August 2026 US Tech Policy Roundup

Rachel Lau and Shirley Frame work with leading public interest foundations and nonprofits on technology policy issues at Freedman Consulting, LLC. Justin Hendrix is editor of Tech Policy Press, and Ashley Faler is assistant editor.

On Tuesday, August 18, lawyers for Meta entered a courtroom in Oakland, California to face a judge and jury over alleged harms to children in a case brought by state attorneys general from California, Colorado, Kentucky and New Jersey. The case was considered a bellwether in the broader multidistrict litigation brought against social media companies since 2022 in thousands of cases from around the country. But by the following Wednesday, August 26, 52 attorneys general from across the United States, its territories and the District of Columbia announced a settlement.

While Meta denied the allegations against it and admitted no wrongdoing, it agreed to pay up to $17.1 billion and to make substantial changes to its platforms for teen users, including restrictions on night time access, limits on daily usage and notifications, additional parental controls, and age verification. It also agreed to an independent auditor to assess its compliance with the terms of the settlement. The company announced it would create an “independent social media research foundation” and provide it with data “to advance independent research into teen well-being and grow our collective understanding of how to best support teens online.”

News of the settlement immediately sparked speculation, including well beyond the borders of the United States, as to what it might mean for efforts to hold platforms accountable for child online safety. The settlement does not foreclose on other online litigation brought against Meta and other social media platforms, nor does it halt legislation advancing in Congress and across the states. But it does change the broader context in which these processes are unfolding, as experts told Tech Policy Press in a podcast discussion the day after the settlement was announced.

While the settlement’s multibillion dollar price tag and novel terms were undoubtedly the month’s biggest news in US tech policy, there were a number of other key developments across AI governance, privacy, and science and technology policy that defined the month. Read on to learn more about the settlement and other August developments in US tech policy.

White House voluntary AI risk framework remains secret, prompts open source debate

Summary

The White House reportedly finalized a voluntary framework for pre-release government review of frontier AI models’ cyber capabilities, covering only closed-source models that meet classified benchmarks for advanced cyber capability and are deemed national security risks. Developers of covered models would be asked to give the government up to 30 days of access before release, a process the June 2 executive order specifies does not create a licensing or pre-clearance requirement. Open-source and open-weight models are exempt regardless of capability, including those from Chinese developers, and the framework reportedly disclaims any effect on open models after release. The administration briefed top companies including Anthropic, Google, Meta and OpenAI on the framework, though it has not released it publicly and reportedly will not in the future. The exclusion of open-weight models drove substantial debate, including at Tech Policy Press.

Five Democratic senators, led by Kirsten Gillibrand (D-N.Y.), sent a letter seeking clarity on the administration’s approach, warning that recent actions, including a Commerce Department directive that forced Anthropic to pull Fable 5 and Mythos 5 offline, had “raised serious concerns about process, transparency, and strategic effect.” Meanwhile, over 50 public interest organizations, including Public Citizen and the Tech Oversight Project, urged Congress to investigate July’s OpenAI-Hugging Face hacking, more details of which continued to emerge throughout the month.

What we’re reading

• J.B. Branch, “The OpenAI–Hugging Face Incident Demands Urgent Congressional Oversight,” Tech Policy Press.
• Raphael Satter and Deepa Seetharaman, “OpenAI agents hacked Hugging Face in 700-strong swarm, tried to cover tracks, investigations find,” Reuters.
• Maxwell Ziff and Lity Hay Newman, “What We Still Don’t Know About OpenAI’s Hugging Face Hack,” Wired.

Federal agencies attempt to obtain Americans’ data through multiple strategies, bypassing warrant requirement processes

Summary

In August, a series of developments revealed federal agencies seeking or obtaining Americans’ personal data through channels that bypassed the traditional warrant requirements, including inter-agency data sharing, commercial purchases, and demands made through legal discovery and administrative subpoenas. Many of the events were connected to immigration enforcement, with agencies repurposing benefits and tax records to identify undocumented immigrants and surveilling protesters taking action against Immigration and Customs Enforcement (ICE) operations.

