Start with the settlement these six authors said no to. Anthropic agreed to pay $1.5 billion to resolve a class action over training its models on pirated books, and a judge found that while training on pirated material was unlawful, the trained models themselves could still be used legally[1]. Eligible authors and publishers get roughly $3,000 per work out of that pool, spread across an estimated 500,000 titles.

A group led by John Carreyrou — the journalist who broke the Theranos story and wrote "Bad Blood" — looked at that number and opted out[1]. Opting out of a class action means giving up your guaranteed share of the settlement in exchange for the right to sue on your own. It's a real bet: you're trading a certain $3,000 for the chance at something bigger, with real legal fees and real odds of getting nothing.

What they're actually asking for is $150,000 per title, per defendant, under the Copyright Act's statutory damages provision — and they didn't stop at Anthropic. The new suit, filed in the Northern District of California, names Anthropic, OpenAI, Google, Meta, xAI, and Perplexity, and as far as I can tell it's the first copyright case either xAI or Perplexity has faced over how they trained their models[2]. The complaint accuses all six of pulling books from the same pirate libraries — LibGen, Z-Library, OceanofPDF — to train their systems without permission or payment[2].

The line from their filing that stuck with me: the earlier settlement "seems to serve [the AI companies], not creators[3]." That's a pointed thing to say about a $1.5 billion deal, and I think the underlying argument is actually simple. $3,000 per work, spread across hundreds of thousands of authors, adds up to a huge total number, but it's a number the AI companies can treat as a fixed, absorbable cost of doing business — a line item, not a deterrent. $150,000 per title, times six separate defendants, times however many books each of these authors has published, is a completely different order of magnitude. It's the difference between a settlement that closes the book on a practice and a number big enough to actually change what a company decides is worth doing next time.

I don't know yet whether a court will actually award anything close to $150,000 a title — statutory damages ranges are wide, and juries and judges land all over them. But I think the fact that six authors, one of them a Pulitzer winner with real leverage of his own, looked at a $1.5 billion class settlement and decided it undervalued what happened to their work is itself the story. It's a genuinely open question whether the system built to handle mass copyright harm at scale — the class action, the negotiated settlement, the flat per-work payout — is actually built to make anyone whole, or just built to make the problem go away for a fixed price. These six authors are betting it's the second one, and betting they can do better outside it.

Indonesia moved first. Its Minister of Communication and Digital Affairs issued Government Regulation No. 17 on March 6, 2026, and it took effect March 28[1]. The law bars anyone under 16 from having an account on a platform the regulation classifies as "high-risk" — YouTube, TikTok, Facebook, Instagram, Threads, X, Bigo Live, Roblox — where "high-risk" has an actual legal test behind it: does the platform facilitate contact with strangers, expose kids to harmful material, treat children as a revenue source, threaten their personal data, or risk addiction and psychological harm[1]. Under-13s get an even narrower lane: child-designed educational platforms only. Companies that don't comply face a real escalation ladder — written reprimand, then administrative fines, then temporary suspension, then outright termination of access[1]. Indonesia gave itself up to two years to phase the whole thing in, but the law itself, and the consequences for ignoring it, were live from day one. Around 70 million Indonesian children are covered by this.

Malaysia followed on a slower clock. Enforcement of its own under-16 restriction started June 1, 2026, and it leans on infrastructure Indonesia didn't build: MyKad, the national smart ID card, combined with live facial verification through MyDigital ID, the government's digital identity platform[2]. New accounts have to be checked against official National Registration Department records before they're created. The rules apply to any platform with at least 8 million Malaysian users — which is basically every major one — and the regulator is deliberately not mandating one specific technology, calling its approach "technology-neutral and outcome-based"[2]. Platforms that don't verify age face fines up to RM10 million.

The Philippines hasn't done either of those things. It's still in the debate stage[3].

Here's what actually gets me about laying these three next to each other: nobody disagrees about the goal. Every country in this region has looked at the same evidence about kids and social media and landed on the same basic answer — under 16 shouldn't be on these platforms unverified. What's different isn't the politics, it's the machinery. Indonesia had a regulation ready to sign in March. Malaysia had a national digital ID system it could repurpose by June. The Philippines, as far as I can tell, doesn't yet have either the political consensus or the technical infrastructure lined up, so "still debating" is where it's stuck.

