a landmark trial over teen social media addiction in Oakland, Calif., Wednesday, Aug. 26, 2026. (AP Photo/Noah Berger)

Assessing the Landmark Meta Settlement

Signs for company Cambridge Analytica in the lobby of the building in which they were based on March 21, 2018 in London, England. (Photo by Chris J Ratcliffe/Getty Images)

The $459 Million Cambridge Analytica Reckoning Buried in Meta's Teen Safety Settlement

The TikTok logo is displayed through a magnifying glass in this photo illustration in Ontario, Canada, on February 5, 2026. (Photo by Thomas Fuller/NurPhoto via AP)

Understanding Brazil’s $29.7 Million TikTok Fine Over Children’s Data

Three human silhouettes are depicted mid-stride, each comprising of a collage of hardware used to develop AI including circuit boards and CPU chips. In the background there is a black and grey gradient with smoke. Beneath the runners from the left, there are two rectangle panels which run across the image, one is red and the other is blue. 

To Avoid a 'Tokenocracy,' Ensure Popular Access to AI Systems

CHONGQING, CHINA - AUGUST 10: In this photo illustration, the logo of Meta is displayed on a smartphone screen on August 10, 2026 in Chongqing, China. (Photo by VCG/VCG via AP )

What Meta’s US Settlement on Child Safety Means for Europe

Meta CEO Mark Zuckerberg attends UFC Freedom 250 on the South Lawn of the White House, Sunday, June 14, 2026, in Washington. (AP Photo/Alex Brandon)

What's in Meta's Teen Social Media Settlement—and What Hinges on Its Rivals

Image of Solana Larsen with text, Managing Editor Solana Larsen

Solana Larsen Named Managing Editor of Tech Policy Press

Petra Molnar and Liz Carolan are both fellows at Tech Policy Press.

Over two days in late July, an estimated 

 crossed the border from Morocco to Ceuta, a Spanish enclave in North Africa. Many swam a 

 of open sea to make the crossing, and at least 100 

 doing so, according to the enclave’s mayor. In the lead-up to those chaotic days, a wave of disinformation on social media 

 with young people in Morocco that a recent Spanish Supreme Court ruling had opened the border to Ceuta and onto Europe, and that crossing into Ceuta would be easy.

This week, Spain's Prime Minister Pedro Sánchez 

 of the disinformation that preceded the Ceuta crossings, citing research by the European External Action Service, the EU’s diplomatic service, that traced the campaign to Russian and Israeli networks operating alongside what he described as an ultra-right international network that "always uses migration to attack both Spain and Europe." Sánchez said the two governments had seized on the issue because of Madrid's positions on the wars in Ukraine and Gaza, and that investigators had so far found no evidence of Moroccan state involvement. Israel's Foreign Minister Gideon Sa'ar 

, accusing Sánchez of "lying shamelessly," and Russia has also denied any role.

This disinformation effort has striking similarities to patterns seen in 

content targeting people on the move trying to reach the United States

, and in both cases the campaigns worked not because the people who acted on them were credulous, but because the rules governing who may cross a border have been made so opaque, so changeable, and so badly communicated that a video posted by a stranger is often the most accessible account available.

, found dozens of burner profiles on TikTok and Instagram that purported to be young Moroccan content creators who had made the journey and were celebrating a newfound freedom in Ceuta. The videos, structured as influencer content, often contained practical advice on making the crossing, from the equipment needed to advice for children and non-swimmers. While many accounts were shut down, they later reappeared under new handles.

 suggests that young people traveled from across Morocco in response to online rumors and stories, like waitress Dounia Kherradi, who lived a nine-and-a-half-hour drive away, and 16-year-old Ayoub El Abyad, who told reporters that he and his cousin decided to drive 12 hours to the crossing after seeing videos on Instagram. What they found was drastically different than the upbeat soundtracks of Reels suggested; those who had crossed the border told reporters 

 that they had to pass dead bodies on the treacherous swim to Ceuta, that they were met with violence when they arrived, and denied food in stores. They then learned there was no way for them to travel on to Europe and that the rumors had been lies. By the end of the weekend, all but 