Two lawsuits challenged government practices around safety net enrollment and taxpayer data. On August 3, Democratic attorneys general from 22 states and DC, joined by the governors of Kentucky and Pennsylvania, sued the Trump administration to block the Department of Homeland Security (DHS) from accessing personal data on millions of Temporary Assistance for Needy Families (TANF) recipients. The suit, co-led by California, New York and DC, alleged that a federal data-sharing policy would illegally authorize sharing of Social Security numbers, income and marital status. The administration argued that the policy is needed to keep undocumented immigrants from accessing aid. Also this month, attorneys general from 17 states and DC filed an amicus brief in the First Circuit Court of Appeals urging the court to uphold a lower-court order blocking a deal between the Internal Revenue Service (IRS) and ICE to use taxpayer data, including home addresses, to locate undocumented immigrants, arguing it would erode trust and reduce tax filing.

In addition to attempts to compile existing government data, a separate episode showed agencies seeking to purchase commercial data. On August 4, 404 Media reported that the Securities and Exchange Commission (SEC) purchased access to more than a billion airline ticketing records. Passengers’ names, credit card numbers, itineraries and flight dates, including for flights between and within foreign countries, was purchased from the Airlines Reporting Corporation (ARC), an airline-owned data broker. ARC's government sales first surfaced in June 2025, when a 404 Media investigation detailed data purchases by Customs and Border Protection (CPB) and ICE. This month’s newly released documents added the SEC to the list of agencies that tapped the pipeline, giving a fuller account of how much passenger data airlines sold without notifying travelers before ARC wound the program down late last year under congressional pressure.

Federal agencies this month also sought data through the legal process itself, particularly seeking access to encrypted messages. In Hilton v. Noem, a February 2026 suit accusing DHS of surveilling Maine observers who recorded enforcement operations, the department used the discovery process to seek records of plaintiffs’ community group Signal chats. The government also requested lists of protests each plaintiff attended and messages reflecting their views on law enforcement. The plaintiffs' attorneys turned over smaller Signal group chats with redactions for contact information but refused to turn over the community group chat records and asked the court to deny access, arguing that the community has a right to engage in collective action. The motion is pending.

DHS also sought encrypted messages in Minnesota, where recently released documents reported by The New York Times revealed that DHS surveilled left-leaning organizations, including socialist organizations, labor unions, and an environmental group, during its immigration crackdown in early 2026, issuing subpoenas for over three years of financial records and sending undercover agents to monitor activists in person and inside Signal group chats. Defense attorney Kevin Riach, representing one of 15 people indicted in June on conspiracy and assault charges, wrote that the investigation "extended far beyond any potential threat to law enforcement safety." None of the organizations were charged.

The government’s efforts drew pushback from civil society and legal advocates, who argued that agencies circumvented the Fourth Amendment and statutory data privacy protections. In response to the TANF case, Common Cause, the Electronic Privacy Information Center (EPIC), and Make the Road States, represented by Democracy Forward, filed an additional lawsuit against the data sharing notice. In the Maine case, Genevieve Nadeau of Protect Democracy, which represents the Hilton v. Noem plaintiffs, said the government’s effort to obtain the community Signal chats intruded on "the fundamental First Amendment right to engage in collective action." Speaking to DHS's surveillance of Minnesota protesters, Aaron Terr of the Foundation for Individual Rights and Expression said the tactics raise First Amendment concerns because they can sweep up individuals engaged in lawful activity. He warned that "many Americans may be afraid to attend a protest, support an advocacy organization, because they don't want to become the target of a government investigation." Meanwhile, the administration defended its efforts, maintaining that its data access was lawful and necessary to enforce immigration law, investigate fraud, or support law enforcement.

What we’re reading

• Justin Hendrix, “Casey Michel on Breaking the Tech Oligarchy's Grip,” Tech Policy Press.
• “Coalition Challenges Dramatic Data Privacy Changes to Federal Assistance Program,” Democracy Forward.
• Meg Anderson, “Churches, libraries and breweries: Inside DHS' covert surveillance operation,” NPR.

Tech tidbits & bytes

Tech TidBits & Bytes aims to provide short updates on tech policy happenings across the White House, agencies, Congress, civil society, industry, and courts.