I think this is worth sitting with because it's such a clean small-scale version of something I keep noticing at a much bigger scale: agreeing on a rule and being able to actually run a rule are two completely different projects, and the second one is usually the harder, slower, more expensive one. Indonesia and Malaysia didn't get here because they cared more about kids than the Philippines does. They got here because one had a regulation-drafting process ready to move, and the other had a national ID system already built for something else that it could point at a new problem. Neither of those things happens overnight, and neither of them is really about willpower.

If your country hasn't done anything here yet, that's genuinely the more common position worldwide, not the exception — I've built this question directly into the Digital Rights Atlas, and for most of the 195 countries I've covered, there's nothing on the books about verified consent for minors on social media at all.

Check where your own country lands at rowataha.com/digital-rights.html.

Meta's chief legal officer put the reasoning plainly: "Because teens move fluidly across dozens of apps, we need an industry-wide solution[2]." That's true, and it's also convenient — a rule that only binds Meta while everyone else keeps running their apps the old way is a competitive disadvantage Meta would rather not carry alone.

So who's actually going to join? Here's where I think the three platforms split into genuinely different situations, not one bloc making one decision.

TikTok has already said no, publicly, in the most concrete way available: it rejected Meta's own ad campaign asking it to sign on, telling Meta on September 9 that the ads violated TikTok's policy against running "political content[3]." I don't think that's really a content-policy dispute. TikTok is already fighting for its ability to operate in the US at all under separate divestiture pressure — the last thing it needs is to publicly hand ammunition to people arguing it's an irresponsible platform for kids, but it also has every reason not to let Meta dictate the terms of that admission through a paid ad campaign. Rejecting the ad is a cheap way to reject the framing without formally rejecting the underlying safety changes yet.

Snap looks different. Reporting on the settlement specifically notes Snap "appears poised to settle" and, tellingly, isn't mentioned in Meta's public pressure campaign the way TikTok and YouTube are. My read: Snap is smaller, has less leverage to spend fighting this, and is already facing its own state enforcement actions and investigations independent of Meta's settlement[1]. For Snap, matching terms probably looks less like capitulating to a rival and more like the cheapest way to close out its own separate legal exposure.

YouTube is the one I think is genuinely uncertain. It's named in the same contingency language as TikTok and Snap, and it's facing the same kind of state scrutiny, but Google has historically preferred negotiating its own settlements on its own timeline rather than getting pulled into a framework a competitor built. I'd watch YouTube's own state investigations for the real signal, not anything Meta says about it.

If I had to bet: Snap joins, because it has the least to lose and the most immediate legal pressure to relieve. YouTube negotiates something adjacent but probably not identical to Meta's exact terms. And TikTok holds out the longest, not because it disagrees with two-hour limits or midnight curfews, but because agreeing to Meta's framework, on Meta's timeline, while Meta runs ads about it, costs TikTok something Snap doesn't have to worry about losing: the appearance of independence at the exact moment its independence is already the thing under threat.

Worth watching: whether any state actually moves to enforce the contingency by suing TikTok or YouTube directly if they don't sign on, since that's the point where "please join our settlement" turns into its own separate legal fight.

As of August 2, 2026, Article 50 of the EU AI Act is fully enforceable, and it does something I think is more fundamental than people give it credit for: if a piece of audio, video, image, or text was generated or manipulated by AI, it legally has to say so[1]. Deployers have to visibly label deepfakes, providers have to build in machine-readable markers like watermarking or metadata at the point of creation, and here's the part I didn't expect, the rule applies even when nobody meant to deceive anyone[2]. Content that looks or sounds like a real person needs a label whether or not there was any intent to trick you, and whether or not a real person is even depicted. The fines back it up too, up to €15 million or 3% of a company's global revenue, whichever number actually hurts more[1].

I've been sitting with this for a few days now, and I keep landing in the same place: in 2026, the right to know whether something is AI-generated is right up there with the right to privacy over your own information. Maybe more urgent, honestly. Privacy violations happen to you. A convincing fake happening to your understanding of reality happens to everyone watching it, whether or not they're the subject.