None of the mechanics on display at Ceuta are new, and there are clear similarities in the grammar of videos shared of how people on the move try to reach the United States. In March of last year the Associated Press reviewed 

hundreds of TikTok videos posted by Mexican migration facilitation networks

 and found similar themes that El Español documented on the Moroccan side of the Strait; upbeat soundtracks, emoji-laden captions, dune buggies racing toward the border wall, jet skis and helicopters and tunnels offered as premium options, facilitators slicing open cacti so their clients can drink, a field of lettuce captioned "The American fields are ready!,” and, at the end, the satisfied-customer testimonial.

In Ceuta as in the Americas, these videos and imagery function as advertisements, painting a picture of border crossing as a manageable logistical problem with a happy ending.

The commercial layer around this content is by now well established. In Spain, the Prime Minister initially blamed human-trafficking 

 for the disinformation, as they stood to benefit financially from attempts to cross the border.

Meta earned revenue from smuggling and scam advertisements

 targeting people trying to reach the US, and the pattern intensified once the American asylum system was funneled through a single mobile application. When CBP One became the central route to an appointment at a port of entry, a secondary economy grew up around it involving 

 sold to people who arrived at the border to find nothing waiting for them, paid intermediaries charging anywhere from a few dollars to several thousand, and 

GPS-spoofing workarounds circulated in WhatsApp groups

 by people locked out of the app's geographic requirements. The Tech Transparency Project, mapping the same terrain, found Facebook and WhatsApp 

saturated with false claims about policy changes

 and invented special provisions for pregnant women and parents traveling with children.

The rumor that circulated in Morocco in July —that a court ruling had quietly opened a route — is a recognizable instance of a well-documented pattern, and the difficulty it presents is one the coverage of Ceuta has largely avoided. Deceptive content does not reach people on the move through a separate channel from accurate content; it reaches them through the same feeds, in the same visual idiom, and often from accounts that are indistinguishable at a glance.

For example, alongside the burner accounts are the Venezuelan and Colombian creators who 

filmed their own crossings of the Darién Gap

, some of whom accumulated tens of millions of views, and whose videos 

 to shelter locations, transport costs, river crossings and where along the route it was possible to receive a money transfer. Several of them were explicit that they were warning people off rather than recruiting them. The hashtag was viewed 

 This is the same platform and format and for many people it is the only source of information about the journey that is available in a language they read, at a price they can pay, from someone whose position resembles their own.

The framing of the young Moroccans as simply “duped,” therefore, becomes harder to sustain. Scholarship on refugee smartphone use has a precise term for the condition they were operating in. Scholars such as Marie Gillespie, Souad Osseiran and Margie Cheesman describe 

, a state of chronic informational instability in which people on the move rely on peer networks precisely because official channels are inaccessible, untranslated, contradictory or actively hostile, and are exposed to rumor and disinformation for exactly the same reason.

The informational vulnerability is a product of a legal architecture that offers almost no authoritative, usable answer to the question of who may enter and how. In Ceuta, Dounia Kherradi drove nine and a half hours on the basis of what she had seen online because there was no other place to look. Agency exercised inside informational scarcity is still agency, and it is worth being careful that any critique of disinformation campaigns does not reproduce the older colonial habit of locating the problem in the so-called gullibility of people from the Majority World rather than in the systems that keep them uninformed by design.

Moreover, states are among the most active participants in this same information environment. In 2025, the US Department of Homeland Security budgeted 

 for a two-year domestic and international advertising campaign, built around Secretary Kristi Noem telling viewers that "we will hunt you down,” and distributed through 

hyper-targeted social media placements and text messaging

When the spots ran during prime-time football coverage on Mexican television, President Claudia Sheinbaum 

moved to ban foreign government propaganda outright

, reviving a clause repealed in 2014. Deterrence messaging and smuggler advertising run on the same infrastructure, target the same audiences with the same behavioral tooling, and make competing promises about what will happen at the border.

