Today, along with the ACLU, EFF filed an amicus brief in the Sixth Circuit court of appeals in United States v. Sturdivant, a case where police warrantlessly tracked a suspect’s movements using Automated License Plate Reader (ALPR) data. Our brief details the vast, interconnected network of ALPRs that constantly track drivers around the country and argues that this tracking is a “search” under the meaning of the Fourth Amendment.

Sturdivant involves a series of robberies in and around Cleveland, Ohio. Using surveillance camera footage, police identified the make, model and color of the robber’s car, but they did not know its license plate number. After running an open-ended search of two ALPR databases, Flock and ELSAG, officers learned a car belonging to the defendant had been tracked near sites of the robberies, eventually leading to his arrest. Faced with a motion to suppress the ALPR evidence, the district court held that Mr. Sturdivant had no reasonable expectation of privacy in his license plate number because it could be observed by members of the public, and that therefore he had no Fourth Amendment interest in not having his car tracked in public places.

But ALPRs are simply not comparable to observing an individual license plate on a passing car. As we’ve explained in many amicus briefs and in our lawsuits directly challenging ALPR use in San Jose, California and Wisconsin, ALPRs give law enforcement “a virtual time machine to view suspects’, or anyone else’s, past movements (and much more) with just the click of a button.” Just last month, a federal district court agreed and held that ALPRs are a “form of indiscriminate mass surveillance” that can violate the Fourth Amendment.

We hope the Sixth Circuit will reverse the lower court in this case and hold that ALPR searches require a warrant.

The number of petitions being filed at the Patent Trial and Appeal Board (PTAB) has collapsed. That’s not reason for celebration. The PTAB is an important line of defense against low-quality software patents being used in lawsuits against people and companies.

The drop didn’t happen because suddenly patents have become higher quality. It’s simply because USPTO leadership is increasingly refusing to consider good challenges to patents, for reasons unrelated to the merits. The process has become so unreliable that many would-be patent challengers aren’t even trying.

Inter partes review (IPR) is a process that allows people to challenge patents at the Patent Office, rather than having to fight an expensive lawsuit in federal court. It’s one of the most important ways to get bad patents out of the system.

In the third quarter of 2026, July through September, only 97 IPR petitions were filed at the PTAB, compared to 327 petitions during the same period in 2025. Similarly, only 37 IPR petitions were filed in September 2026, compared to 129 petitions in December 2024—the last full month before the current USPTO leadership began reshaping how the Board handles patent challenges.

This dramatic decline shouldn’t just concern patent lawyers. EFF has fought bad patents because so many software and internet patents make claims to the basic tools of free expression online, like sending email, using online ads, or publishing web pages. When bad patents go unchallenged, they affect everyone who cares about the freedom to write new code and make new technology.

That’s why EFF has defended IPR since it came on the scene more than a decade ago. It provides a faster and less expensive way to challenge patents that should never have been granted. Congress created IPRs because the Patent Office makes mistakes. District court litigation is an extraordinarily expensive way to correct them. Without a meaningful administrative review process, bad patents remain powerful weapons in the hands of patent trolls and others seeking to extract settlements from companies that often did nothing wrong.

Now, USPTO leadership is dismantling that safeguard.

Since Congress created the IPR patent challenge process in 2012, the PTAB has always had some discretion in deciding which petitions deserve review. But institution rates today are much lower than their typical historical range.

Between fiscal years 2022 and 2024, the PTAB instituted between 66% and 68% of IPR petitions. In fiscal year 2026, which concluded in September 2026, the institution rate fell to 41%. And institution is only the first step of an IPR—it means the PTAB has agreed to hear the challenge, not that the challenger won, and the patent will be invalidated.

That decline helps explain why fewer petitions are being filed in the first place. Preparing an IPR petition takes substantial time and money. While cheaper than federal court, it’s still a complicated administrative process. Before filing, a challenger typically needs to search for prior art, hire experts, and develop detailed technical and legal arguments about why the patent never should have been granted.

Companies were willing to pay for IPRs because, historically, they could expect a predictable process. Petitions that met the statutory standard generally had a reasonable prospect of being heard and decided on the merits. But the USPTO has made it harder to get petitions heard and is throwing them out for reasons that have nothing to do with the merits of the challenges. Faced with these odds, many potential challengers aren’t filing at all.

When the PTAB decides to hear an IPR case, that means the petition has been “instituted”—but that has never meant that the petitioner will definitely win. It means the PTAB has determined the challenge warrants a full merits review, and the parties could expect the proceeding to continue toward a final written decision. But under the current USPTO leadership, that expectation has disappeared. The PTAB’s institution decisions are being repeatedly vacated by the Director.

USPTO Director John Squires has vacated at least 29 decisions granting institution of IPR proceedings, and subsequently denied the petitions, terminating those proceedings before a final written decision. These include cases that PTAB judges had already agreed to hear, as well as proceedings that Squires himself had previously allowed to proceed. This level of retroactive intervention is unprecedented.

In some cases, the parties had already invested substantial time and money litigating before the PTAB, only to have the proceeding terminated based on new reasoning by the Director’s office that arose after institution.

For example, in Revvo Technologies v. Cerebrum Sensor Technologies, the Director vacated an institution decision and remanded the case to the Board. The Board then instituted review again, but the Director reversed that decision. Using a new approach, the Director said that the petition had inconsistencies between claim construction positions taken before the PTAB and in district court. Since then, that decision has been cited as a basis for terminating several other instituted proceedings.

The result is another layer of uncertainty for people who want to challenge bad patents. Getting through the front door of an institution decision is much harder than it used to be—and now, even getting through that door doesn’t mean the PTAB will decide your challenge. Predictability is one of the things that made IPRs work.

Congress created IPRs in part because challenging a questionable patent in federal court is enormously expensive and risky. Patent examiners work under serious time constraints, and some patents that shouldn’t have been granted will inevitably issue. Not every patent dispute requires years of expensive district court litigation. Congress recognized that, and created an administrative process, staffed with experts more capable of correcting those mistakes.

That system has benefited the public. Since 2012, it has helped invalidate thousands of patent claims that never should have been issued. The IPR process has protected startups, software developers, nonprofits, and small businesses that otherwise would have faced crushing litigation costs simply for building products or offering services that use everyday internet technology.

EFF supports a balanced IPR system because it should be easier to fight against bogus patents that should never have been issued. The cost of fighting a patent can be a weapon in itself, and weak patents don't just burden large technology companies. Patent trolls routinely target small businesses and independent developers, and have gone after podcasters, retailers, and even coffee shops and nonprofits. These organizations have neither the resources nor the desire to spend years litigating over potentially invalid patents in federal court. IPR offers a chance to challenge those patents before litigation costs get out of control.

If we weaken the IPR system, bad patents become much harder and more expensive to challenge.

Some defenders of the current approach argue that lower institution rates reflect more balance in the patent system. But institution rates at the PTAB have plummeted from 68% to 41% in just two years—a nearly 40% decline. IPR petition filings have reached historic lows. And even proceedings that have already been instituted can now be terminated months later, without a decision on the merits.

These developments send a troubling message to members of the public who might want to use the PTAB: don't bother. The PTAB doesn’t need to institute every petition. But it does need to provide a process that is transparent, predictable, and fair. Right now, confidence in the system is disappearing.

If companies, individuals, and nonprofits conclude that IPRs aren’t worth pursuing, the consequences won't stop at the PTAB. More weak patents that never should have been granted will survive, and patent trolls will use them. That means more defendants facing expensive district court litigation or paying settlements driven by the cost of litigation.

That's not what Congress intended when it created IPRs. It should not become the PTAB's “new normal.”