And I don't think that's dramatic. We're at the point where "is this real" is a question people have to ask about a video of a politician, a voice note from a family member, a product review, a piece of breaking news. The EU just said: for content inside our borders, you don't have to guess anymore, the platform has to tell you. That's not a small thing. That's a floor under reality itself, and most of the world doesn't have one yet.

The European Commission's own Code of Practice frames this as giving people the tools to tell human content from synthetic content at a glance, an "AI" or equivalent icon standard is coming EU-wide[3]. It's not perfect, watermarking can be stripped, metadata can be scrubbed by a determined bad actor, but as a legal baseline that platforms and providers have to build toward, it's the most concrete thing I've seen any government do on this specific question.

So here's what I actually want you to do with this post: go check whether your own country requires AI-generated content to be labeled. I built exactly this question into the Digital Rights Atlas, twenty questions, cited, country by country, and "is AI-generated content required to be labeled" is one of them. Most countries right now will answer no. I think that's worth knowing before the next viral video crosses your feed.

Check your country at rowataha.com/digital-rights.html.

Here's what actually counts as a violation, because "burying" disclosure is doing a lot of work in these complaints and I think it's worth being specific about what that means. A tiny "#ad" hidden at the bottom of a caption, below a wall of hashtags nobody scrolls to. A disclosure only inside a video nobody's watching to the end. Relying entirely on a platform's built-in tag, like Instagram's "Paid Partnership" label, instead of saying it plainly in the creator's own words within the actual content. The FTC has been explicit that the platform-native tools don't satisfy the requirement on their own, they can supplement a real disclosure, they can't replace one[1].

What's new in the 2026 wave specifically is who's on the hook. Enforcement used to focus almost entirely on brands. Now individual creators are being named directly, at scale, not just the companies paying them[1]. And the definition of what counts as a paid endorsement keeps widening too, it's not just a sponsored post anymore, reposts, tags, and even likes can count as an endorsement requiring disclosure under updated guidance[1].

I think the throughline here connects to something bigger than influencer marketing specifically. It's the same basic question as data breach notification or AI content labeling: do you actually have a right to know when you're being sold something, versus told something honestly? An influencer's genuine opinion and a paid placement dressed up as one look identical from the outside. The only thing that tells them apart is disclosure, done clearly, not buried.

This is also, structurally, a state-by-state question in practice, since a lot of the private class actions are being brought under individual state consumer-protection statutes, not just federal FTC authority. I built exactly this into the Digital Rights Atlas, whether influencers in a given state actually have to register or disclose paid promotions, cited and compared.

Check your state at rowataha.com/usa-rights.html.

So when the IDScan story broke this week, I went looking for the actual reason that keeps happening, and it's not what I expected.

Here's the news part first. IDScan, a Louisiana-based ID-verification vendor used by everything from entertainment venues to cannabis dispensaries to check customers' identity documents, disclosed on September 4 that it had detected unauthorized access to its systems around September 1[1]. It confirmed the breach involved more than 150 million driver's licenses and other government-issued IDs, full names, license numbers, passport numbers, stolen from a company most of the people affected had never directly interacted with or even heard of[1]. Brian Krebs first reported it after a dark-web platform started advertising access to over 153 million stolen US and Canadian driver's license scans. The FBI is investigating. Nine class-action lawsuits have already been filed[3].

That detail, that most affected people never had a direct relationship with IDScan, is actually the whole story. You didn't sign up for their service. Some business you used, a venue, a store, a landlord, ran your ID through them to verify you, and that's how your data ended up sitting in a vendor's cloud you never chose and never agreed to. There's no company you can point to and say "I trusted you with this," because you didn't, not knowingly.

So back to why I never got notified about my own breach. It turns out all 50 US states have data breach notification laws, but they are genuinely not the same law copy-pasted fifty times. Foley & Lardner's own legal analysis is blunt about it, a one-size-fits-all approach to notification will not work, because states differ on what triggers a legal breach in the first place, what has to be in the notice, how fast it has to go out, and what penalties apply if a company blows the deadline or skips it entirely[2]. So whether you get told your ID or your data was compromised depends less on what actually happened to your information and more on which state's notification law happened to apply to the company that lost it.