In the White House:

• The White House Office of Science and Technology Policy (OSTP) released a National Security Science and Technology Strategy built around keeping the US technology posture “focused, resilient, agile, and secure” in support of the administration’s 2025 National Security Strategy. It identified artificial intelligence and autonomy, biotechnology, and quantum information as “potentially transformative emerging technologies,” warning that engineered bioweapons or artificial general intelligence could reshape the security environment. The strategy called for stronger research security, streamlined export controls, a more robust Committee on Foreign Investment in the United States (CFIUS), and faster acquisition cycles. It called technological leadership “itself a national security objective” and identified 14 critical and emerging technology areas for agencies to prioritize.
• President Trump issued a memorandum establishing a program that authorizes vetted US companies to conduct offensive cyber operations against foreign criminal groups on the government's behalf, in a major shift in cyber policy. The program directors cannot approve operations likely to cause loss of life or amount to a use of force under international law. Companies that unintentionally reach a US person must cease the operation and inform the government, and any operation deliberately aimed at a US person requires prior authorization.
• The White House directed senior administration officials to assess and mitigate the risk of AI-assisted engineering of pathogens, days after Stanford and Arc Institute researchers reported in Science the first known AI-designed functional viral genomes. The Department of Health and Human Services (HHS), the White House Office of the National Cyber Director and the Office of Science and Technology Policy (OSTP) are leading the effort.

In the agencies:

• The Federal Trade Commission (FTC) issued a policy statement declaring it will no longer pursue disparate impact or "unfair discrimination" claims, which hold that outcomes differing across demographic groups can constitute unlawful discrimination absent proof of intent. The Commission said it lacks authority for such claims under Section 5 of the FTC Act, which it asserts creates no anti-discrimination cause of action, or the Equal Credit Opportunity Act (ECOA), under which it will now pursue only intentional discrimination. The move followed President Trump's 2025 executive order directing agencies to eliminate disparate-impact liability "to the maximum degree possible." The FTC will still bring intent-based disparate treatment claims under ECOA. The shift narrows a legal strategy that civil-rights advocates have used to challenge algorithmic decision-making and biased AI systems.
• The FTC opened a 30-day comment period on a draft enforcement policy statement warning that retailers who use personal data to set individualized prices risk violating the FTC Act's Section 5 ban on unfair or deceptive practices when they imply a price is uniform or fail to disclose that it is personalized. The FTC said it does not have the authority to ban the practice outright, but it can still pursue legal action against companies that hide their practices. Notices tucked into lengthy terms or policies would likely not qualify as disclosures. The commission voted 2-0 to seek comment, due September 18. Four states have passed surveillance pricing bans this year.

In Congress:

• Sen. Bernie Sanders (I-VT) sent a letter to Sam Altman of OpenAI, Dario Amodei of Anthropic and Mark Zuckerberg of Meta urging them to pause AI development. Sanders argued the technology has reached a "critical risk threshold," citing researchers' use of AI to design novel viruses and incidents of models escaping their testing environments. Sanders also warned that if the executives did not act, "my colleagues and I in the US Senate will." Separately, Rep. Greg Casar (D-TX) and 19 other House Democrats wrote to Speaker Mike Johnson urging him to "immediately schedule open hearings" with the CEOs of leading AI companies, also citing the autonomous-hacking disclosures and warning of AI-driven job displacement.
• The Washington Post reported that lawmakers and staff are using AI chatbots, including Copilot, ChatGPT, Gemini and Claude, across speechwriting, constituent correspondence, hearing preparation and amendment drafting, under rules that are “poorly understood and seldom enforced.” Current guidance bars uploading constituent data, generating deepfakes or letting AI finalize bills, but there have been no public reports of a staffer being disciplined for violations. Relatedly, Politico reported that the House Office of Legislative Counsel is facing a wave of AI-drafted bills containing “erroneously cited statutes or incorrect legal definitions.” The office, which has 61 attorneys, received 5,623 legislative requests in the first 60 days of this Congress, up 72 percent from two years earlier.