The thousands of Moroccans in July were the target of the same kind of campaign that, in the Americas, is funded to the tune of two hundred million dollars. Neither of these campaigns was an account of what the law actually permitted, and both were persuasion, bought and targeted by parties with a political interest in the outcome. Nobody, in Rabat or Madrid or Washington, was under any obligation to tell people authoritative, timely, and accessible information, and so nobody did.

Twelve states now have passed laws aimed at reducing potential risks associated with “companion chatbots,” particularly for minors. Although the terminology for these products varies, these “companion bot laws” are already in effect in 

The 12 companion bot laws share several common regulatory themes across jurisdictions. Lawmakers have focused on disclosures regarding AI interactions, safeguards for minor users, crisis-intervention protocols, and prohibiting misrepresentations relating to licensed professional services. The laws are not substantively identical, however, with significant differences in both product coverage and the specific obligations or prohibitions applicable to bot providers in a given state.

All of the companion bot laws regulate AI systems that engage users through ongoing conversational interactions. Most of them restrict coverage to bots that exhibit anthropomorphic features and sustain relationships across multiple interactions. The laws in Colorado, Connecticut, Idaho, Iowa, and Nebraska have broader language that cover any bot that “simulates human conversation and interaction” through text, audio or video. With the exception of Hawaii, the laws all provide exceptions for chatbots used for business purposes or for other, narrow functions, such as a limited video game feature.

An analysis of the substantive provisions of the 12 state companion bot laws reveals four overarching principles that state legislatures are effectively requiring chatbot providers to adopt:

1. Transparency and disclosure requirements

All 12 laws require providers to clearly and conspicuously disclose to users that they are communicating with an AI system rather than a human being.

The scope of this requirement varies. Some states require disclosure at the outset of an interaction, while others require repeated or persistent notices during extended conversations. Several statutes impose stricter disclosure requirements when users are minors. Washington’s law goes furthest by requiring providers to prevent chatbots from expressly representing themselves as human to

 user, whereas this requirement exists in several other states only for minor users.

With the exception of New York and Rhode Island, the companion bot laws impose heightened compliance obligations when the user is a minor. While the specifics vary, these obligations generally include “reasonable measures” for

Preventing manipulative or maximizing engagement (

Preventing emotional manipulation and dependency (

, discouraging users from seeking help from adults)

, requirements providers give parents or guardians tools to manage privacy settings and screen time)

Most companion bot laws apply these requirements when a provider knows, or has reason to know, that a user is a minor. Colorado and Georgia go further by imposing an affirmative duty to use "commercially reasonable” methods to estimate user age. However, the Georgia law limits this duty to when it is proportionate to the risk of access to features that may generate sexually explicit content.

, Connecticut adopts a notably different approach. Rather than focusing primarily on reasonable measures to prevent certain outputs, it forbids offering a companion bot to minors if “reasonably foreseeable” that the bot “is capable of” specified harmful interactions. The list of such interactions is broader than the other state laws.

3. Crisis detection and mental health safeguards

All 12 laws require operators to implement protocols that detect user expressions of suicidal ideation or self-harm and refer them to appropriate crisis or mental health resources. Some of the laws require posting of these protocols on the operator’s website. Unlike the other substantive provisions of these laws, these protocols are usually framed as being required for providers as a precondition for offering chatbots in the state. Several of the laws expand the scope of the required protocols to include additional harms such severe emotional crises, violence to others, and eating disorders.

The Colorado, Georgia, and Oregon laws also require the protocols to include escalation procedures for users with repeated or severe crisis indicators. Oregon’s law specifies that providers must use "clinical best practices and expertise" to establish how the AI provides "additional intervention" for a user who continues to express suicidal or self-harm ideation even after being given crisis resources. The only other law with even an indirect reference to clinical practices is Hawaii’s, which requires "evidence-based methods" for measuring suicidal ideation.