That's the part that actually bothers me. The harm to you is the same regardless of your zip code. The chance you find out about it isn't.

If you want to know exactly what your own state actually requires, whether a company even has to tell you when your data gets breached, and how fast, I built that straight into the state-by-state Digital Rights Atlas.

Check your state at rowataha.com/usa-rights.html.

On February 10, 2026, India's Ministry of Electronics and IT notified an amendment to the IT Rules, 2021, creating a formal legal category called "synthetically generated information," or SGI, covering any audio, image, video, or combination of them that was created or altered algorithmically to look or sound like a real person or a real event[1]. Effective February 20, 2026, all of that content has to carry a visible disclaimer plus permanent provenance metadata baked in, and platforms have to run automated detection tools to catch it[1].

Here's the part that actually stopped me. If a platform gets a valid takedown request for illegal synthetic content and doesn't act within three hours, it immediately loses its Safe Harbor protection under Indian law[1]. Three hours. Not three days, not "reasonable time," a number small enough that it basically forces platforms to build automated response systems instead of relying on human moderators reviewing a queue. Freshfields' analysis of the amendment calls out how far this goes beyond what most jurisdictions have attempted, this isn't a labeling suggestion, it's a structural compliance obligation with a deadline that can end a platform's legal protection if missed[2].

Every intermediary operating in India, social platforms, video sites, messaging apps, hosting providers, and AI tools themselves, has to revisit its entire compliance posture against this[3]. That's a genuinely huge lift for anyone operating at scale in a country with over 800 million internet users.

I keep coming back to the tradeoff buried in this. A three-hour window is fast enough to actually matter, a deepfake that goes viral usually does most of its damage in the first few hours, so speed is the right instinct. But it also means platforms have every incentive to over-remove anything that looks remotely synthetic rather than risk their Safe Harbor status, which is its own kind of chilling effect, just aimed at content moderation instead of at government critics directly. I don't think there's a clean answer here. I think it's worth watching how Indian platforms actually implement this over the next few months, whether the automated detection tools are accurate enough not to sweep up real content by mistake.

Either way, this is now one of the most concrete AI-labeling laws on the books anywhere, and I think it's worth knowing whether your own country has anything close to it.

Find out at rowataha.com/digital-rights.html.

Start with India. In July 2026, telecom companies cut mobile internet around Delhi's Jantar Mantar, where protesters were demanding accountability over leaked NEET medical entrance exam papers. The shutdown ran in a 1.5-kilometer radius, on and off, from July 21 to 25[3]. It's now in front of the Delhi High Court, on an urgent public interest litigation, with the Internet Freedom Foundation arguing the shutdown broke the safeguards the Supreme Court laid out in a 2020 ruling and violated the government's own 2024 telecom suspension rules[3]. That's the best-case version of this story, a legal system actually being asked to check the government's power in real time.

Uganda didn't get that check. Two days before its general election in January 2026, the Uganda Communications Commission ordered a full shutdown of internet and mobile networks, and separately ordered Starlink, which doesn't even have an operating license there, to block its terminals, while threatening anyone caught using a VPN[2]. Civil society groups ran a #KeepItOn campaign begging the government to reconsider. It didn't. The blackout lasted five full days, through the entire election[2].

Sudan's version is a war story, not an election story. Three nationwide shutdowns hit the country in 2025 as the Sudanese Armed Forces and the Rapid Support Forces both tried to control what information got out. At one point, mobile internet was blocked during national school exams. Separately, RSF forces reportedly used Chinese-made drones and jamming equipment to knock out Starlink and mobile service in El-Fasher, the capital of North Darfur, right before an attack that finally broke the government's hold on the city[1]. When a shutdown becomes a tactic used mid-battle to blind the other side, "inconvenience" stops being the right word for what this is.

Access Now's tracking makes the pattern impossible to miss, this isn't a handful of isolated incidents, it's a recurring move governments reach for specifically because it works, it's hard to challenge in real time, and by the time a court gets involved, the moment it was meant to control has usually already passed[1].