For the past two decades, the U.S. Supreme Court has been slowly weakening the Alien Tort Statute (ATS), a key human rights law that allows foreign nationals to sue persons or entities in civil court for harms resulting from violations of international law. The court’s recent ruling in Cisco Systems, Inc. v. Doe I dealt the law a final blow, foreclosing—absent new legislation by Congress—any future ability by plaintiffs to use the law to hold technology companies accountable for aiding and abetting human rights abuses. EFF filed multiple amicus briefs in the case, including most recently in the Supreme Court.

The ATS was passed by the very first Congress in 1789 and in just a few words gives U.S. federal courts jurisdiction to hear civil claims brought by foreign nationals against defendants who violated “the law of nations or a treaty of the United States." There has been a longstanding question about what counts as a valid civil claim under “the law of nations.”

In Sosa v. Alvarez-Machain (2004), the Supreme Court had noted three historical international law claims that the First Congress likely had in mind: violation of safe conducts, infringement of the rights of ambassadors, and piracy, collectively known as the Blackstone Three.

The Sosa court also held that federal courts may recognize other substantive causes of action under the ATS if they reflect international norms that are “specific, universal, and obligatory,” stating that this “door is still ajar subject to vigilant doorkeeping, and thus open to a narrow class of international norms today.”

Thus, the Sosa court recognized that the ATS could be used to bring claims related to historical violations of international law as well as select newer claims reflecting modern concepts of human rights.

In Cisco, the Supreme Court overruled the second Sosa holding. The majority held that the current case, a technology company aiding and abetting torture and other human rights abuses, was beyond the scope of the original three ATS claims and it was not for the court to create new ways of enforcing international law. The court said:

[W]e close the door that Sosa cracked to judicially created ATS liability. We do not disturb Sosa’s holding that the ATS is a jurisdictional statute; nor do we revisit its assumption that causes of action are available for torts corresponding to the Blackstone three. We conclude only that Sosa was overly optimistic in its prediction that there might be a narrow class of cases in which courts may create ATS actions without infringing on the prerogatives of the political branches. In truth, this class is a null set.

What result for this case? Cisco argues that the Ninth Circuit erred in holding that aiding-and-abetting liability exists under the ATS for the torts alleged by the plaintiffs. Cisco is correct. Courts cannot create new rights of action to remedy violations of international law, so there is necessarily no liability for aiding and abetting such violations. Plaintiffs’ ATS claims against Cisco must be dismissed.

The Supreme Court’s ending of the plaintiffs’ case against Cisco is hugely disappointing given that the case has been going on since 2011 and the Ninth Circuit in 2023 allowed the case to move forward in an excellent and well-reasoned opinion. The court held, in part:

We conclude that Plaintiffs’ allegations, accepted as true, are sufficient to state a plausible claim that Cisco provided essential technical assistance to the douzheng [violent struggle] of Falun Gong with awareness that the international law violations of torture, arbitrary detention, disappearance, and extrajudicial killing were substantially likely to take place. 

The plaintiffs sued Cisco for the company’s role in building and deploying the “Golden Shield,” also referred to as “The Great Firewall of China”—a vast surveillance system that Cisco began building in the late 1990s and that the company customized to enable the Chinese government to target disfavored minorities, including members of the Falun Gong religion.

The thirteen plaintiffs—Falun Gong practitioners—alleged arrest, detention, and torture, including of themselves and family members, at least one of whom died by beating while being detained. The allegations were horrific: the plaintiffs were placed in forced labor camps, beaten with steel rods, shocked with electric batons, and endured sleep deprivation and violent force-feeding.

Importantly, the plaintiffs also alleged that their private emails, text messages, and other information—intercepted by the Golden Shield—were shown to them and used as part of their torture and forced conversion sessions, which included threats to their family members and others who had communicated with them. 

And now, Cisco is off the hook for all of this.

As we argued in our amicus brief to the Supreme Court, a robust federal statute is necessary given that voluntary and informal mechanisms of corporate human rights accountability are inadequate.

The plaintiffs filed their lawsuit in 2011. The following year, in 2012, Cisco first published its Global Human Rights Policy. Since then, the company has never provided redress to the plaintiffs, despite its currently operative human rights policy stating:

Where we have identified that we have caused or contributed to an adverse human rights impact, we are committed to providing access to and cooperating in remediation for affected individuals, workers, and communities through legitimate processes.

What’s more, the Associated Press conducted an extensive 2025 investigation, which recently won the Pulitzer Prize, further mapping Cisco’s and other American tech companies’ involvement in creating China’s surveillance state over the past three decades. When questioned by the AP reporters, the companies dismissed any notion of human rights obligations and simply “said they adhere to relevant export controls, laws and regulations where they operate.”

In short, Cisco’s commitment to human rights is a fiction.

Given that the U.S. Supreme Court has effectively read the ATS into non-existence, Congress must now step up. While there might be other avenues for redress including under state law, there must also be a comprehensive federal human rights law allowing any plaintiff to hold American companies—especially technology companies—accountable for aiding and abetting human rights abuses, with knowledge or intent that those abuses would occur, and whether the victims suffered those abuses in the U.S. or in foreign countries.

The implications of this gap in U.S. human rights law are significant. As Prof. Harold Koh considered:

[T]he Justices should ask whether affording such immunity in Cisco would implicitly signal to U.S. companies that they could not be held liable for assisting the U.S. government in committing gross violations. Such violations could include constructing a mass surveillance system that may be used to surveil, persecute, retaliate against, and punish real and perceived opponents and constructing systems that autonomously commit war crimes.

American companies should not have a free pass to build out surveillance states (or other technologically sophisticated systems) that not only violate personal privacy or facilitate censorship, but that can also lead to real-world physical violence and even death.

Google is rightfully facing blowback for forcing K-12 schools to enable AI if they wanted to keep using Google search. The company quickly backtracked and decoupled and turned off the services by default, but made it clear search will continue to be just another AI chatbot. This mandate forces an ultimatum on educators: accept generative AI or de-google your school.

Students, teachers, and parents across the U.S. are now years into an argument about how schools should respond to the growth of AI-enabled tools. Google decided to skip this debate and take this choice from schools. In August it activated AI chatbot Gemini for 150 million K-12 students on Google Classroom, leaving educators scrambling to respond. A few months later, Google introduced a new way to turn it off — but now administrators would also be turning off Google search.

Google walked this back somewhat, clarifying that Gemini, Gemini notebook, and Search will have their own controls and will be off by default. But because of Google’s broader approach to force AI on all search users, this change is still an example of a tech monopolist pushing unwanted changes into the classroom.

It’s no secret that the biggest companies in AI  are operating at a huge loss, in the hope they can follow Uber’s enshittification playbook. Offer a cheap convenience at a major loss until old systems atrophy, then flip the script to reduce wages and raise consumer costs—whether that’s paying with cash or with data. 

This puts Google in the odd position of an incumbent, with around 90% of search traffic. It needs to not only make good on its own AI investment, but protect its dominance from new AI tools. It’s not just enough to offer its own AI mode, it needs to turn search into AI mode, while engaging in clumsy self-preferencing that is eating its own ad revenue.

The problem with this approach is the public is split on AI, to put it mildly. Some users will welcome these changes, but the rest are stuck in an all-or-nothing bargain. Anyone concerned  about the accuracy of AI overviews or their impact on click-through rates for online communities and small publishers can just deal with it. The bet is any inconvenience in switching to an alternative is enough to keep you trapped.

Google can and should offer a way to disable AI overviews. Smaller services like DuckDuckGo* and Brave search have simple and persisting AI settings which don’t require login. These services also don't mince words and make a distinction between generated AI summaries, suspected AI results, and the backend use of AI to curate links. 