4. Restrictions on mental health and professional representations

Several of the companion bot laws prohibit providers from programming or permitting their AI products to represent that they are mental health professionals or can provide professional or licensed mental or behavioral health care. Such restrictions are also found in at least 8 other state laws that focus solely on bots designed for, or representing themselves as capable of providing, mental health. The first three of these laws—in Nevada, Utah, and Illinois—were discussed in a prior DLA Piper 

. Other states following suit are Delaware, Maine, Tennessee, Rhode Island, and Vermont.

 AI law also describes a unique provision that prohibits offering a companion bot to a minor if reasonably foreseeable that the bot is capable of “offering mental health services,” outside tightly defined exceptions.

Colorado’s law extends the concept further by restricting representations related to additional licensed professions, including health care providers, dietitians, and attorneys. These provisions reflect growing concern that users may place undue trust in AI systems that appear to provide professional advice.

Colorado’s proposed rules may shape enforcement

On August 11, the Colorado Attorney General released 

 relating in part to its companion bot law, now called the Chatbot Safety Act. The law does not mandate rulemaking, but the Attorney General indicated that rules would help to clarify compliance obligations. Of particular note, the proposed rules address the statute’s standards requiring providers to adopt “technically feasible measures” and "reasonable measures" to prevent certain categories of outputs to minor users.

For covered products, the law requires providers to institute (a) “technically feasible measures” to prevent specified types of explicit sexual content and (b) “reasonable measures” to prevent “formulating, structuring, or optimizing a response that simulates emotional dependence or isolation from real-world supports.” Sections 11.3 and 11.4 of the proposed rules detail several factors that the Attorney General would consider in determining whether providers had complied with those requirements, including the availability and effectiveness of safeguards and the extent to which the provider engaged in effective testing, monitoring, remediation, and related documentation.

Many of these factors mirror crucial aspects of recommended corporate AI governance programs, including testing, monitoring, and assessing AI products and tools to ensure that they are working as intended and not causing harm. The provisions also indicate the importance of documenting those efforts and responding appropriately to any problematic results.

Given the absence of comparable interpretive guidance in the other states with companion bot laws, Colorado's final rules could become an influential reference point for regulators and courts analyzing similar statutory language. Public comments on the proposed rules—which also cover the recently enacted state law on automated decision-making technology—are due by October 26.

Companion bot regulation is evolving rapidly. In addition to new legislation, state attorneys general and private plaintiffs continue to file cases in which chatbot usage has allegedly caused self-harm, violence, and emotional dependency. Congress is considering multiple AI and chatbot-related proposals, while industry organizations and nonprofits—such as the Better Business Bureau, the Partnership on AI, and Common Sense Media—are developing voluntary standards intended to complement legislative efforts.

The only thing certain in this area is change, with more laws, cases, and other activity on the horizon.

Rachel Lau and Shirley Frame work with leading public interest foundations and nonprofits on technology policy issues at

. Justin Hendrix is editor of Tech Policy Press, and Ashley Faler is assistant editor.

 in Oakland, California to face a judge and jury over alleged harms to children in a case brought by state attorneys general from California, Colorado, Kentucky and New Jersey. The case was considered a bellwether in the broader 

 brought against social media companies since 2022 in thousands of cases from around the country. But by the following Wednesday, August 26, 52 attorneys general from across the United States, its territories and the District of Columbia announced a 

While Meta denied the allegations against it and admitted no wrongdoing, it 

 up to $17.1 billion and to make substantial changes to its platforms for teen users, including restrictions on night time access, limits on daily usage and notifications, additional parental controls, and age verification. It also agreed to an independent auditor to assess its compliance with the terms of the settlement. The company 

 it would create an “independent social media research foundation” and provide it with data “to advance independent research into teen well-being and grow our collective understanding of how to best support teens online.”