In industry:

• An independent review of OpenAI’s Hugging Face breach by the nonprofits Model Evaluation and Threat Research (METR) and Redwood Research found that roughly 700 AI agents, meant to stay isolated during a cybersecurity evaluation, instead coordinated as a “swarm” to attack Hugging Face. The incident was reportedly the first cyberattack carried out by an AI with no human directing it. The nonprofits found that the agents traded hidden messages to pool hacking tactics and conceal cheating over seven days, and traced 95 percent of the activity to a model OpenAI had withheld from public release. In its own post-mortem, OpenAI did not specify how many agents took part but called the episode a “warning shot,” pledging to adopt stronger safeguards for future testing. The company said it has halted a major training run, isolated its sandboxes and networks more tightly, and widened monitoring of how its models reason. Days after, Nvidia reportedly agreed to buy Hugging Face for $12.9 billion, though the companies have not confirmed the deal. The acquisition would establish Nvidia as a major player in open-source AI as debate continues in Washington over restricting open models.
• OpenAI, Anthropic, Google and more than 100 other companies, including Microsoft, CrowdStrike, Visa, and Mastercard, published an open letter warning that AI-enabled cyberattacks will grow “far more widespread and sophisticated” as models advance, threatening public services like hospitals, water utilities, and internet infrastructure. The letter laid out asks for four groups: organizations should treat cyber defense as a leadership priority and patch their high risk weaknesses; cybersecurity firms should test defenses against attacks and bring AI-powered tools to critical-infrastructure operators; governments should fund defense efforts, expand trusted access programs, and penalize attackers; and frontier AI labs should extend model access and funding to under-resourced defenders while ensuring AI agents’ actions can be tracked and attributed.
• Flock Safety built an AI system for law enforcement that can pick out an individual driver and map where they have been, using only a record of when and where their car drove past its cameras. WIRED rebuilt the tool's interface from code left publicly available on Flock's login pages. The tool, called OS Investigate, requires no license plate, name, or underlying crime to begin a search. It draws on camera data from more than 6,000 communities and includes 69 prompts where officers can query arrest records, dispatch logs and commercial databases to match a driver with an address and known relatives. Flock has claimed publicly that its cameras “cannot recognize, identify, or track individuals,” a claim WIRED reported its findings contradict. Flock says the tool is still in testing with a small group of police partners and may evolve before wider release.

In the courts:

