Privacy

Blank Rome LLP, a Philadelphia-based law firm, faces two proposed class-action lawsuits over a data breach that exposed sensitive information on 57,554 current, former, and prospective clients. The breach occurred in May 2026 when a cybercriminal impersonated the firm's IT department and convinced an attorney to upload client files to an external Google Drive account. The exposed data includes names, Social Security numbers, addresses, dates of birth, driver's license numbers, passport numbers, medical records, and health insurance information. Blank Rome announced the breach to affected clients on June 26, 2026—nearly a month after the incident occurred. The firm stated it will "aggressively defend" against the suits and claims they lack merit.

Twenty-six current and former Meta employees filed a federal lawsuit Monday in the U.S. Northern District Court of California alleging the company used artificial intelligence systems to systematically target workers with disabilities or those on protected medical, parental, or family leave during its May 2024 mass layoff. The plaintiffs claim Meta replaced managerial discretion with AI-driven metrics—including productivity scores, keystroke monitoring, and AI token consumption data—to generate termination lists, effectively penalizing employees for approved absences. The complaint names specific tools including Metamate, Meta's internal AI assistant, and employee-built monitoring dashboards that allegedly recorded absences as "disengagement" and suppressed performance ratings. One plaintiff was terminated while on approved pre-birth leave; another alleges a manager discouraged medical leave by warning that leadership would "definitely" fire them if they took it.

TikTok Shop is being flooded with AI-generated product demonstrations, fake creator personas, and duplicate avatars that are undercutting human creators and eroding consumer trust. Merchants and affiliate creators are using TikTok's built-in AI tools to mass-produce makeup tutorials, clothing reviews, and product showcases without holding inventory—a low-cost strategy that prioritizes algorithmic reach over authenticity. Some operators have deployed synthetic personas, including a fabricated Black creator named "Aliyah," to sell dropshipped goods from retailers like Shein, exploiting algorithmic biases that reward emotional connection to creators.

Traci Tamiko Eto, former research director at Mayo Clinic, filed a federal lawsuit on July 6, 2026, alleging retaliation and wrongful termination after she raised concerns about AI safety failures and patient privacy violations. According to the complaint, Eto was demoted in July 2025, placed on involuntary medical leave, and fired in December 2025 when her position was eliminated in a reduction in force that reportedly affected only her role. The suit was filed in U.S. District Court for the District of Minnesota under the False Claims Act's retaliation provision, the Americans with Disabilities Act, and the Family and Medical Leave Act.

The Department of Justice announced the sentencing of two U.S. nationals for operating a multiyear scheme that deployed North Korean IT workers under stolen American identities to infiltrate over 100 U.S. companies. Kejia Wang, 42, and Zhenxing Wang, 39, used at least 80 fraudulent identities to secure remote positions across the corporate sector, generating more than $5 million in illicit revenue for the DPRK regime. The operation relied on "laptop farms"—physical U.S.-based facilities hosting computers that allowed overseas workers to bypass location-based security checks, making employers believe they were hiring domestically based remote staff.

The United Nations released the International AI Safety Report 2026, a comprehensive assessment concluding that advanced artificial intelligence presents both transformative opportunities and escalating dangers. The report, led by the UN agency for digital technology, finds that AI can accelerate development in health, education, and financial services in developing nations while simultaneously enabling cyberattacks, deepfake fraud, non-consensual intimate imagery, and biological weapon design. The core finding: AI capabilities in critical fields like biological research are advancing faster than governance frameworks, creating a dangerous gap between what is technologically possible and what remains safe.

In early 2026, the Trump administration ordered all federal agencies to cease using Anthropic's Claude AI models and designated the company a "Supply-Chain Risk to National Security" under the Federal Acquisition Supply Chain Security Act. The conflict originated when the Department of Defense demanded unrestricted access to Claude for "all lawful purposes," including potential use in autonomous weapons and domestic surveillance. Anthropic refused, citing civil liberties and human rights concerns. On February 27, President Trump issued an immediate cease directive with a six-month phase-out period. By March 5, the DOD's supply-chain designation took effect, barring military contractors from any commercial activity with Anthropic and removing the company from federal procurement systems.