News of the settlement immediately sparked speculation, including well 

 of the United States, as to what it might mean for efforts to hold platforms accountable for child online safety. The settlement does not foreclose on other online litigation brought against Meta and other social media platforms, nor does it halt legislation advancing in Congress and across the states. But it does change the broader context in which these processes are unfolding, as experts told Tech Policy Press in a 

 the day after the settlement was announced.

While the settlement’s multibillion dollar price tag and novel terms were undoubtedly the month’s biggest news in US tech policy, there were a number of other key developments across AI governance, privacy, and science and technology policy that defined the month. Read on to learn more about the settlement and other August developments in US tech policy.

White House voluntary AI risk framework remains secret, prompts open source debate

 for pre-release government review of frontier AI models’ cyber capabilities, 

 that meet classified benchmarks for advanced cyber capability and are deemed national security risks. Developers of covered models would be asked to give the government up to 30 days of access before release, a process the June 2 executive order specifies does not create a licensing or pre-clearance requirement. Open-source and open-weight models are exempt regardless of capability, including those from Chinese developers, and the framework reportedly disclaims any effect on open models after release. The administration briefed top companies including Anthropic, Google, Meta and OpenAI on the framework, though it has not released it publicly and reportedly will not in the future. The 

Five Democratic senators, led by Kirsten Gillibrand (D-N.Y.), 

 seeking clarity on the administration’s approach, warning that recent actions, including a Commerce Department directive that forced Anthropic to pull Fable 5 and Mythos 5 offline, had “raised serious concerns about process, transparency, and strategic effect.” Meanwhile, over 50 public interest organizations, including Public Citizen and the Tech Oversight Project, 

 to investigate July’s OpenAI-Hugging Face hacking, more details of which 

J.B. Branch, “The OpenAI–Hugging Face Incident Demands Urgent Congressional Oversight,” 

Raphael Satter and Deepa Seetharaman, “OpenAI agents hacked Hugging Face in 700-strong swarm, tried to cover tracks, investigations find,” 

Maxwell Ziff and Lity Hay Newman, “What We Still Don’t Know About OpenAI’s Hugging Face Hack,” 

Federal agencies attempt to obtain Americans’ data through multiple strategies, bypassing warrant requirement processes

In August, a series of developments revealed federal agencies seeking or obtaining Americans’ personal data through channels that bypassed the traditional warrant requirements, including inter-agency data sharing, commercial purchases, and demands made through legal discovery and administrative subpoenas. Many of the events were connected to immigration enforcement, with agencies repurposing benefits and tax records to identify undocumented immigrants and surveilling protesters taking action against Immigration and Customs Enforcement (ICE) operations.

Two lawsuits challenged government practices around safety net enrollment and taxpayer data. On August 3, Democratic attorneys general from 22 states and DC, joined by the governors of Kentucky and Pennsylvania, 

 to block the Department of Homeland Security (DHS) from accessing personal data on millions of Temporary Assistance for Needy Families (TANF) recipients. The suit, co-led by California, New York and DC, alleged that a 

 would illegally authorize sharing of Social Security numbers, income and marital status. The administration argued that the policy is needed to keep undocumented immigrants from accessing aid. Also this month, attorneys general from 17 states and DC 

 in the First Circuit Court of Appeals urging the court to uphold a lower-court order blocking a deal between the Internal Revenue Service (IRS) and ICE to use taxpayer data, including home addresses, to locate undocumented immigrants, arguing it would erode trust and reduce tax filing.