It’s not enough to point to opaque workarounds, either. Adding “-ai” to your Google search will usually remove AI Overview, but so will “-unicorn”. This trick isn’t meant to be an AI off-switch, it’s a quirk of how AI Overview was implemented and can change at any time. These tricks also don’t generalize well to settings for system administrators. Hacks might work for now, but everyone—including administrators—deserve clear set-and-forget controls for the tools they rely on.

De-googling your life isn’t easy, and for schools it can be even more difficult. For decades Google has gone after schools to foster life-long Google users—resulting in many institutions being deeply entrenched in its ecosystem despite data privacy concerns. That’s because schools face major switching costs when moving to a competitor. It takes more than flipping a setting—it means a lengthy contract process, staff retraining, and a cumbersome migration of past work. 

The difficulty of switching makes granular controls even more essential, particularly for a hot-button issue like generative AI. Few parents would send their kids to AI-driven schools, but they may want their kids to learn tools like search as they exist outside of the classroom. However, many parents and teachers concerned with AI disrupting learning are pushing major school districts to implement temporary AI moratoriums for young students. These pauses are meant to make sure any introduction of AI fits the needs of students and is done in a way that actually makes sure educators are prepared. 

But in either camp, this is a choice that must be made by schools, not Google. Teachers know more about what their students need than a trillion-dollar tech company, and this expertise should be respected in their own classrooms. 

Google’s self-preferencing and desperate attempt to eventually recoup on an AI money pit must be tempered with more fine-tune controls over generative AI. It’s in Google’s own interest to stop abusing its dominance to piss off users, advertisers, and school communities. It’s also Google’s responsibility as an adjudicated monopolist.

*DuckDuckGo is an EFF donor. EFF donors do not influence our agenda or our positions.

What does the digital future look like? Who gets to imagine it, shape it, and make it real?

Building a freer, more inclusive digital age requires not only challenging systems of surveillance and control, but also making space for creativity, community, and radical imagination. 

That's why earlier this year with the queer arts collective, we put out a call for submissions inviting people to explore the intersections of technology, identity, and digital liberation—whether that involved pointing the lens towards an underrepresented issue in digital justice efforts; sharing personal accounts of joy, pleasure, or sorrow under surveillance; or painting wide imaginations for our communities using technology for good instead of carcerality and doom.

And we’re excited to share that the project is now live! Desire Lines: Encoding Queer Digital Futures explores a digital world that dreams wilder and exists louder. Seven artists share their visions of digital liberation, spanning from early internet-coded yearning to escapist steamy chat rooms and seed-laced battle suits for revolution. 

These essays and stories remind us that digital rights aren't just about the existence of technology and its deployment as existing in a vacuum, but instead about how tech tools are a way for people to express themselves freely, find communities, explore identities, and build spaces to exist and seek joy without fear. Too often, conversations about technology focus on innovation, efficiency, and the next big thing while overlooking the people and communities most affected by the systems being built. This project was an effort to break containment and make space for something different: a chance to imagine digital futures rooted in queer creativity, resistance, and possibility.

Together with the queer arts collective, we were excited to launch the magazine and celebrate the artists and ideas that brought it to life through our session at Mozilla Festival last week, ‘Privacy x Queer Desire,’ where we started out by co-curating a community privacy plan grounded in digital fairness before launching the magazine. 

If the stories in Encoding Queer Digital Futures teach us one thing, it’s that we don't have to accept the digital future handed to us by oppressive governments and tech companies. We already have pre-Big Tech internet experiences encoded in our fondest memories that can inform our dreams for something better, and together we can build a new reality.

Read Desire Lines: Encoding Queer Digital Futures here.

“The safety of young people in the digital environment cannot be assessed without also considering the safety of young people in offline environments. For millions of young people around the world, the digital environment is their safe place, their haven from an unsafe physical environment, community, or family situation. The digital environment may be the best, perhaps only, place for them to find critical safety information and community, to explore ideas that are controversial in their families and larger physical environments, and to otherwise nourish their personal autonomy.

“For these young people, regulatory efforts that limit their access to online services or to certain features they find valuable, make their lives, in total, less safe, even if there has been some marginal safety benefit to their digital environment.

“The OHCHR must thus consider the whole of young persons' lives in any recommendations that come out of this process and not treat ‘safety, physical or mental health, and rights in the digital environment’ as disconnected from safety, physical or mental health, and rights elsewhere.”

So begins EFF’s submission to the global Call for Inputs on Child Rights and Safety in the Digital Environment conducted by the United Nations Office of the High Commissioner on Human Rights. The OHCHR is preparing a report on the issue to be presented to the UN Human Rights Council at its 64th session in the first quarter of 2027. The Human Rights Council requested the OHCHR to solicit input from a wide range of stakeholders, including child and youth perspectives, and convene five regional consultations to assess the risks to the safety of the child in the digital environment and best practices to address these risks in different geographical areas, bearing in mind current and emerging business models. 

The OHCHR acknowledges that young people today navigate a digital environment with both “unprecedented opportunities” and “serious and evolving risks,” and sets out a rights-based framing whereby “Children's 'safety' is therefore addressed through the full framework of their rights — with freedom from violence (Art. 19) and protection from exploitation and abuse (Arts. 34–36) as clearly defined obligations, situated alongside privacy (Art. 16), access to information (Arts. 13 and 17), expression (Art. 13), participation (Art. 12), and development (Art. 6). Protection and the full range of children's rights are understood as reinforcing rather than competing imperatives, and measures taken in the name of safety must not be used to restrict the enjoyment of other rights, such as the right to privacy and the right to participate.”

In light of this, EFF’s submission focused on the current general disregard for young people's speech and privacy rights by regulators around the world, all of whom seem far more interested in empowering parents rather than young people themselves, or meaningfully involving young people in the regulatory process. We emphasized the human rights-centered uses young people make of social media that were not specifically set out in the concept note. We also explained that too often, policy proposals aiming to remedy the issues of online safety for young people introduce limitations on access to online services and content rather than tackling the specific problems that people experience. 

More specifically, our submission looks at:

1. the most significant risks to young people’s safety in the digital environment
2. how digital product design and business models drive risks to children's rights online, including in AI-mediated services
3. the inclusion of young people’s views in the design, governance, and regulation of digital environments 
4. how equality and non-discrimination in access and protection can be ensured
5. the promotion of digital literacy, skills, and empowerment for young people 
6. the impact of legislative and regulatory measures from the United States to Indonesia and Australia 
7. importance of broader, more systemic interventions that can address address online harms
8. how global instruments and processes can protect young people online. 

The internet is where young people learn, find community, explore their identities, access important information, and express themselves. Curtailing these opportunities doesn't make them safer. And requiring everyone to hand over sensitive personal information just to access online spaces creates privacy risks for all users.

As the OHCHR has acknowledged, the solution to the issue of online safety should not require a choice between protecting young people from danger or protecting their rights. Instead of restricting access, governments should focus on the systems that create these risks in the first place; tech companies must be accountable for their design choices, data practices, and surveillance-driven business models; and young people need to be included in the decisions that affect them. 

Read our full submission here. 

On November 3, our colleagues at the Software Freedom Law Center, India (SFLC.in) received notifications from X that the Delhi Police had issued takedown requests targeting 42 URLs. Among the accounts and posts targeted were those belonging to SFLC.in, the Internet Freedom Foundation (IFF), and X account @geoblockedindia, as well as posts documenting legal notices and instances of online censorship. 

Takedown requests targeting SFLC.in and other digital rights groups threaten not only their work, but the public’s ability to know when and how online speech is being restricted. 