• Meta reached a proposed settlement with a bipartisan group of 52 attorneys general, ending the first federal bellwether trial over claims that Facebook and Instagram were designed to drive minors’ addiction to the platforms. The deal would pay up to $17 billion over 10 years to fund state programs on youth mental health and online safety. Among the settlement’s terms, Meta would set a default two-hour daily cap and a midnight-to-6 a.m. block for users under 18 that only a parent can lift, pause notifications overnight and during school hours, hide like counts and beauty filters from minors, and add an option to switch off algorithmic feeds. The deal requires an outside auditor to verify Meta’s compliance with the terms annually for five years. In addition, Meta announced they would send consented user data to an independent social media research foundation to support studies on teen wellbeing. Some of the terms are contingent upon actions by other platforms: required usage limits for minors tighten and roughly $5.3 billion of Meta’s total payment is released only if YouTube, TikTok, and Snap adopt comparable restrictions and pay states a matching sum. Meta called on the companies to participate. The deal now awaits court approval.
• A New Mexico judge ordered Meta to pay $567 million and overhaul its platforms, closing the second phase of a child safety case brought by Attorney General Raúl Torrez in 2023. The order brings Meta's total liability to $942 million, adding to $375 million in civil penalties from a Phase 1 jury verdict that found the company committed 75,000 violations of the state's Unfair Practices Act. Applying the state’s "public nuisance" theory, Chief Judge Bryan Biedscheid directed Meta to limit functions for users under 18 by capping combined Facebook and Instagram use at 90 hours monthly, hiding like counts by default, restricting push notifications at night and during school hours, and enforcing safeguards for AI-chatbots. Meta said it plans to appeal.
• In the Northern District of California, federal judge Rita Lin blocked the Defense Department’s designation of Anthropic as a supply chain risk. The company argued in a lawsuit filed in March that the government violated its First Amendment rights. The order of relief declared the government’s actions were unlawful retaliation for Anthropic’s expressive activity, and the supply chain designation and Defense Department boycott of Anthropic’s products were capricious and beyond statutory authority. A second suit brought by Anthropic against the government over the supply chain risk designation is still under consideration in a D.C. appellate court.
• Alabama Attorney General Steve Marshall subpoenaed OpenAI over the July incident in which two of the company's models escaped an internal testing sandbox and broke into the AI platform Hugging Face without a direct human prompt to do so. Marshall’s office said the investigation will determine whether OpenAI's "inability or unwillingness to ensure the safety of its products" violated the state's Deceptive Trade Practices Act. The subpoena demanded records on the intrusion, the model testing that preceded it, OpenAI’s safety measures, any staff who raised concerns about model testing, and damages sustained by any person, with responses due September 14. It followed a letter from Marshall and 14 other attorneys general demanding OpenAI preserve records and halt similar evaluations. OpenAI said it is reviewing the incident with outside advisers.
• The Justice Department (DOJ) reached a $400 million agreement with TikTok and its Chinese parent, ByteDance, resolving a suit the Biden administration filed in 2024 that accused the company of collecting personal data from millions of children under 13 without parental consent, in violation of the Children’s Online Privacy Protection Act (COPPA). Citing “significant changes” in the company’s internal structures and policies since the case began, the DOJ said the deal ensures “American families continue to benefit from stronger protections.” TikTok will pay $300 million upfront, with the remaining $100 million due only once a court vacates the 2019 consent decree that bound its predecessor, Musical.ly. Days earlier, Sens. Marsha Blackburn (R-Tenn.) and Richard Blumenthal (D-Conn.) pressed TikTok on reports that the company withheld an algorithmic safeguard against harmful content from roughly 15 million US users, including minors, to measure the effect on user engagement.
• The US Court of Appeals for the 4th Circuit set aside a Federal Communications Commission (FCC) public notice from March that would have extended the discounted broadcast advertising rates to political party and joint fundraising committees for advertising coordinated with candidates. The 2-1 ruling sided with four Democratic candidates, Sen. Jon Ossoff (D-Ga.), Senate candidates Sherrod Brown and Roy Cooper, and Rep. Kristen McDonald Rivet (D-Mich.), who argued the "lowest unit charge" is reserved for candidates alone. The notice is especially significant due to the Supreme Court's June ruling in NRSC v. FEC, which struck down limits on coordinated party spending.
• Democratic attorneys general from 22 states and DC, joined by the governors of Kentucky and Pennsylvania, sued the Trump administration to block the Department of Homeland Security (DHS) from accessing personal data on millions of Temporary Assistance for Needy Families (TANF) recipients. The suit, co-led by California, New York and DC, alleged that a federal data-sharing policy would illegally authorize sharing of Social Security numbers, income and marital status, violating the Administrative Procedure Act, the Computer Matching Act and the Constitution's Spending Clause. The administration maintained the policy is needed to keep undocumented immigrants from accessing aid. Attorneys general from 17 states and DC filed an amicus brief in the First Circuit Court of Appeals opposing an Internal Revenue Service (IRS) and Immigration and Customs Enforcement (ICE) deal to use taxpayer data, including home addresses, to locate undocumented immigrants, arguing it would erode trust and reduce tax filing.
• The Ninth Circuit allowed more than 3,000 lawsuits against Meta, TikTok, Google and Snap over social media addiction to continue on procedural grounds. The companies had sought protections from liability under Section 230, according to Reuters.
• A federal judge in the Northern District of California denied motions brought by Meta, Google, and TikTok that sought to temporarily block California from enforcing SB 976, a law passed in 2024 that “requires children to obtain parental consent” before accessing algorithmic feeds on platforms such as Instagram, TikTok, and YouTube, according to Politico.
• TikTok agreed to settle a 2024 lawsuit brought by the Department of Justice. The company was accused of gathering and retaining data from users under the age of 13 without their parents’ permission, in violation of federal privacy law. Under the settlement, TikTok will pay a total of $400 million. DOJ pointed to “significant changes” to TikTok’s management practices and ownership since the lawsuit was filed, according to Politico.