So here's the actual question worth asking, wherever you live: is there a legal limit on your own government's power to do this to you? I built that exact question into the Digital Rights Atlas, cited, country by country. For a lot of places, the honest answer right now is no, or a limit so vague it doesn't really hold. I think you should know which one your country is before you ever need to find out the hard way.

Check yours at rowataha.com/digital-rights.html.

Here's what actually happened. On July 3, 2026, veteran Malaysian journalist P. Gunasegaram published a piece on his own site, KINIBIZ, questioning the costs and delays on the LRT3 Shah Alam rail line, and shared it on Facebook[1]. That's it. That's the article. Malaysian Resources Corporation Berhad, the company behind the project, and its executive vice-chairman Salim Fateh Din, filed suit in the Shah Alam High Court on July 29, seeking RM100 million, about US$24.45 million, in damages, plus an injunction ordering Gunasegaram to take the article down and barring him from publishing anything similar[1]. They're arguing the piece falsely implied the project was awarded through cronyism and that it hurt the company's share price.

He's defended it as fair comment and refused to retract or apologize[1]. And this is where the story becomes bigger than one company and one journalist. The Committee to Protect Journalists publicly called on MRCB and Salim Fateh Din to withdraw the suit, describing the RM100 million figure as "excessive" and naming it directly as an example of the kind of legal action meant to punish, not to genuinely seek accountability for reputational harm[2]. That's the textbook definition of a SLAPP, a Strategic Lawsuit Against Public Participation, a suit filed less to win in court and more to make the cost of speaking up so high that nobody does it again.

What strikes me about this specific case is the scale mismatch. A major listed company with a vice-chairman backing it, going after one columnist over one piece of financial commentary, seeking damages large enough to end most journalists' careers regardless of whether the underlying claims about cronyism were even provable. Malaysiakini's coverage of the case lays out just how directly this ties to a specific infrastructure project people are entitled to ask questions about, public transit spending is about as legitimate a subject for scrutiny as journalism gets[3].

Most countries don't have a real answer to this. An anti-SLAPP law, a legal mechanism that lets a journalist get an obviously retaliatory suit thrown out fast, before it bankrupts them in legal fees alone, is still rare. I built that exact question into the Digital Rights Atlas, whether journalists in a given country are actually protected from being sued into silence, and for most of the 195 countries I've covered, the honest answer is no protection exists at all.

Check whether your own country has one at rowataha.com/digital-rights.html.

Abubakar Salim Musa had been posting criticism of a government official on social media from Gusau, the capital of Zamfara State in northwest Nigeria. Police from the Gusau Central Police Command started monitoring him over those posts[1]. Then, while he was staying in Abuja, heavily armed security personnel tracked him down to Sounders Suites hotel in the Apo Legislative Quarters and took him into custody[1]. No formal invitation, no complaint filed against him, no allegation of a crime presented before the arrest. His lawyers reached out to police for clarification once they heard he was under surveillance and got no response[1].

He was held at a detention facility nicknamed "Abattoir," a site past detainees have reportedly described as a place where torture occurred[1]. For posts criticizing a government official. That's the whole offense.

Amnesty International came out directly against it, calling the arrest arbitrary, unlawful, and a blatant violation of his right to freedom of expression, and demanding his immediate, unconditional release, stating plainly that "no one should be punished for criticising a government official"[2]. Sahara Reporters' coverage adds that opposition figures, including former Vice President Atiku Abubakar, publicly called for his release too, which tells you this wasn't read as a fringe civil-liberties complaint, it registered as a real political flashpoint[3].

I want to be direct about why this matters beyond one case. A surveillance operation targeted at someone's social media posts, followed by a warrantless-feeling detention with no charge presented up front, is the exact pattern that makes "just don't post anything critical" the rational move for anyone watching this happen to someone else. That's not an accident. That's often the point.

Here's the question I think is actually useful to ask yourself: could this happen to you, legally, where you live? Not "would it be wrong," obviously it would, but is there an actual legal protection standing between you and this outcome, or is it just discretion and hoping the wrong person doesn't notice your posts? I put that exact question into the Digital Rights Atlas, whether you can be criminally charged for criticizing your government online, cited, country by country.

Find out where your country stands at rowataha.com/digital-rights.html.