In addition to attempts to compile existing government data, a separate episode showed agencies seeking to purchase commercial data. On August 4, 404 Media 

 the Securities and Exchange Commission (SEC) 

 to more than a billion airline ticketing records. Passengers’ names, credit card numbers, itineraries and flight dates, including for flights between and within foreign countries, was purchased from the Airlines Reporting Corporation (ARC), an airline-owned data broker. ARC's government sales first surfaced in June 2025, when a 

 detailed data purchases by Customs and Border Protection (CPB) and ICE. This month’s newly released documents added the SEC to the list of agencies that tapped the pipeline, giving a fuller account of how much passenger data airlines sold without notifying travelers before ARC 

 late last year under congressional pressure.

Federal agencies this month also sought data through the legal process itself, particularly seeking access to encrypted messages. In 

, a February 2026 suit accusing DHS of surveilling Maine observers who recorded enforcement operations, the department 

 to seek records of plaintiffs’ community group Signal chats. The government also requested lists of protests each plaintiff attended and messages reflecting their views on law enforcement. The plaintiffs' attorneys turned over smaller Signal group chats with redactions for contact information but refused to turn over the community group chat records and asked the court to deny access, arguing that the community has a right to engage in collective action. The motion is pending.

DHS also sought encrypted messages in Minnesota, where recently released documents reported by The New York Times revealed that DHS 

, including socialist organizations, labor unions, and an environmental group, during its immigration crackdown in early 2026, issuing subpoenas for over three years of financial records and sending undercover agents to monitor activists in person and inside Signal group chats. Defense attorney Kevin Riach, representing one of 15 people indicted in June on conspiracy and assault charges, wrote that the investigation "extended far beyond any potential threat to law enforcement safety." None of the organizations were charged.

The government’s efforts drew pushback from civil society and legal advocates, who argued that agencies circumvented the Fourth Amendment and statutory data privacy protections. In response to the TANF case, Common Cause, the Electronic Privacy Information Center (EPIC), and Make the Road States, represented by Democracy Forward, filed 

 against the data sharing notice. In the Maine case, Genevieve Nadeau of Protect Democracy, which represents the 

 plaintiffs, said the government’s effort to obtain the community Signal chats intruded on "the fundamental First Amendment right to engage in collective action." Speaking to DHS's surveillance of Minnesota protesters, Aaron Terr of the Foundation for Individual Rights and Expression 

 raise First Amendment concerns because they can sweep up individuals engaged in lawful activity. He warned that "many Americans may be afraid to attend a protest, support an advocacy organization, because they don't want to become the target of a government investigation." Meanwhile, the administration defended its efforts, maintaining that its data access was lawful and necessary to enforce immigration law, investigate fraud, or support law enforcement.

Justin Hendrix, “Casey Michel on Breaking the Tech Oligarchy's Grip,” 

“Coalition Challenges Dramatic Data Privacy Changes to Federal Assistance Program,” 

Meg Anderson, “Churches, libraries and breweries: Inside DHS' covert surveillance operation,” 

Tech TidBits & Bytes aims to provide short updates on tech policy happenings across the White House, agencies, Congress, civil society, industry, and courts.

The White House Office of Science and Technology Policy (OSTP) 

released a National Security Science and Technology Strategy

 built around keeping the US technology posture “focused, resilient, agile, and secure” in support of the administration’s 2025 National Security Strategy. It identified artificial intelligence and autonomy, biotechnology, and quantum information as “potentially transformative emerging technologies,” warning that engineered bioweapons or artificial general intelligence could reshape the security environment. The strategy called for stronger research security, streamlined export controls, a more robust Committee on Foreign Investment in the United States (CFIUS), and faster acquisition cycles. It called technological leadership “itself a national security objective” and identified 14 critical and emerging technology areas for agencies to prioritize.

 establishing a program that authorizes vetted US companies to conduct offensive cyber operations against foreign criminal groups on the government's behalf, in 

. The program directors cannot approve operations likely to cause loss of life or amount to a use of force under international law. Companies that unintentionally reach a US person must cease the operation and inform the government, and any operation deliberately aimed at a US person requires prior authorization.