The Federal Trade Commission has opened a public comment period on a proposed policy statement addressing AI companies' manipulation of system outputs to serve undisclosed ideological objectives. The FTC asserts that such conduct violates Section 5 of the FTC Act by constituting unfair or deceptive practices that undermine consumer expectations for accuracy and objectivity. Comments are due by July 31, 2026, and will be published on Regulations.gov. FTC Chairman Andrew N. Ferguson authorized the notice with a 2-0 vote and invited feedback from businesses and consumers about their experiences with AI system manipulation.

A U.S. bankruptcy judge has approved a $46.75 million settlement to compensate victims of 23andMe's 2023 data breach, resolving claims after the genetic testing firm exposed the genetic data of nearly 6.9 million people worldwide. U.S. Bankruptcy Judge Brian Walsh in St. Louis ordered Chrome Holding—the entity that acquired 23andMe following its bankruptcy filing—to disburse the funds through Kroll Restructuring within five days.

Vendor contracts are being urgently reclassified as AI risk vectors. In 2026, corporate counsel are discovering that SaaS and AI vendors have embedded contractual language permitting them to train, fine-tune, and evaluate proprietary models on customer data without explicit consent. What vendors historically labeled "service improvement" provisions are now recognized as mechanisms for secondary data exploitation. Law firms including Kilpatrick Townsend, Consilium Law, and SiLaw have published redlining guides instructing clients to demand explicit "no training," "no commingling," and "no retention" clauses in master service agreements.

Anthropic embedded undisclosed geolocation tracking code in Claude Code designed to identify Chinese users and report their location to company servers without consent. Security researchers discovered the steganographic markers across multiple versions of the coding assistant, flagging them as high-risk software. Alibaba responded by imposing an enterprise-wide ban effective July 10, 2026, citing "back-door risks" and security vulnerabilities in an internal notice.

A federal judge in California has denied Meta Platforms' motion for summary judgment, clearing the way for a multistate lawsuit over youth mental health to proceed to trial in August 2026. The ruling, issued June 29 by the U.S. District Court for the Northern District of California, rejects Meta's attempt to have the case dismissed and confirms that the attorneys general's claims have sufficient legal merit to survive pretrial scrutiny.

The Department of War terminated its $200 million partnership with AI firm Anthropic on February 27, 2026, after the company refused to remove safety restrictions on its Claude model for military use. Defense Secretary Pete Hegseth had issued a three-day ultimatum on February 24 demanding Anthropic disable all guardrails. When CEO Dario Amodei declined, Hegseth designated Anthropic a "supply chain risk," and President Trump issued a presidential order barring all federal agencies from using Anthropic's systems. The dispute centered on two non-negotiable demands from Anthropic: no fully autonomous lethal weapons and no mass surveillance of Americans.

Blank Rome LLP, a Philadelphia-based national law firm, faces a proposed class action lawsuit alleging it failed to protect sensitive client data after a May 2026 social-engineering attack compromised information on over 57,000 individuals. An unauthorized third party impersonated IT staff and tricked a Blank Rome attorney into uploading confidential files to an external Google Drive account, exposing names, Social Security numbers, and potentially financial and medical records. The lawsuit names Blank Rome as defendant and alleges violations of common law, industry standards, the Federal Trade Commission Act, and HIPAA due to inadequate cybersecurity safeguards and delayed notification.

The FTC's proposed consumer-protection framework would not permit AI companies to use compliance with state AI laws as a defense against federal deception claims, according to recent analysis. This creates a direct conflict between federal and state enforcement regimes at a moment when AI governance is fragmenting across jurisdictions. Colorado's SB24-205 is already in effect, while California, New York, and Illinois have enacted or proposed their own AI transparency and deployment rules, forcing companies to navigate overlapping and potentially contradictory obligations.