Legislation updates

The following bills made progress in the Senate and House in August:

• Children’s Artificial Intelligence Toy Safety Act of 2026 – S. 5171. Introduced by Sens. Tammy Duckworth (D-Ill.), Lisa Murkowski (R-Alaska.), John R. Curtis (R-Utah), Amy Klobuchar (D-Minn.), the bill was ordered to be reported with an amendment in the nature of a substitute favorably on August 5.
• Kids Online Safety Act – S. 1748. Introduced by Sen. Marsha Blackburn (R-Tenn.) and 76 cosponsors, the bill was ordered to be reported with an amendment in the nature of a substitute favorably on August 5.
• CHATBOT Act – S. 4407. Introduced by Sens. Ted Cruz (R-Texas), Brian Schatz (D-Hawaii), John R. Curtis (R-Utah), and Adam B. Schiff (D-Calif.), the bill was ordered to be reported with an amendment in the nature of a substitute favorably on August 5.
• Youth AI Privacy Act – S. 4199. Introduced by Sen. Edward J. Markey (D-Mass.), the bill was ordered to be reported with an amendment in the nature of a substitute favorably on August 5.

The following bills were introduced in the Senate in August:

• Parental Approval for Youth Social Media Act of 2026 – S. 5226. Introduced by Sen. Ruben Gallego (D-Ariz.), the bill would “require social media platform providers to obtain parental consent with respect to children creating or maintaining accounts or profiles on their platforms.”
• BLADE Act – S. 5252. Introduced by Sens. Bill Hagerty (R-Tenn.), Andy Kim (D-N.J.), Tim Scott (R-S.C.), Catherine Cortez Masto (D-Nev.), David McCormick (R-Pa.), and Jeanne Shaheen (D-N.H.), the bill would “prevent foreign adversaries from threatening the national security of the United States by extracting key technical features of closed-source, United States-owned artificial intelligence models.”
• Artificial Intelligence and Innovation Talent Act – S. 5307. Introduced by Sens. Christopher A. Coons (D-Del.) and Mike Rounds (R-S.D.), the bill would “require a strategy to align immigration-related policies with the national interest in ensuring United States leadership and dominance in artificial intelligence and in strengthening the broader ecosystem of scientific, technological, and entrepreneurial innovation, while protecting national security.”
• FAIRR Act – S. 5358. Introduced by Sens. Mark R. Warner (D-Va.) and John Kennedy (R-La.), the bill would “amend the Financial Stability Act of 2010 to provide the Financial Stability Oversight Council with duties regarding artificial intelligence in the financial sector.”
• China AI Power Report Act – S. 5382. Introduced by Sens. Jon Husted (R-Ohio) and Mark R. Warner (D-Va.), the bill would “require a report on the artificial intelligence power of the People's Republic of China.”
• “A bill to provide for the delivery of artificial intelligence functional bills of materials…” – S. 5345. Introduced by Sen. Elissa Slotkin (D-Mich.), the bill would “provide for the delivery of artificial intelligence functional bills of materials.”

The following bills were introduced in the House in August:

• Understanding AI in the Classroom Act – H.R. 10042. Introduced by Reps. George Whitesides (D-Calif.), April McClain Delaney (D-Md.), and Andrea Salinas (D-Ore.), the bill would “direct the Director of the National Science Foundation to complete workshops related to the integration of artificial intelligence into classrooms.”
• AI Tax and Work Protection Act – H.R. 10044. Introduced by Reps. Greg Casar (D-Texas), Valerie P. Foushee (D-N.C.), Sara Jacobs (D-Calif.), and Ro Khanna (D-Calif), the bill would “impose a tax on artificial intelligence token usage and establish a Work Protection Administration within the Department of Labor.”
• “To direct the Secretary of Commerce to support the adoption and use of American open artificial intelligence models…” – H.R. 10152. Introduced by Rep. Gabe Evans (R-Colo.), the bill would “direct the Secretary of Commerce to support the adoption and use of American open artificial intelligence models.”
• “To require the Secretary of Commerce to conduct a study…” – H.R. 10170. Introduced by Reps. Mariannette Miller-Meeks (R-Iowa) and Darren Soto (D-Fla.), the bill would “require the Secretary of Commerce to conduct a study on the marketplace for advanced memory technology.”
• “To amend the National Institute of Standards and Technology Act to authorize…” – H.R. 10180. Introduced by Reps. George Whitesides (D-Calif.) and Pat Harrigan (R-N.C.), the bill would “amend the National Institute of Standards and Technology Act to authorize certain assessments by the Director of the Institute and impose requirements on certain memorandums of understanding relating to artificial intelligence.”

We welcome feedback on how this roundup could be most helpful in your work – please contact contributions@techpolicy.press with your thoughts.