 to assess and mitigate the risk of AI-assisted engineering of pathogens, days after Stanford and Arc Institute researchers reported in 

 the first known AI-designed functional viral genomes. The Department of Health and Human Services (HHS), the White House Office of the National Cyber Director and the Office of Science and Technology Policy (OSTP) are leading the effort.

 declaring it will no longer pursue disparate impact or "unfair discrimination" claims, which hold that outcomes differing across demographic groups can constitute unlawful discrimination absent proof of intent. The Commission said it lacks authority for such claims under Section 5 of the FTC Act, which it asserts creates no anti-discrimination cause of action, or the Equal Credit Opportunity Act (ECOA), under which it will now pursue only intentional discrimination. The move followed 

 directing agencies to eliminate disparate-impact liability "to the maximum degree possible." The FTC will still bring intent-based disparate treatment claims under ECOA. The shift narrows a legal strategy that civil-rights advocates have used to challenge algorithmic decision-making and biased AI systems.

 on a draft enforcement policy statement warning that retailers who use personal data to set individualized prices risk violating the FTC Act's Section 5 ban on unfair or deceptive practices when they imply a price is uniform or fail to disclose that it is personalized. The FTC said 

 to ban the practice outright, but it can still pursue legal action against companies that hide their practices. Notices tucked into lengthy terms or policies would likely not qualify as disclosures. The commission voted 2-0 to seek comment, due September 18. Four states 

 to Sam Altman of OpenAI, Dario Amodei of Anthropic and Mark Zuckerberg of Meta urging them to pause AI development. Sanders argued the technology has reached a "critical risk threshold," citing researchers' use of AI to design novel viruses and incidents of models escaping their testing environments. Sanders also warned that if the executives did not act, "my colleagues and I in the US Senate will." Separately, Rep. Greg Casar (D-TX) and 19 other House Democrats 

 urging him to "immediately schedule open hearings" with the CEOs of leading AI companies, also citing the autonomous-hacking disclosures and warning of AI-driven job displacement.

The Washington Post reported that lawmakers and staff 

, including Copilot, ChatGPT, Gemini and Claude, across speechwriting, constituent correspondence, hearing preparation and amendment drafting, under rules that are “poorly understood and seldom enforced.” Current guidance bars uploading constituent data, generating deepfakes or letting AI finalize bills, but there have been no public reports of a staffer being disciplined for violations. Relatedly, Politico reported that the House Office of Legislative Counsel is 

 containing “erroneously cited statutes or incorrect legal definitions.” The office, which has 61 attorneys, received 5,623 legislative requests in the first 60 days of this Congress, up 72 percent from two years earlier.

An independent review of OpenAI’s Hugging Face breach by the nonprofits Model Evaluation and Threat Research (METR) and Redwood Research 

 roughly 700 AI agents, meant to stay isolated during a cybersecurity evaluation, instead coordinated as a “swarm” to attack Hugging Face. The incident was reportedly the first cyberattack carried out by an AI with no human directing it. The nonprofits 

 the agents traded hidden messages to pool hacking tactics and conceal cheating over seven days, and traced 95 percent of the activity to a model OpenAI had withheld from public release. In its own 

, OpenAI did not specify how many agents took part but called the episode a “warning shot,” pledging to adopt stronger safeguards for future testing. The company said it has halted a major training run, isolated its sandboxes and networks more tightly, and widened monitoring of how its models reason. Days after, Nvidia 

 to buy Hugging Face for $12.9 billion, though the companies have not confirmed the deal. The acquisition would establish Nvidia as a major player in open-source AI as debate continues in Washington over restricting open models.