Healthcare AI developers face a three-front legal challenge that requires coordinated planning from product inception, not sequential problem-solving after development. Patent counsel, FDA regulators, and HIPAA compliance teams must align on strategy before the first commercial release, according to a MedCity News analysis. The core tension is structural: companies must lock down product specifications early enough for FDA review while maintaining the technical flexibility that makes AI valuable, document human inventorship to satisfy patent law, and design data systems that support model monitoring and retraining without violating privacy rules.

New York legislators are advancing two bills that would impose distinct compliance obligations on businesses using artificial intelligence. Assembly Bill 3411B would require any user of generative AI systems to display a clear notice on the interface warning that outputs may be inaccurate. Assembly Bill 9581B targets employers and businesses using AI in hiring and workforce management, mandating annual reports to the New York Department of Labor detailing AI's impact on employment—including estimates of displaced workers, reduced hours, and unfilled positions. Businesses that fail to submit the required report by March 1 face civil penalties of up to $500 per day.

A coalition of 42 state attorneys general, led by Washington AG Nick Brown, announced a settlement with 23andMe's bankruptcy trustee on July 14 resolving claims over a 2023 data breach that exposed genetic data of more than 220,000 Washington customers. Washington will receive approximately $500,000 as part of the multistate agreement, which addresses the company's failure to safeguard sensitive user information.

An advisory article cataloging eight high-risk uses of AI assistants like ChatGPT and Claude has highlighted the gap between widespread adoption and user safety guidance. The piece identifies specific domains where these large language models pose unacceptable risk: legal and compliance decisions, hiring or termination calls, medical diagnostics, and generation of final financial figures. The core problem is familiar—LLMs hallucinate statistics and present false information with unwarranted confidence—but the article emphasizes a secondary issue: AI providers themselves offer little guidance on what users should avoid, leaving organizations to independently identify pitfalls around data privacy, accuracy requirements, and inappropriate outputs.

The federal judiciary has established a clear constitutional prohibition on federal grant termination based on recipients' involvement with Diversity, Equity, and Inclusion initiatives. The Southern District of New York ruled in the ACLS case that the government's withdrawal of DEI-related humanities grants violated both the First Amendment and the Fifth Amendment's Equal Protection Clause, characterizing the actions as "textbook examples" of unconstitutional discrimination. Courts in the Northern District of California and elsewhere have reached similar conclusions, blocking the Department of Justice and Department of Education from enforcing new DEI-related conditions on community policing grants and other federal funding.

Artificial intelligence has fundamentally altered the employment landscape by enabling employers to reconstruct comprehensive digital histories of workers—including deleted posts, archived social media accounts, and browsing activity—making attempts to obscure past behavior a potential liability rather than a privacy safeguard. AI monitoring platforms including Teramind, Controlio, ActivTrak, and Worklytics now track keystrokes, screen activity, website visits, and sentiment analysis across workplace communications. When employees attempt to sanitize their online presence, algorithms frequently flag these deletions as suspicious activity, potentially triggering hiring rejections or termination.

On July 1, 2026, the Federal Trade Commission issued a proposed policy statement applying Section 5 of the FTC Act to AI companies that manipulate their systems' outputs contrary to consumers' reasonable expectations for truth and accuracy. The FTC is accepting public comment through July 31, 2026. The Commission voted 2-0 to authorize the Federal Register notice.

The Department of Justice announced the establishment of an Artificial Intelligence Litigation Task Force on January 9, 2026, formalizing AI's role in federal legal operations. The Task Force will oversee how the DOJ integrates AI into litigation workflows, marking an institutional shift from experimental adoption to regulated practice. The move reflects broader industry momentum: legal technology firms including Esquire Solutions, Baker Botts, and Lexis+ AI are now advising law firms on AI-assisted discovery and technology competence as standard practice rather than competitive advantage.

Enterprise buyers, AI vendors, and system integrators are converging on a recognizable contract template for AI services. The emerging standard includes shorter terms (often capped at 12 months), no automatic renewals, customer-controlled pilots, strict limits on data use for training, explicit output ownership, and tighter indemnity and audit provisions. The shift reflects a market-wide negotiation playbook rather than a single deal or regulatory mandate, though compliance frameworks like the EU AI Act and NIST are being mapped into contract language to define risk and governance obligations.

Employees are increasingly requesting religious accommodations to avoid using artificial intelligence tools at work, forcing employers to navigate exemption requests under tightened legal standards. The shift marks a departure from earlier AI workplace concerns centered on algorithmic bias and efficiency, introducing a novel religious accommodation issue that implicates federal employment law.

Bracewell LLP has hired Dina McLeod as a partner in its New York government enforcement and investigations practice. McLeod, who spent 11 years at the U.S. Attorney's Office for the Southern District of New York, most recently served as chief of the Complex Frauds and Cybercrime Unit. In that role, she oversaw investigations and prosecutions involving white-collar crime, cybercrime, AI-related fraud, cryptocurrency schemes, digital assets, money laundering, securities fraud, trade secrets theft, tax fraud, healthcare fraud, bankruptcy fraud, FCPA violations, and national security cyber cases.

Anthropic announced a $20 million additional donation to Public First Action, a 501(c)(4) political advocacy group, bringing its total commitment to the organization to $40 million. The funding supports Public First Action's efforts to back candidates and advocacy campaigns favoring AI regulation, transparency, and safety measures. Public First Action has supported candidates across party lines, including Republicans Marsha Blackburn and Pete Ricketts, who have advocated for stronger AI safeguards. Anthropic stated the money is intended to advance policy debate rather than directly support individual candidates.

On July 1, 2026, the UN's Independent International Scientific Panel on Artificial Intelligence released a preliminary report warning that unregulated AI development is outpacing both scientific understanding and government policy, with no guarantee against catastrophic harm. Led by UN Secretary-General António Guterres and computer scientist Yoshua Bengio, the panel identified specific risks: loss of control over autonomous systems, deceptive AI behaviors, and exploitation for fraud, cyberattacks, and biological threats. The report notes that AI already demonstrates expert-level reasoning in mathematics and science, with task complexity doubling every four to seven months, while current models trained on only a fraction of the world's 7,000 languages produce dangerous errors in health diagnoses for many populations.

Apple Intelligence, the company's on-device generative AI service, has received official registration from China's Cyberspace Administration of China (CAC), clearing the path for deployment on iPhones in mainland China. The filing, submitted by Apple Technology Development (Shanghai) Co., Ltd., was approved on July 8 and publicly confirmed by the CAC on July 15 as part of a batch of seven approved mobile AI models. The approval ends a regulatory standoff that had blocked the service's rollout in the world's largest smartphone market.

The legal profession faces a convergence of ethics crises driven by artificial intelligence and fraud. Attorneys are increasingly taking side work training AI models, while scammers deploy AI-generated deepfakes and cloned identities to impersonate immigration lawyers and steal from vulnerable clients. The problem intensified with the exposure of Washington State attorney Alexandra Lozano, who fabricated thousands of domestic abuse and trafficking narratives to secure humanitarian visas without client consent. Her scheme, which enlisted hundreds of employees across Colombia, Mexico, and Argentina to process fraudulent applications, affected tens of thousands of immigrants and drained client bank accounts while exposing victims to deportation risk.

Companies including Walmart, Starbucks, Delta, and Chevron are deploying AI-powered employee monitoring systems that track keystrokes, idle time, email and Slack activity, meeting participation, location data, and even tone analysis to assess productivity and flag retention risk. These tools have moved beyond niche management software into widespread workplace surveillance, often integrated into performance reviews and employment decisions without full employee visibility. The Consumer Financial Protection Bureau has begun enforcement action related to the practice, while legal scholars and researchers are actively analyzing employee privacy rights in this context.

Blank Rome LLP, a Philadelphia-based firm, faces two proposed class-action lawsuits following a May 2026 data breach that compromised the personal information of 57,554 current, former, and prospective clients. A cybercriminal impersonating an IT staff member tricked an attorney into uploading sensitive files to an unauthorized external Google Drive. The exposed data includes Social Security numbers, medical records, driver's license numbers, passport information, and health insurance details.

Meta faces a lawsuit filed by the Consumer Federation of America in Washington, DC, alleging that the company violated consumer protection laws by allowing fraudulent advertisements to proliferate on Facebook and Instagram. The CFA claims Meta's AI-powered advertising tools have enabled scams including fake government checks and counterfeit product offers despite the company's stated commitment to combating fraud. The suit also highlights Meta's AI ad-generation tool, which has produced errors that distort product images, compromise text legibility, and misrepresent people in advertisements. Separately, the Tech Transparency Project documented instances where Meta approved harmful ads targeting minors—promoting drug use, alcohol, and eating disorders—using Meta's own AI-generated imagery and targeting children as young as 13.

A Dubai-based CEO and trader has pleaded guilty in federal court in Massachusetts to conspiring with a former BigLaw M&A associate to run a decade-long insider trading operation that generated tens of millions in illicit profits. The scheme involved 30 defendants—corporate attorneys and financial professionals—who allegedly stole confidential client data from nearly 30 major M&A transactions to trade on material nonpublic information between March 2014 and August 2024.

California Attorney General Rob Bonta and 46 state attorneys general have secured a $45 million settlement with Block, Inc., the parent company of Cash App, over allegations that the company misled consumers about fraud protections and failed to safeguard users from theft. The agreement requires Block to implement 24-hour live customer support, halt false marketing claims about safety features, and comply with a separate Consumer Financial Protection Bureau settlement obligating the company to distribute $75 million to $120 million in consumer redress.

Waymo has begun manual mapping and data collection on Chicago streets, operating a limited fleet of human-driven vehicles east of I-90 from the South Loop to Wrigleyville. The testing started in late February 2026 after residents spotted Waymo vehicles in the area and in a Loop parking garage. The current phase does not include passenger pickup services. Waymo spokesperson Chris Bonelli confirmed the limited operations, while Chicago Mayor Brandon Johnson's office acknowledged the testing but stated that no autonomous operations are currently authorized in the city.

A New York state court on July 20 allowed Attorney General Letitia James's lawsuit against Early Warning Services, operator of Zelle, to survive a motion to dismiss. Judge Phaedra F. Perry-Bond ruled that the complaint plausibly alleges fraud and deceptive marketing under New York Executive Law § 63(12). The court did not find that Early Warning violated the law—only that James's allegations warrant proceeding to discovery.

On July 15, 2026, China's Provisional Measures on Human-like Interactive AI Services took effect, establishing the first national regulatory framework specifically targeting AI companions and virtual lovers. The rules, jointly issued April 10 by the Cyberspace Administration of China, the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Administration for Market Regulation, explicitly prohibit AI services from inducing emotional dependency, damaging real-world relationships, or using emotional manipulation to drive unreasonable user decisions. Companies must ensure their bots clearly identify as AI, remind users of this fact after two hours of continuous interaction, and intervene immediately if signs of self-harm are detected. Violations carry fines up to 200,000 RMB (approximately $28,000) and potential service shutdowns.

Users are sharing login credentials for premium AI services—ChatGPT Plus and Claude Pro—exposing themselves to serious privacy breaches. Connor Effrain, a 22-year-old digital fundraising associate, shared his ChatGPT account and inadvertently gave others access to sensitive health information about his Crohn's disease and personal details he had discussed with the chatbot. Both OpenAI and Anthropic explicitly prohibit account sharing in their terms of service, classifying these subscriptions as single-user only. The platforms detect concurrent sessions and suspend accounts that violate this rule.

The Department of Justice has begun full enforcement of the Bulk Sensitive Data Rule, a regulation codified at 28 C.F.R. Part 202 and mandated by Executive Order 14117. The rule prohibits or restricts the transfer of Americans' bulk sensitive personal data and government-related data to designated countries of concern—China, Russia, Iran, and Cuba. A three-month grace period that began April 8, 2025 has now expired. Companies face civil penalties up to $368,136 per violation and criminal exposure of up to 20 years imprisonment for willful breaches.

Technology professionals are rapidly adopting AI-powered recording and transcription tools to automatically capture, transcribe, and summarize virtually all digital interactions—from workplace meetings and internal chats to personal dates. The practice is driven by productivity gains: users leverage applications like Fathom, Otter AI, Fireflies, Avoma, Granola, tl;dv, Zoom AI Companion, and NotebookLM to create searchable archives and extract action items without manual effort. Granola has gained particular traction by addressing the "bot problem"—the concern that a visible recording presence alters what participants are willing to say—through local call detection that avoids inserting a bot into conversations.

A ransomware group called World Leaks has posted nearly 19,000 files related to India's largest nuclear power plant, Kudankulam, on the dark web. The leaked materials include purported blueprints of facility components and supplier details allegedly obtained from Reliance Group, a major contractor at the plant. Reliance Group confirmed a partial breach of data stored on a server hosted by Yotta, an Indian data center provider, and reported the incident to the Indian government. The compromised files represent the most sensitive portion of approximately 858,000 Reliance files now accessible on the World Leaks website.

On June 2, 2026, President Trump signed Executive Order 14409, directing federal agencies to accelerate U.S. artificial intelligence development while fortifying cybersecurity defenses against AI-enabled threats. The order tasks the Department of Defense, CISA, the NSA, and the Office of Management and Budget with prioritizing cyber protection for National Security Systems and critical infrastructure—specifically naming rural hospitals and utilities. It establishes a voluntary framework for "covered frontier models" without imposing mandatory licensing, explicitly rejecting what the order characterizes as the "overly burdensome regulation" of the prior administration. The Attorney General receives a directive to prioritize enforcement against AI-facilitated crimes. The order also creates an AI cybersecurity clearinghouse to coordinate voluntary industry participation in remediating software vulnerabilities at scale.

A sponsored article published on Above the Law argues that general-purpose AI tools are failing law departments due to a fundamental mismatch between what these systems can do and what legal work actually requires. The piece, titled "What Does Your Legal Team Actually Need From AI?", identifies hallucination, factual errors, and an inability to grasp legal nuance or business context as core problems. Tools like ChatGPT, Claude, and Microsoft Copilot are being deployed across contract review and eDiscovery without sufficient customization, leaving lawyers dependent on strict human supervision to catch errors and meet competence obligations.

Meta faces a federal class action lawsuit alleging that its Ray-Ban smart glasses secretly transmit user-captured video to thousands of human contractors in Kenya for AI training—contradicting the company's privacy commitments. Filed March 4, 2026, by plaintiffs Gina Bartone and Mateo Canu, the suit claims Meta and Luxottica violated federal and state law by routing footage to overseas servers for manual labeling without user disclosure, rather than processing it solely through AI models.

Scammers launched a coordinated campaign in July 2026 impersonating Netflix, Coca-Cola, and FIFA through counterfeit hiring pages designed to harvest job seekers' credentials. The fake sites mimic legitimate career portals but use mismatched domains—adding terms like "jobs," "careers," or "hiring" around brand names—and embed sign-in boxes directly on the pages rather than redirecting to authentic Google, Microsoft, or LinkedIn authentication. Security firms Norton and Malwarebytes identified the scheme, which specifically targets marketing professionals.