In January 2026, Elon Musk backed accusations that the UK is behaving like a fascist state, pointing directly at a figure that had already been circulating: over 12,000 people arrested for social media posts. The comment landed in the middle of a broader fight over a potential X ban and rising tension around British speech law generally[1].

So where did the number come from? A Freedom of Information investigation by The Times, filed with 35 of the UK's 43 police forces, found that more than 12,000 people were arrested in 2023 under two specific laws, section 127 of the Communications Act 2003 and section 1 of the Malicious Communications Act 1988, both of which cover things sent online, not exclusively social media, but that's most of what falls under them in practice. That works out to roughly 33 arrests a day for something somebody typed.

Here's the part that matters and gets lost in the viral version. Arrests aren't convictions. Independent fact-checking on the figure found that only a small fraction of those 12,000-plus arrests, roughly in the low thousands or fewer, actually resulted in conviction under those same statutes, and far fewer still led to any custodial sentence[3]. So the headline number is real, it's not exaggerated or made up, but "arrested" and "prosecuted and found guilty" are very different outcomes, and a lot of commentary flattens that difference because the bigger number is more dramatic.

That said, I don't think the smaller conviction number makes this a non-story. Freedom House's own independent assessment of the UK's internet freedom lists exactly this pattern, broad law enforcement discretion to arrest over online speech, as a documented concern in its country report, separate from and before Musk ever weighed in on it[2]. Civil liberties groups like Big Brother Watch have been raising it as a chilling-effect problem for years, the argument being that even an arrest that goes nowhere still costs someone their phone, their time, a police record entry, and very possibly their willingness to post anything remotely edgy again. Being investigated is already a punishment, even when it never becomes a conviction.

I think both things are true at once here: the "12,000 arrested" framing overstates how many people actually faced consequences, and the underlying pattern of broad arrest powers over online speech is a real, independently documented issue that predates the viral moment. Neither version cancels the other out.

If you want to know what the actual legal consequences for online speech look like where you live, cited and compared country by country, that's exactly what I built the Digital Rights Atlas for.

Check it out at rowataha.com/digital-rights.html.

Here's what the UK just did. On June 15, 2026, the government announced a full ban on social media use for anyone under 16[1]. It's more aggressive than Australia's earlier version too, blocking specific functions like livestreaming and messaging with strangers, not just account creation[2]. A month later, on July 15, the government added a second layer: default overnight curfews, midnight to 6am, automatically switched on for 16 and 17 year olds across social apps, along with turning off the features specifically designed to keep people scrolling longer[2]. The legal mechanism running underneath all of this is the Children's Wellbeing and Schools Act 2026, which slots a new section directly into the existing Online Safety Act 2023[2].

None of it is law yet, to be precise about where things actually stand. The regulations still need approval from both Houses of Parliament, and the government's own target is to have them in force by spring 2027[1][2]. In the meantime, Ofcom has been asked to run a rapid study on what actually counts as effective age verification for confirming someone is over 16, due by the end of October 2026[2], which is its own genuinely hard problem, since most age-verification methods either don't work well or require handing over more personal data than feels proportionate to the risk you're trying to prevent.

I don't think this is a simple good-news story, and I don't want to write it like one. Age verification systems create their own privacy exposure. A ban this broad will get worked around by plenty of teenagers the same way every previous restriction has. But I also think it's genuinely significant that a government looked at the current state of kids' social media use and decided the answer wasn't another advisory panel, it was actual binding law with actual mechanisms behind it, curfews that are on by default rather than opt-in, functions disabled rather than merely discouraged.

That's rare. Most countries haven't done anything close to this. I built the question directly into the Digital Rights Atlas, whether minors need verified parental consent or age assurance for social media, cited, country by country, and for most of the 195 countries I've covered, there's genuinely nothing on the books.

Check where your own country lands at rowataha.com/digital-rights.html.

Expect commentary on the stories behind the stories: why a particular enforcement action matters more than it looks, what a new law actually changes versus what it just claims to change, and where I think the field of tech policy is getting something wrong.

If you want the fast-moving weekly roundup, that's the Newsletter. This is the slower, more opinionated companion to it.