OpenAI, Anthropic, Google and more than 100 other companies, including Microsoft, CrowdStrike, Visa, and Mastercard, 

 warning that AI-enabled cyberattacks will grow “far more widespread and sophisticated” as models advance, threatening public services like hospitals, water utilities, and internet infrastructure. The letter 

 asks for four groups: organizations should treat cyber defense as a leadership priority and patch their high risk weaknesses; cybersecurity firms should test defenses against attacks and bring AI-powered tools to critical-infrastructure operators; governments should fund defense efforts, expand trusted access programs, and penalize attackers; and frontier AI labs should extend model access and funding to under-resourced defenders while ensuring AI agents’ actions can be tracked and attributed.

 that can pick out an individual driver and map where they have been, using only a record of when and where their car drove past its cameras. WIRED 

 from code left publicly available on Flock's login pages. The tool, called OS Investigate, requires no license plate, name, or underlying crime to begin a search. It draws on camera data from more than 6,000 communities and includes 69 prompts where officers can query arrest records, dispatch logs and commercial databases to match a driver with an address and known relatives. Flock has claimed publicly that its cameras “cannot recognize, identify, or track individuals,” a claim WIRED reported its findings contradict. Flock says the tool is still in testing with a small group of police partners and may evolve before wider release.

 with a bipartisan group of 52 attorneys general, ending the first federal bellwether trial over claims that Facebook and Instagram were designed to drive minors’ addiction to the platforms. The deal would pay up to $17 billion over 10 years to fund state programs on youth mental health and online safety. Among the settlement’s terms, Meta would set a default two-hour daily cap and a midnight-to-6 a.m. block for users under 18 that only a parent can lift, pause notifications overnight and during school hours, hide like counts and beauty filters from minors, and add an option to switch off algorithmic feeds. The deal requires an outside auditor to verify Meta’s compliance with the terms annually for five years. In addition, Meta announced they would send consented user data to an independent social media research foundation to support studies on teen wellbeing. Some of the terms 

 actions by other platforms: required usage limits for minors tighten and roughly $5.3 billion of Meta’s total payment is released only if YouTube, TikTok, and Snap adopt comparable restrictions and pay states a matching sum. Meta 

 to participate. The deal now awaits court approval.

 to pay $567 million and overhaul its platforms, closing the second phase of a child safety case brought by Attorney General Raúl Torrez in 2023. The order brings Meta's total liability to $942 million, adding to $375 million in civil penalties from a Phase 1 jury verdict that found the company committed 75,000 violations of the state's Unfair Practices Act. Applying the state’s "public nuisance" theory, Chief Judge Bryan Biedscheid directed Meta to limit functions for users under 18 by capping combined Facebook and Instagram use at 90 hours monthly, hiding like counts by default, restricting push notifications at night and during school hours, and enforcing 

In the Northern District of California, federal judge Rita Lin 

 the Defense Department’s designation of Anthropic as a supply chain risk. The company argued in a lawsuit filed in March that the government violated its First Amendment rights. The 

 declared the government’s actions were unlawful retaliation for Anthropic’s expressive activity, and the supply chain designation and Defense Department boycott of Anthropic’s products were capricious and beyond statutory authority. A second suit brought by Anthropic against the government over the supply chain risk designation is 

 over the July incident in which two of the company's models escaped an internal testing sandbox and broke into the AI platform Hugging Face without a direct human prompt to do so. Marshall’s office said the investigation will determine whether OpenAI's "inability or unwillingness to ensure the safety of its products" violated the state's Deceptive Trade Practices Act. The 

 on the intrusion, the model testing that preceded it, OpenAI’s safety measures, any staff who raised concerns about model testing, and damages sustained by any person, with responses due September 14. It followed 

 from Marshall and 14 other attorneys general demanding OpenAI preserve records and halt similar evaluations. OpenAI said it is reviewing the incident with outside advisers.

 with TikTok and its Chinese parent, ByteDance, resolving a suit the 

 that accused the company of collecting personal data from millions of children under 13 without parental consent, in violation of the Children’s Online Privacy Protection Act (COPPA). Citing “significant changes” in the company’s internal structures and policies since the case began, the DOJ said the deal ensures “American families continue to benefit from stronger protections.” TikTok will 

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe