Issue No. 4 · Week of September 14–20, 2026

A Law on the Books Isn't a System That Works

By Rowa Taha

Every story this week turns on the same gap: the distance between a rule existing and a rule actually working — and it shows up in strikingly different forms, from a fine that arrived four years too late to a policy that's two years old and still mostly on paper.

Lawsuit — United States

Meta's $18B Child-Safety Settlement Has a Catch

Meta agreed August 26 to a settlement worth up to $18 billion — a coalition led by California AG Rob Bonta, DC AG Brian Schwalb, and Connecticut AG William Tong — over claims it designed products to be addictive to minors and collected under-13 data without consent. About $12.7 billion is guaranteed; the remaining $5.3 billion only releases if Meta delivers specific product changes: a one-hour daily time limit for teens, a night mode, usage limits during school hours, and real age assurance. Meta's Chief Legal Officer C.J. Mahoney framed it as a template for the industry: "Because teens move fluidly across dozens of apps, we need an industry-wide solution."[1][2]

But that "industry-wide" framing is doing a lot of work. Meta's own full payout depends on TikTok and YouTube adopting the identical restrictions and contributing comparable amounts — Connecticut's version of the settlement release names Snapchat as a third trigger. TikTok has already rejected Meta's ad campaign pressuring it to fall in line, which means roughly $5 billion of what's supposed to be accountability is actually a bet that Meta's rivals will voluntarily regulate themselves the same way, under pressure from a company with no authority to make them.[2]

Two reactions to this stuck with me. Researcher Rob Lalka's: "No one should be praising someone for what the court orders them to do. Meta is not reforming here, they're complying." And litigator Jess Nall's, on scale: paid out over ten years and set against Meta's annual revenue and market cap, "it's not really all that big." That's the actual question worth sitting with — not whether the safety features are good, but whether a penalty this size, on a company this size, structured to depend on a rival's cooperation, functions as enforcement or as an unusually expensive PR commitment.[2]

Al Jazeera → Fortune → ESG Dive →

Lawsuit — United Kingdom

Largest-Ever Collective Settlement Against Google

The Competition Appeal Tribunal approved a record £260 million settlement on September 16 between Google and thousands of UK app developers who alleged Google abused its Play Store dominance — ending a ten-week trial twelve days before it was set to open. Of that, £160 million goes directly to developers, with the remaining £100 million covering litigation costs, legal fees, and insurance. Lead claimant Professor Barry Rodger called it "a historic outcome for thousands of UK app developers and for the UK's collective action regime," benefiting "developers of every size, from individuals and start-ups to established companies."[1][2]

Google admits no liability, and — this is the part that actually matters for anyone hoping this settles the underlying question — the tribunal made no finding on whether Google's roughly 30% Play Store commission was actually excessive. It just made the case go away twelve days before a court would have had to decide that.[2][3]

And the developer case isn't even the whole story. A separate, larger consumer claim brought by Liz Coll on behalf of roughly 20 million UK consumers, covering the period from October 2015 to July 2026, is still headed to trial on October 5 — on an opt-out basis, meaning those 20 million people are automatically included unless they remove themselves. Developers got paid without anyone having to prove Google overcharged them. Consumers are about to find out whether a court will actually decide that question, or whether this settlement is the template for how that case ends too.[2]

Global Legal Post → PocketGamer.biz → BusinessCloud →

Data Centers — Global

Tech Giants Say They've Solved AI's Water Problem. An Expert Says Not So Fast.

Nvidia, Microsoft, AWS, and Meta all told AFP their newest data centers use closed-loop cooling with "no net water loss" — even as Rystad Energy projects global data-center water use will nearly triple from 222 billion litres in 2025 to as much as 644 billion by 2030. Nvidia's pitch is the most aggressive: its new DSX system reportedly "could almost eliminate water consumption at some facilities" by running liquid straight through servers and accepting incoming water at 45°C instead of the industry-standard 32°C. Microsoft says it improved water-use efficiency 25% between 2022 and 2025; AWS says 37%.[1][2]

Two people who study this for a living aren't convinced the numbers mean what the companies want them to mean. Researcher Andy Masley: "There's a pretty direct trade-off between how much water is used and how much energy is used" to control temperatures — less water often just means more electricity instead. Professor Shaolei Ren goes further: "because water is generally much cheaper than electricity," cost alone gives companies no real incentive to cut total consumption. What's actually driving the closed-loop announcements, in his read, is "public relations as opposition to data centres grows," not economics.[1]

The part I think gets lost entirely in "no net water loss" headlines is indirect use — the water burned generating the electricity these facilities run on, and the water used manufacturing the chips inside them. In the US, that indirect footprint can run twice as high as what a data center draws directly. A company can genuinely hit "no net water loss" at the tap and still be responsible for a much larger water footprint sitting one or two steps upstream, in a community that never gets asked and never sees a headline about it.[1]

Euronews → Rystad Energy → Down To Earth →

Data Rights — Chile

A Landmark Privacy Law Gets Delayed Before It Even Starts

Chile's government asked its Senate on September 1 to push back the effective date of its flagship data protection law, No. 21,719, by a full year — from December 2026 to December 2027. The proposal, filed as a high-urgency message, isn't industry pushback. The Senate rejected the government's first slate of nominees for the new Data Protection Agency's oversight council back in May, and the legal deadline to appoint them expired in June, leaving the agency legally required to be operational by June 1 with nobody actually running it.[1][3]

The fix on offer isn't just a delay, it's a redesign: the council grows from three members to five, the quorum needed to act rises from two to three, and the government now gets twelve months before implementation to make the first appointments instead of six. The core obligations don't move — 30-day response times for access requests, 72-hour breach notification, impact assessments for AI, safeguards on automated decisions, and penalties up to 20,000 UTM or 4% of annual revenue are all still coming. What changes is enforcement in year one: instead of fines, every company, not just small ones, gets a written warning first, publicly logged in the National Sanctions Registry.[3]

The government's own framing was direct: "We don't want less data protection, we want this legislation to work correctly from day one." I think that's actually the honest version of a pattern I keep seeing this week — Chile isn't weakening the law, it's admitting the enforcement body doesn't exist yet and asking for time to build it before the clock starts. Whether a full year is enough, or whether this becomes the first of several delays, is the thing to watch once 2027 gets closer.[3]

von Marttens → CiberLATAM → Cercai →

AI Governance — Africa (Continental)

A Continental AI Strategy, Two Years In, Still Mostly on Paper

The African Union endorsed its Continental AI Strategy at the Executive Council's 45th session in Accra in July 2024, laying out five focus areas and fifteen recommended actions built around principles like "Local First," human rights, and inclusion, with implementation running 2025 to 2030 — the first two years earmarked just for research, public engagement, and partnerships. Two years in, researchers count only 13 national AI strategies across the continent's 55 member states. Rwanda led in 2019; Kenya was among the most recent, in May 2025.[1][2]

What's notable is why the rest haven't caught up. Researchers who interviewed African government officials found the gap isn't political resistance to AI governance — it's that writing real technical policy takes specialist drafting capacity, institutional design, and dedicated budget lines most governments simply don't have yet. Rwanda's own path backs that up: it built a national Data Revolution Strategy back in 2017, years before its AI strategy, treating data infrastructure as the prerequisite rather than trying to skip straight to AI policy.[1][2]

The sharper critique, from a separate Strathmore University analysis, is that the strategy itself wasn't built with enough input from the people AI governance is supposed to protect — it "did not adequately consider the perspectives of the most vulnerable users," including people with disabilities, women, and rural populations, and lacks real feedback mechanisms for tracking whether implementation reaches them at all. There's a proliferation problem underneath all of it, too: the Continental Strategy is one of several overlapping documents, alongside a separate AUDA-NEPAD white paper and AI Roadmap for Africa — which risks exactly the "policy, not system" problem Lagos officials were describing the same week.[2][3]

CIPESA → CIPIT / Strathmore → Future of Privacy Forum →

Legislation — Southeast Asia

The Under-16 Social Media Wave Spreads, Unevenly

Indonesia's Government Regulation No. 17 took effect March 28, with a transition period running up to two years: under-16s are barred from "high-risk" platforms — YouTube, TikTok, Facebook, Instagram, Threads, X, Bigo Live, and Roblox all named specifically — while under-13s are restricted to child-designed, low-risk platforms only. The compliance list is genuinely detailed: platforms have to run risk self-assessments, set the highest privacy defaults for child accounts, complete data protection impact assessments, and are barred from geolocation tracking or profiling of minors. Non-compliance escalates from written reprimands to fines to full account termination.[2]

Malaysia's version, effective June 1, takes a harder identity-verification approach: anyone 12 or older needs their MyKad national ID to open an account, backed by live facial biometric checks through MyDigital ID, the national digital identity platform already used by 12 million of Malaysia's 35 million residents. NACSA's CEO Megat Zuhairy Megat Tajuddin was careful to note the system "does not require users to submit or store physical ID copies, nor does it store biometric data such as fingerprints or facial images" — though it's still checking your face against a government identity system every time you sign up. Fines for non-compliance run up to RM10 million, about US$2.5 million.[3]

The Philippines is still just debating its version. Three countries, the same underlying problem — platforms full of children with no reliable way to know how old anyone actually is — and three different answers about how much identity infrastructure they're willing to build to fix it. Indonesia is asking platforms to self-assess and self-report. Malaysia is asking every teenager to prove who they are against a national biometric system. Neither approach has been running long enough to know which one actually keeps kids safer, or which one just normalizes handing a face scan to a government database to use an app.[1][2][3]

BERNAMA → CMS Law → Biometric Update →

Lawsuit — United States

Authors Bet They Can Beat Anthropic's Own Settlement

Six authors led by two-time Pulitzer winner John Carreyrou filed suit in late December 2025 in the Northern District of California against six AI companies at once — Anthropic, OpenAI, Google, Meta, xAI, and Perplexity — marking the first copyright suit against both xAI and Perplexity over AI training practices. The complaint accuses all six of sourcing books from piracy platforms including LibGen, Z-Library, and OceanofPDF, then compounding the violation by making additional copies during model training.[1][2]

What makes this suit unusual is what the authors turned down to bring it. All six had already qualified for Anthropic's separate $1.5 billion class settlement, worth roughly $3,000 per work. They opted out anyway, calling that compensation "pennies on the dollar" compared to statutory damages of up to $150,000 per work if willful infringement is proven — a bet that suing six companies individually beats collecting a guaranteed but modest payout from one of them.[2][3]

The company responses tell you something too. xAI dismissed the whole thing as "Legacy Media Lies." Perplexity's Jesse Dwyer said the company doesn't index books at all — even though the complaint specifically alleges Perplexity pulled copyrighted text into its RAG-based search system without authorization, a different claim than "indexing" that Dwyer's statement doesn't actually address. Whether six authors betting on individual damages outperforms a class settlement depends entirely on whether a jury buys "willful" — the difference between $3,000 and $150,000 per book comes down to that one word.[2]

TechCrunch → The Decoder → Publishers Weekly →

Accountability — Netherlands / EU

Uber Fined €825 Million — for Conduct That Ended Four Years Ago

The Dutch Data Protection Authority fined Uber €824.99 million on Friday, August 21 — the second-largest GDPR fine ever issued, behind only Ireland's €1.2 billion Meta fine in 2023 — for automatically deactivating drivers over fraud suspicions or low ratings with no human review, from 2018 to 2022. Deputy chair Monique Verdier: "A computer should not make decisions on its own that have major consequences for you. These decisions should have been looked at first by a human being." The fine works out to 1.85% of Uber's €44.5 billion 2025 turnover, 46% of the statutory maximum the Dutch DPA could have imposed.[1][2]

The case traces back to 171 French drivers who filed a complaint through the Ligue des droits de l'Homme with France's CNIL in 2020. The Dutch authority ended up leading the investigation under GDPR's one-stop-shop mechanism, since Uber's European headquarters sits in the Netherlands — a reminder that where a company happens to incorporate in Europe determines which country's regulator gets to act on a complaint filed somewhere else entirely.[1]

Uber is appealing, disputing that the process was ever fully automated and pointing out it recorded only 126 permanent deactivations across all of Europe in 2021 — arguing the fine is disproportionate to the actual scale of what happened. The penalty is suspended while that plays out. Either way, the timeline is the part I can't get past: the conduct ran from 2018 to 2022, the first complaint landed in 2020, and the fine arrived in 2026. GDPR was in force this entire time. The law wasn't the problem. Six years between a complaint and a decision is.[2][3]

Pearl Cohen → Implicator.ai → Gblock →

Accountability — Uganda

National ID Data Leaked to a Trafficking Ring

Douglas Kaaya, a registration assistant at Uganda's National Identification and Registration Authority, was remanded to Luzira prison on May 6 after a BBC documentary exposed a trafficking network that lured young Ugandan women to Dubai with fake job offers, then trapped them in exploitative labor and prostitution. Prosecutors allege Kaaya used his NIRA access to disclose a specific woman's national ID information — Scovia Nabulime's — to a man named Umar Bashir without authorization, at NIRA's Makindye offices back on December 4, 2024.[1][2]

He's charged under Section 35 of Uganda's Data Protection and Privacy Act, for unlawful disclosure and unlawful processing of personal data without consent — a law that has existed since 2019. Magistrate Asuman Muhumuza deferred Kaaya's bail application over missing identification and a required LC1 chairperson's letter, keeping him remanded while investigators build the case.[1][3]

What actually strikes me about this one is the gap between when it happened and when anyone was charged: the alleged disclosure was in December 2024, and it took a BBC documentary — not Uganda's own data protection enforcement — to surface it publicly before charges followed a year and a half later. The 2019 Privacy Act gave prosecutors a law to charge Kaaya under. It didn't do anything to stop a NIRA employee from allegedly selling a woman's identity data to traffickers in the first place, and it wasn't Uganda's regulator that caught it.[2][3]

Monitor → Eagle Online → The Observer →

AI Governance — Africa (Continental)

"We Don't Lack Policy, We Lack a System That Works Together"

At the Hyperscalers Convergence Africa 2026 conference in Lagos on September 4, a panel called "Governing the Digital Continent" brought together Dr Talkmore Chidede of the AfCFTA Secretariat, Egypt's Amr Safwat, Nigeria's Tony Emoekpere and Gimba Mohammed, and NITDA's Dr Aristotle Onumo, chaired by Chidera Ike-Okonkwo of Nina Jojer. Their shared argument: Africa's problem isn't a shortage of digital policy. The continent already has the Malabo Convention on cybersecurity and data protection, an AU Digital Transformation Strategy, an AfCFTA Digital Trade Protocol, a Data Policy Framework, a Digital Compact, and the Continental AI Strategy from story five. "Africa does not lack digital policy," Ike-Okonkwo said. "What we lack instead is a system in which these policies work together."[1][2]

Their proposed fix is specific: interoperability, not uniformity. Instead of forcing every country onto identical rules, the pitch is common minimum principles, mutually recognized certifications, comparable data classification systems, and standardized approval procedures — national systems keep their own character but become compatible enough to actually function together. On data sovereignty specifically, the panel pushed for risk-based classification instead of blanket data localization requirements, so how sensitive a given category of data actually is determines the control requirements, rather than applying the same rule to everything.[3]

The concrete asks were narrower than the framing: interoperable digital identity systems, cross-border payments infrastructure, trusted data-transfer mechanisms, and — as a starting point — just agreeing on common terminology for classifying data, plus a pilot for mutual recognition between a couple of jurisdictions willing to try it first. It's a modest, unglamorous list next to "governing the digital continent." But given how many countries in story five are still stuck on the capacity to write policy at all, a pilot between two willing jurisdictions might actually be the more realistic starting point than a continent-wide framework nobody has the staff to implement yet.[1][3]

Hyperscalers Africa → BusinessDay NG → Hyperscalers Africa (2) →

— End of Issue No. 4 —

Back to the archive →