The requests cite grounds including hate speech, alleged defamation of the Hindu nationalist organization Rashtriya Swayamsevak Sangh (RSS), and concerns relating to safety and security. But the context in which these requests have emerged is particularly troubling: they target organizations and individuals whose work involves documenting restrictions on online expression and making those restrictions visible to the public. 

In other words, the organizations being targeted are among those trying to tell the public when and how its speech is being censored. 

SFLC.in is one of India's most important digital rights organizations and promotes innovation and open access to knowledge by helping developers make great free and open-source software, protects privacy and civil liberties for Indians by educating and providing free legal advice, and helps policymakers make informed and just decisions about use of technology. In 2025, we recognized their work with an EFF Award for Defending Digital Freedoms. 

IFF (the Internet Freedom Foundation) is another of EFF's close allies in India. Like EFF, IFF combines advocacy campaigns and strategic litigation to advance digital rights. They write frequently about internet shutdowns and have filed several lawsuits contesting them. 

Among SFLC.in's initiatives is its Free Speech Tracker, which documents instances of online censorship, content restrictions, and account takedowns in India. In a country where government orders to restrict online content are often opaque, this work is absolutely essential. 
 
Recent legal notices object to the tracker itself, as well as the organization’s documentation of restricted content and geo-blocked material. The allegations against SFLC.in include claims that it is "continuously opposing government directions" and publicly circulating information about restricted content, thereby undermining measures taken in the name of national security and public order. 

But documenting government censorship is not the same as undermining public safety. Reporting that content has been restricted is not an endorsement of that content, nor does it constitute an attempt to circumvent the law. It is an exercise in transparency and accountability, and one that allows journalists, researchers, civil society organizations, and the public to understand how governments exercise their power over the information landscape. 

The use of legal complaints and platform takedown mechanisms against organizations documenting censorship creates a particularly troubling dynamic. When those who monitor restrictions on expression are threatened with having their accounts or reporting removed, the result is a chilling effect that extends far beyond the immediate targets. Other organizations or journalists may think twice before documenting controversial takedowns or challenging government orders, and the public loses access to an independent record of decisions that affect its ability to speak and access information online. 

There is also an important role here for platforms like X. Platforms must be transparent about the requests they receive, provide meaningful notice to affected users, and ensure that any restrictions are subject to appropriate scrutiny and avenues for appeal. When governments seek to restrict speech, platforms have a responsibility to avoid becoming opaque intermediaries through which censorship is quietly carried out. 

These developments are part of a broader pattern of pressure on independent civil society organizations working to defend freedom of expression and access to information in India. Digital rights groups play an indispensable role in documenting the effects of government policies, identifying patterns of censorship, and challenging restrictions that undermine fundamental rights. Their ability to do so independently is not a peripheral concern; it is a cornerstone of a healthy democratic society. 

The right to freedom of expression includes the right to scrutinize the exercise of government power. That includes the right to document censorship, question the reasons given for it, and make that information available to the public.  

EFF stands in solidarity with SFLC.in, the Internet Freedom Foundation, @geoblockedindia, and all those working to document and challenge restrictions on online expression in India. We urge the authorities in India to respect the rights of digital rights organizations to conduct their work without intimidation or retaliation, and to ensure that any restrictions on online expression comply with international human rights standards. 

California’s 2026 legislative session has officially adjourned and it’s time to reflect on the wins and losses that have shaped Californians’ digital rights landscape this year. This was the second year of a two-year legislative session, which meant several bills resumed their legislative paths from 2025.

EFF monitored nearly 100 bills in the state over the two-year session. These included proposed regulations on 3D printers, access to social media platforms, police, commercial, and workplace surveillance practices, AI, and other privacy concerns. While we saw some victories, alarming developments also raised serious concerns about the future of privacy protection in the state.

Governor Newsom signed vital protections on the use of automated decision-making in the workplace and workplace surveillance tools, specifically No Robo Bosses (SB 947) and AB 1883.

Championed by our labor partners, SB 947 limits how employers can use automated decision-making to fire or discipline workers, including provisions that ensure workers get vital information about automated decisions that affect them, and that an algorithm is not the only authority for these consequential decisions. Alongside it, AB 1883 prohibits the use of workplace surveillance to predict emotions or collect neural data. This stops employers from using potentially biased, invasive, and exploitative forms of AI surveillance at the workplace, marking an important step toward creating workplaces that respect the privacy and autonomy of workers. We look forward to continuing to ensure that technology in California’s workplaces is deployed fairly, thoughtfully, and with respect for all workers.

EFF was also grateful to see Governor Newsom sign SB 747, which allows damages lawsuits against federal officials who violate the U.S. Constitution. Victims of constitutional violations deserve a complete remedy and this law also helps deter constitutional violations in the first place. Gaps in current law often make it difficult to seek a damages remedy against federal officials who violate the U.S. Constitution. This bill makes it easier to bring such litigation. Federal law enforcement officials have violated our First Amendment right to record on-duty police and other newsworthy subjects, and also sometimes violate our Fourth Amendment right to be free from unreasonable searches of our phones and laptops. When this happens, the people who suffer these violations should be able to sue these officials for damages.

Additionally, EFF supported two bills (which are now state law) that clarify and extend California’s shield laws to protect patients, healthcare providers, and others involved in reproductive healthcare and gender-affirming care that is legal in California. After the overturn of Roe v. Wade, California enacted numerous shield laws to protect people who provide, receive, or help others obtain healthcare that is legal in California. These laws prohibit California agencies and certain companies from helping other states enforce laws that punish this care. Yet the federal government and coordinated efforts in other states still threaten access to these legally protected healthcare services. AB 1854 addresses these threats by expanding coverage to more California businesses and individuals who receive legal demands, creating a notification process so the Attorney General can intervene to stop improper disclosures, and clarifying that law enforcement cannot arrest someone if the Governor refuses an extradition request. These protections serve as a necessary response to real and escalating tactics outside the state targeting lawful reproductive healthcare.

EFF also supported AB 1930 to protect confidential medical records from politically motivated investigations into lawful healthcare, empowering the California Attorney General’s office to meaningfully intervene and respond to out-of-state subpoenas or requests for data regarding protected care.

EFF is dedicated to protecting the rights of young people online. We supported a handful of bills on digital literacy and cybersecurity education that were signed into law, such as AB 2071 on digital wellness instruction and AB 2298 on cybersecurity in educational standards. Unlike blanket bans, these bills address online safety through education rather than prohibition. Young people rely on the internet not just for entertainment, but for civic engagement, education, self-expression, and community—especially vulnerable youth who may lack support in their physical surroundings.

Real digital safety comes from preparation, not isolation. Research consistently shows that open, honest conversations about digital literacy and privacy with trusted adults are far more effective at protecting youth than restrictive censorship laws. Young people themselves recognize this need; in fact, AB 2071 was co-authored by a group of students actively seeking better resources to navigate their digital lives safely.

EFF and our allies were also able to stop the expansion of California’s dangerous age gating law from operating systems to browsers. The California legislature stepped back from their plan to expand the 2025 age-gating law and ultimately removed language from AB 1856 that could have compounded serious threats to users’ speech, privacy, and security just to browse the internet, and positively, removed the burdens on open-source operating systems.

Real digital safety comes from preparation, not isolation

While EFF still believes the underlying law that AB 1856 amends, AB 1043, is unconstitutional, we appreciate that the legislature did not expand this problematic age-gating framework to browsers. We were also pleased that an earlier amendment to AB 1856 reduced the threat to the open-source community by exempting open-source operating systems. Given these changes, EFF removed its opposition to AB 1856, and thanks the author for listening to concerns from advocates and developers.

EFF was proud to co-sponsor AB 1337 this session alongside our friends at Oakland Privacy and Assemblymember Chris Ward, who is also the chair of the legislative LGBTQ Caucus. The bill unfortunately failed to cross the finish line after stalling in the Senate.

AB 1337 would have updated California's foundational Information Practices Act of 1977 and extended its vital privacy safeguards present at the state agency level to counties and cities. Today, city and county governments collect vast amounts of sensitive personal data (from public health records such as vaccinations, to welfare assistance details, to license plate reader data) and administer programs that were likely not contemplated back in 1977. Yet the law has simply not kept up with modern data practices, and California still has no state law governing how local governments handle this information. While we could not build enough political progress to pass the bill this session, closing this local privacy gap remains an urgent need for California.

Another major setback was the passage (and subsequent signing) of a social media ban for youth under the age of 16 (AB 1709).

Technology and the laws that regulate it should support and empower young people, but AB 1709 falls far short of this goal. Using technology is how we learn and build community in today’s world, but laws such as AB 1709 cut young people off from essential information and experiences. They also particularly harm those already facing increased challenges who find safety in supportive online communities that they cannot always access in the physical world.

Technology and the laws that regulate it should support and empower young people

Denying minors access to digital forums or stripping out basic tools needed to navigate them will not make young people safer or healthier in the AI age. Research shows social media bans are ineffectual while denying young people opportunities to develop their own voices, share their art, practice religion, or engage in politics. These laws also hurt all of us. Age-gating requirements force everyone to give up more personal information. To verify who can pass through online gates, companies will collect even more data, concentrating power in corporate hands rather than protecting people. AB 1709 is also inconsistent with rights to free expression, meaning California will spend resources defending a law that will likely get tied up in court.

CIPA was originally intended to protect personal privacy against surveillance and included a private right of action so consumers could hold corporations accountable in court. This is why EFF and allied organizations spent the two-year session strongly opposing SB 690—a bill we dubbed the "Corporate Cover-Up Act" for its attempt to weaken consumer protections in CIPA. Although SB 690 was narrowed from its original draft, we asked Governor Newsom to veto it because it strips away the law's private right of action—a vital tool for individuals fighting back against unlawful metadata surveillance. People deserve the right to decide whether to bring a lawsuit, which remains one of the most effective ways to deter corporate abuse. Unfortunately, the Governor signed the bill and even urged the legislature to go further next year. It's especially alarming to see this disregard for accountability as the federal government and law enforcement agencies seek data from businesses or data brokers to target people based on political beliefs, religious affiliations, or health decisions.

We expect to see further attacks on CIPA next legislative session, as Governor Newsom’s signing statement called for “additional work in this area” and urged the legislature to “take this on next year to ensure a fair balance between protecting private information and preventing rapacious litigation."

California also missed the opportunity to join other states in restricting the sale of sensitive data. We are deeply disappointed that Governor Newsom vetoed AB 1542, which would have ensured sensitive personal information stays private by banning its sale outright. There's a nationwide movement to protect consumers by making intimate details off-limits for businesses to sell or share. From precise geolocation and genetic data to private messages, health records, sexual orientation, and immigration status, sensitive data reveals the most private aspects of our lives. Monetizing this information fuels financial scams, predatory pricing, and warrant-free government surveillance. By vetoing this bill, California not only fails to lead but falls behind other states, by missing a critical opportunity to protect our most vulnerable communities.

The California legislature unfortunately also passed AB 2047, which aimed to make every 3D printer come pre-loaded with censorship software. It's a law that is trying to prevent an act that is already illegal in the state, and just won't work. It was part of a recent sweep of misguided state bills which purport to go after "ghost guns," but actually “enshittify” 3D printers by introducing privacy risks and a new way to restrict or upcharge users. Lawmakers even considered including misdemeanor charges that would have impacted people using alternative open-source programs. Fortunately an outpouring of opposition from makers and civil liberties advocates resulted in a bill so limited that, despite having passed and been signed into law, will not affect makers until ASTM International publishes a standard — something the organization had not been considering doing.

California lawmakers also missed key opportunities to curb commercial surveillance. EFF supported AB 2564, which prohibits retailers from engaging in surveillance pricing, the invasive practice that allows corporations to offer the same product to two different people at two different prices based on scrutiny of their personal data. Unfortunately, the bill stalled on the last day of session.

The legislature also failed to move AB 322, which would have safeguarded the privacy of Californians by placing restrictions on the collection, use, and sale of location data. Last year, EFF published a rubric for comprehensive location privacy laws, outlining baseline standards states should meet to shield individuals from pervasive location surveillance. Since then, states like Connecticut, Maryland, New Jersey, Oregon, and Virginia have enacted new consumer privacy restraints on geolocation data. Yet, even as these states move the ball forward, most of their laws leave significant gaps that still must be filled. California failed to make that change and protect residents from location surveillance.

California lawmakers have lagged in enacting meaningful limits on automated license plate readers with all proposed ALPR regulation bills failing to pass since 2022. SB 1013 initially appeared on track to pass with broad support, but ultimately stalled in the final days of the session.

EFF maintains high standards for ALPR legislation, favoring full bans or, at minimum, strict warrant requirements and brief data retention limits. While we remained neutral on earlier versions of SB 1013, EFF and our partners ultimately opposed the bill after late amendments compromised key privacy protections. The final draft would have doubled the current data retention period and allowed agencies to archive rather than delete data unrelated to active investigations—effectively shifting away from data minimization toward indefinite retention. (We saw San Francisco adopt a similar proposal this year). We encourage California lawmakers to draw from our ALPR legislative agenda to enact robust safeguards or ban ALPR mass surveillance altogether.

Next session, we expect ALPR legislation to be top of mind as states across the country reckon with the harms the technology has caused. We will also be monitoring the results and action following the state’s audit into California’s fusion centers. Following calls from advocates to address privacy abuses and a lack of transparency, the Joint Legislative Audit Committee approved Senator Sabrina Cervantes’ audit request in March 2026. This builds on our past experiences working with JLAC audits to expose law enforcement overreach—such as the state auditor's damning 2020 report on law enforcement’s use of automated license plate readers and our 2016 push to fix the deeply flawed CalGang database. The audit will examine the legal authority, governance, and funding of the centers, map out state and private data systems accessed by personnel, and review protocols for handling data breaches and unauthorized surveillance. This audit will mark the first comprehensive review of these facilities in 13 years and should be released by Summer 2027. We hope lawmakers use the findings to rein in these centers and their unauthorized surveillance.

Other “zombie bills” are also expected to return next year, including legislation regarding the use of copyrighted material to train AI systems. Throughout the two-year session, EFF raised serious concerns about AB 412, a bill that would require AI developers to identify and disclose copyrighted works used in generative AI training. We argued that complying with such a mandate is practically impossible, as it demands information that often does not exist and cannot realistically be obtained. While we are glad the legislature paused to consider the best approach rather than rushing this policy forward, we expect legislation targeting fair use and AI training to return next session.

More broadly on AI, vulnerabilities and security issues have dominated recent news cycles, and everyday Californians feel real anxiety about the risks of AI. We expect to see numerous bills addressing issues like existential risk and kill switches, as Assembly and Senate privacy committees in California have held informational hearings on these topics over the last month.

We hope to work with legislators to address the threats of AI and ensure that technology supports rights, justice, freedom, and innovation for all people. Laws should always ensure that technology empowers rather than oppresses.

Join us to celebrate the legacy of Aaron Swartz on Nov. 8, 2026. With the organizers of Aaron Swartz Day, we’re honoring his life with an in-person and remote hackathon. This event is supported by several organizations that carry on his work, including the Internet Archive—which is hosting the in-person event—the Freedom of the Press Foundation, Creative Commons and the Free Law Project.

Aaron Swartz was a digital rights champion who believed in the need for an open internet. His life was cut short in 2013, after federal prosecutors charged him under the Computer Fraud and Abuse Act (CFAA) for systematically downloading academic journal articles from the online database JSTOR. Facing the prospect of a long and unjust sentence, Aaron died by suicide at the age of 26.

EFF was proud to call Aaron a friend and ally. We continue to stand with programmers and developers engaged in cutting-edge exploration of technology through our Coders' Rights Project.

Hackathon participants can contribute code, documentation, and design to several open-source and public-interest projects. These include Secure Drop, Open Library, Quantifying the Commons, Onion Press, and our own Atlas of Surveillance.  EFF Director of State Affairs Hayley Tsukayama will also join hackathon participants at the Internet Archive at 11 a.m. for an Atlas of Surveillance on-boarding session.

Contributors across experience levels are welcome. The Aaron Swartz Day organizers are also open to adding new projects and workshops, so please contact them at aaronswartzday@gmail.com if you’d like to suggest a workshop or project—particularly open-source projects on Github that participants can continue to work on after the event. For more details on how to participate in-person or remotely, please visit the Aaron Swartz Day and International Hackathon page at www.aaronswartzday.org.

Event Details

• Date: Sunday, November 8, 2026
• Time: 10:00 AM – 5:00 PM PST
• Social Lunch: 1:00 PM – 3:00 PM PST
• In-person Location: Internet Archive Headquarters, 300 Funston Ave, San Francisco, CA 94118
• Admission: Free, but please RSVP here

Yesterday, along with the ACLU, EFF filed an amicus brief in the Ninth Circuit court of appeals in United States v. Spurlock, a case involving a “tower dump” warrant. These overbroad warrants require cellular providers to turn over location data about every phone in a given area at a given time. This is the first such case to be heard by a federal appeals court since the US Supreme Court ruled this summer that highly similar “geofence” warrants are searches under the meaning of the Fourth Amendment.

Spurlock involves an investigation into two murder victims discovered on the side of a rural California highway. Police also found a car belonging to one of the victims several miles away on the same highway. They quickly sought a tower dump warrant for an area covering this stretch of road, which eventually revealed location data on nearly 1,700 unique phones. Faced with a motion to suppress, the district court relied on a Fifth Circuit court of appeals decision about geofence warrants to hold that tower dumps are similarly categorically unconstitutional “general warrants” that violate the Fourth Amendment. However, the court refused to suppress evidence on the basis of the “good faith doctrine.”

Our amicus brief on appeal makes several key arguments.

First, we point out that the Supreme Court’s decision in the geofence case Chatrie v. United States this summer only strengthens the arguments that tower dumps are unconstitutional general warrants. Tower dumps are a somewhat older technique than geofence warrants, but they are both “reverse location searches,” in which police “tap into an all-encompassing database, allowing them to undertake nearly perfect, retrospective surveillance of countless persons and places.” This is the sort of untargeted “general warrant” the framers of the Fourth Amendment wanted to prevent. As we write in the brief, “Searching all people in an area without probable cause to believe they were all involved in the criminal activity under investigation reproduces the evils of general warrants and is not constitutionally permitted.” It’s this rule of law that prevents police from searching the houses of a hundred, or even a thousand people in the vicinity of a crime.

Second, we note that even if high courts continue to allow tower dump and geofence warrants in any cases, core Fourth Amendment law requires strict limits to protect the privacy of innocent bystanders, including limits on the scope and duration of the warrants, as well notice to affected individuals and after-the-fact deletion and minimization of irrelevant data.

Finally, we argue that the Fourth Amendment requires the court to set aside the good faith doctrine in cases like these and actually decide the constitutional issue. Too often courts pass the buck in cases involving novel surveillance techniques, leading to situations where police can continue using the technique for years or even decades without a definitive ruling.

Whether they call it AI summaries, knowledge panels, or AMP, Google takes actions that are less about functionality and more about locking you into its own ecosystem. Knowing that makes it possible for all of us to choose better services than Google's, defeating their anticompetitive goal. In this case, as it is so often, knowledge is power.  

In the old days, when dinosaurs roamed the earth and getting online involved your computer making eldritch shrieking, Google was a website that took whatever you typed in and gave you a list of links that best matched what you were searching for. As it's grown beyond that, however, the core function of Google Search has moved from giving you the best answer to your query to a number of other things, most of them about making money for Google. 

This is obviously not a new observation. It's at the core of what EFF Special Advisor Cory Doctorow named "enshittification." But it's important to remember that whatever shiny new name or technology is wrapped around these tools, it's not about the wrapping, it's about the monetization. 

In the case of Google Search, the company has a history of rolling out new "features" that are less helpful to the searcher and more designed to keep you and your data within the Google ecosystem. One easy example of enshittification is putting sponsored links and ads at the top of search results, forcing you to scroll down past a bunch of not relevant links to get to your answers. Or, in some cases, accidentally clicking on sponsored links that might be designed to give you the opposite information of what you're looking for or for a competitor to the product you intended to buy.  

The other clumsy version of this is Google's self-preferencing, where Google's own services—say YouTube if you're looking for a video—are weighted so that they appear at the top of a search over a competitor's. Similar to this was Google's push for websites, particularly news ones, to be made available via what it called "Accelerated Mobile Pages" or AMP, which in theory stripped out features that might make loading a page on mobile too slow, but also handed over control of how webpages looked on mobile to Google and turned mobile links, often by default, into Google links.  

But the other way that Google has historically kept your—and your valuable eyeballs—on its website has been to just obviate the need to even click on a link and leave Google at all. The first version of this was what Google calls "knowledge panels." These are snippets of information shown on the results page of a search that purport to answer your question. Knowledge panels predate the AI push and haven't always been what you could call accurate.  

Knowledge panels are extremely similar to the AI summaries we now see at the top of Google Search results, except that instead of pulling quotes from specific linked sources, it's the AI doing the summarizing, though also sometimes with links. They are basically the same thing, mostly changed only in branding, because AI is now the cool kid on the block. The goal is essentially the same—it's less about providing you with the best answer to your query and more about making you think it's unnecessary to click a link and leave Google's ecosystem. And, more importantly, it keeps you on Google's pages longer to read the content. More time on the page is more time exposed to ads and sponsored links and more money for Google.  

The biggest irony here is that it didn’t even work. People choosing to use “AI mode”—and possibly made accustomed to getting information as text instead of links through the knowledge panels and the AI summaries at the top—has caused “lower monetization” via ads. Ads, remember, are Google’s main source of revenue. Like newspapers before them, Google is finding that counting on a monopoly on ad space maybe isn’t the most sound strategy in a shifting technological landscape. And to get out of the hole it has made for itself, it is lighting cash on fire to try to get back on top. Perhaps they should consider pivoting to video.  

Every time you see a feature like this, no matter what it is called or what "new" technology they claim fuels it, remember that it is Google's monetary incentives that drive the decisions and not necessarily the tech itself. And you can always choose to ignore it, scroll past, disable it, or even go to another service entirely.  

The U.S. Postal Service used social media surveillance to monitor and report on protests across the political spectrum, government records show.

The records, disclosed to EFF and other requesters suing the postal service under the Freedom of Information Act, show that the agency’s internet Covert Operations Program, or iCOP, routinely sifted through social media posts organizing and discussing protests with little records of any oversight or legal justification.

EFF filed suit in 2021 after Yahoo News disclosed the program’s existence and how the agency used it to monitor First Amendment protected activities. After years of delays and technical failures that led the agency to lose access to a trove of emails discussing the program, the postal service disclosed records to EFF and several other requesters this year.

The disclosures include a series of bulletins created from iCOP, which show that the postal service used the program in 2020 and 2021 to monitor and circulate information about a wide range of planned protests. They included a planned “Million MAGA March,” a guns rights advocacy event and counter-protest in Virginia, a nationwide Save the Post Office Saturday protest, and planned protests in front of then-Postmaster General Louis DeJoy’s home in Washington, D.C.

Many of the bulletins provide dry descriptions of the events being planned and reference public discussions or events on major social media services. Others seem to imply or anticipate that the protests would turn violent.

For example, in discussing planned national and international protests scheduled for March 20, 2021, the bulletin references potential violence in light of “online inflammatory material.” Yet the bulletin acknowledges that the agency has “no intelligence to suggest specific threats.” This bulletin was described by Yahoo News when it disclosed iCOP’s existence.

Another bulletin discussing an ongoing Black Lives Matter protests in response to police shooting and killing people styles itself as a “National Civil Unrest Update.” The bulletins also recount and monitor threats sent to then-Postmaster DeJoy.

The Postal Service also disclosed three email chains to EFF that, while heavily redacted, show how the agency queried iCOP and disseminated what it found (Read the emails here, here, and here). The government agreed to release the email messages as part of settling EFF’s FOIA suit this fall. To EFF’s knowledge, they are the only existing materials that reflect how the agency queried iCOP.

According to the agency, after Yahoo News disclosed the program in 2021, the postal service renamed it and publicly said that it had stopped issuing bulletins. But the documents do not say that the agency’s social media surveillance stopped.

At the same time, EFF and several other FOIA requesters sought records detailing how the agency used iCOP and what rules the postal service had for using the program and distributing information it gained from surveilling social media. EFF spent years pushing the agency to disclose email communications about the program, which the agency had stored on an external hard drive. Amid these negotiations, someone dropped the hard drive, rendering it inoperable, agency officials said. By the time that happened, the agency had already deleted the underlying email messages pursuant to the agency’s retention schedule.

EFF’s FOIA request sought internal rules, guidance, and training that would show what safeguard the Postal Service imposed to protect First Amendment rights. The agency disclosed very few documents in response to this part of EFF’s request.

For example, a series of slides give an overview of the program, but do not explain how officials used iCOP. The closest thing to internal guideline that the agency disclosed were talking points the Chief Postal Inspector authored in response to questions about iCOP.

The inspector wrote that, “In reviewing social media postings to gather information we did not single out any particular group and did not base what was reviewed on race, religion, gender, sexual orientation, immigration status, or a person’s exercise of First Amendment freedoms.” The statement echoes language in the bulletin stating that its purpose is not to infringe on First Amendment rights; Other parts of the talking points characterize the surveillance as providing officials with situational awareness.

The postal inspector’s talking points go on to say that “the recent attention on iCOP has highlighted opportunities for improvement, including enhanced executive oversight. We have stopped the distribution of the bulletins like the one you have seen in the media reports.”

Setting aside that it’s unclear whether internal oversight occurred or resulted in any changes, the claim that iCOP did not infringe on First Amendment rights rings hollow. As the records disclosed show, surveilling and reporting on social media users’ efforts to organize rallies and protests was a feature of iCOP.

But more fundamentally, the claims by Postal Service officials fail to recognize that surveillance directly chills First Amendment rights. Further, the government can misuse the information it obtained as part of its social media surveillance to harass or retaliate against those exercising their constitutional rights.

Although EFF’s case seeking records about iCOP has ended, we will continue to bring more transparency to the government’s use of social media surveillance and look for ways to challenge the practice, especially when people are caught in the dragnet for exercising the First Amendment rights.

The government’s surveillance powers grew rapidly after Sept. 11, 2001, some in public view and some in secret. EFF suspected but couldn’t prove that the National Security Agency was spying on Americans' communications. The New York Times sat on a story about it for over a year, finally publishing it in December 2005. Then, in January 2006, a retired AT&T technician named Mark Klein walked into EFF's office with a manila folder of documents that blew the story wide open. 

Welcome to the third episode of “Privacy’s Defenders,” a podcast about the people – lawyers, journalists, hackers, and others – who’ve fought to secure your digital liberties since before most people even knew what the internet was.

%3Ciframe%20height%3D%2252px%22%20width%3D%22100%25%22%20frameborder%3D%22no%22%20scrolling%3D%22no%22%20seamless%3D%22%22%20src%3D%22https%3A%2F%2Fplayer.simplecast.com%2Fe7dd937c-3319-4a9a-9245-f9ed34b9419d%3Fdark%3Dtrue%26amp%3Bcolor%3D000000%22%20allow%3D%22autoplay%22%3E%3C%2Fiframe%3E Privacy info. This embed will serve content from simplecast.com

(You can also find this episode on YouTube.)

In this episode, former EFF Executive Director Cindy Cohn talks with former EFF lawyer Kevin Bankston, who was at his desk drafting a lawsuit against AT&T when Klein showed up. Less than two weeks later, EFF sued the phone company on behalf of its own customers in Hepting v. AT&T. Cindy speaks again with now-retired Justice Department lawyer Tony Coppolino, who asked for the opportunity to defend the case. He called EFF with a warning after Klein’s documents were filed in court: If they were classified, EFF would be in big trouble. You’ll also hear from Klein himself, and from Carolyn Jewel, a romance novelist and AT&T customer who became the lead plaintiff in EFF's related case against the NSA. 

It's the story of a secret room in a San Francisco phone company building, a heroic whistleblower, and the people who refused to let mass surveillance stay hidden. 

The “Privacy’s Defenders” podcast is a follow-up to Cindy’s book, “Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance,” bringing to life pivotal moments in the voices of those who fought for your rights. Sales of “Privacy’s Defender” benefit EFF, so pick up your copy today!  

Joanne Elgart Jennings co-produced and created this podcast.   

Jarrod Sport co-produced, mixed, and mastered it.   

Corinne Ruff is our story editor. 

We had additional help from Rachel Estabrook and Alison Broverman. 

The original music was composed and performed by Nat Keefe of Hot Buttered Rum with Ben Andrews on the fiddle. 

On November 11, Lina Attalah, founder and editor-in-chief of the independent Egyptian news outlet Mada Masr, will face trial for the second time in just two weeks. This time, she faces charges of spreading false news, an accusation that has become one of the Egyptian government's most frequently used tools for prosecuting journalists. 

The trial follows a conviction on October 27, when Attalah was found guilty of managing an unlicensed news website. The Mada Masr team had repeatedly applied for a license, but their attempts went unacknowledged. The proceedings took place in a single hearing, which Mada Masr states included serious violations of her right to a fair trial. She was sentenced to the maximum fine of 3 million Egyptian pounds (approximately 55,000 USD), forcibly removed from the courtroom, and held for seven hours until the fine was paid. The court also ordered Mada Masr's closure and the confiscation of all equipment belonging to the organization. 

The current wave of repression has also targeted Matsada2sh, a fact-checking and open-source intelligence initiative. Its entire six-person newsroom was violently arrested, illegally detained, and interrogated under torture before being charged with terrorism-related offenses and spreading false news. The team remains in pretrial detention. 

According to CPJ, at least 25 other journalists are currently incarcerated in Egypt. 

Governments seeking to control the flow of information increasingly rely on a combination of legal harassment, financial pressure, criminal prosecution, and restrictions on the infrastructure that makes independent publishing possible. Egypt's media licensing regime is a particularly troubling example. Requiring news organizations to obtain government authorization to operate creates an obvious mechanism for restricting who gets to publish and whose voices are allowed to reach the public.  

The charge of spreading false news is similarly dangerous. Governments around the world have increasingly invoked the language of misinformation to justify restrictions on speech, often without meaningful safeguards against political abuse, as we laid out in our recent submission to the United Nations Office of the High Commissioner for Human Rights. Governments should never be the arbiters of which reporting is permissible, particularly when that reporting concerns their own conduct. 

Founded in 2013, Mada Masr has spent more than a decade doing the kind of journalism that authoritarian governments find most threatening: documenting abuses, amplifying marginalized voices, and reporting on issues that powerful institutions would prefer remain hidden. 

Its reporting has given torture survivors and the families of political prisoners a platform. It has opened space for debate about reproductive rights. It has brought frontline reporting from Sudan and Gaza, and stood alongside refugees facing xenophobic attacks and security crackdowns. 

Emerging as a digital-first publication, in a media environment where traditional outlets were increasingly constrained, being purely digital allowed Mada Masr’s founders to build an independent publication outside the structures of legacy media.  

At a time when only 43% of Egyptians had access to the internet, going fully digital meant taking a big risk, but it was one that has been rewarding: Despite being blocked by the Egyptian government since 2017, Mada Masr has continued to reach Egyptian and global audiences, and Attalah has received numerous accolades, including the Knight International Journalism Award, the Ordre des Arts et des Lettres, and a spot in TIME Magazine’s 100 most influential people (2020). 

Mada Masr has also consistently engaged with technology and advocated for a free and independent internet for the global majority. It has covered dozens of hot-button tech stories in recent years, from Egypt’s Cybercrime Bill and Israel’s use of AI weaponry in Gaza, to stories about the “privacy chaos” caused by biometrics to more personal essays about the importance of the internet and tech. In August, they launched an open call for proposals on original critical reporting on artificial intelligence. 

Mada Masr may be thoroughly Egyptian, but it doesn’t belong just to Egypt. Its team has made into a publication that represents the kind of independent, local, grounded journalism that international audiences need, particularly at a time when international reporting on state repression is lacking. They built on-the-ground networks to center local voices in Sudan (publishing in both English and Arabic on the conflict) and Gaza out of a sense of cross-border responsibility and solidarity. 

This is precisely why its potential closure should concern everyone who cares about a free press. The ability to publish independently, investigate powerful institutions, and to share information without government interference is fundamental to the exercise of free expression.  

The international community has repeatedly expressed concern about restrictions on press and internet freedom in Egypt. More than 100 organizations have now joined statements of solidarity with Mada Masr, and with Matsada2sh.  

These expressions of support matter, particularly when journalists are increasingly isolated and under threat—but solidarity must also translate into sustained political and institutional pressure. 

The international governments and institutions that maintain relationships with Egypt—including those in the European Union, the United Kingdom, and the United States—should make clear that the prosecution of journalists and the forced closure of independent media outlets are unacceptable.  

The cases against Lina Attalah, Mada Masr, and Matsada2sh must be dropped. The journalists who remain in detention must be released. And Egypt's licensing regime, with its profound chilling effects on access to information and independent knowledge production, must be brought to an end. 

There is a particular urgency to defending independent media at a moment when governments are finding ever more ways to restrict the circulation of information. Whether through internet shutdowns, platform restrictions, surveillance, or the criminalization of reporting, the result is often the same: fewer opportunities for people to understand what is happening around them, to challenge official narratives, and to hold power accountable. 

We cannot allow the closure of one of Egypt's most important independent newsrooms and the prosecution of its editor-in-chief to become another routine episode in the global erosion of press freedom. Nor should we wait until the last independent journalists have been silenced before recognizing what has been lost. 

To learn more about Lina Attalah in her own reads, you can read our Speaking Freely interview from January 2026. 

In courts across the country, publishers and creators are suing large AI companies for training generative AI models on copyrighted works. It’s easy to see these cases as a David-and-Goliath showdown between authors and publishers fighting for a cut of Big Tech company profits. But this fight is actually much larger. It affects billions of people who aren’t represented in the case at all, including researchers, artists, activists, journalists, people with disabilities, and anyone who accesses and shares content online.   

That’s why EFF is stepping in to defend the public’s rights in these cases. Today, EFF filed an amicus brief in In re OpenAI, explaining how the court’s ruling on fair use could impact people worldwide. If fair use gets narrowed, it will impede work that benefits the public, like medical research and investigative journalism, and even limit access to privacy protection tools.

Let’s be clear: creators and workers deserve support as AI changes their fields, and Big Tech companies must be held accountable for the harms they cause. But giving copyright holders more control over the web won’t accomplish either of these goals. If the plaintiffs prevail in these cases, courts would have to rewrite copyright law in ways that hurt everyone except powerful media and tech companies.

Copyright exists for one reason: to stimulate creativity and innovation in service of the greater public good. Unfortunately, the plaintiffs in this lawsuit are arguing to limit everyone’s fair use rights, in ways that would thwart the basic purpose of copyright. The harms of shrinking fair use will go far beyond generative AI, impacting everyone.

Initial speculation that AI models would be infringement machines, churning out works highly similar to those on which they were trained, has proven unfounded. And courts have already found fair use in cases where copyrighted works were used to train generative AI models, recognizing that training uses those works for a fundamentally different purpose.

Plaintiffs in these cases argue that, even if the use is transformative, using their works to train AI is still unfair, because the AI models could generate new, non-infringing works that might compete with plaintiffs’ own works. They also argue that scraping or downloading the data without permission—or in some cases, from websites containing infringing copies—was independently infringing and/or rendered any subsequent uses of that data unfair.

These arguments would put beneficial research and reporting at risk. First, if copying without permission rules out fair use, the law will never protect transformative uses that benefit us all. Researchers, journalists, and other watchdog groups gather information the same way AI companies do—but they do it to serve the public interest, and often to hold Big Tech itself accountable. For example, journalists and nonprofit researchers have used “crawling” or “scraping” to investigate potentially anticompetitive practices by tech companies, and research misinformation and hateful content posted on X. Their data acquisition techniques are virtually identical to those used by AI giants—but they lack those companies’ deep pockets.

Requiring users to show that copyrighted material was lawfully obtained would also threaten everyday internet use. As EFF’s brief explained, that requirement would “cast legal doubt on the billions of copies we collectively make every day through routine online activities like opening emails, clicking on an embedded link, visiting websites, sharing pictures, streaming music, and watching videos. All of this activity requires intermediate copying.”

Fair use is what lets us all use the internet without being compelled to track the source of every image, video, and article that we click on, and make sure the rights are all cleared.

Additionally, while rightsholders are understandably concerned about competition from AI generated works, copyright law exists to promote new creation, not protect authors who published first. Under the plaintiffs’ theory, no one could stand upon the shoulders of giants. Copyright could prevent people from writing new books inspired by themes in a favorite novel or genre, or prevent academic researchers from publishing literature reviews that distill insights from prior research—simply because readers might prefer those new publications over those that came first.

Finally, general-purpose AI models are neither designed nor usually used to create works targeted at any particular market. These models have been used to generate new insights and tools for medicine, science, journalism, art, and accessibility. For instance, an AI-powered tool called Be My AI uses Open AI’s GPT models to provide visual descriptions for people who are blind or have low vision. Generative tools have also accelerated scientific research, and researchers have used these tools to develop new medical treatments and medications for conditions previously thought to be incurable.

Some creators and publishers argue that AI developers should just get a license. But requiring permission for every work used would give the largest companies massive advantages over small competitors and impede academic research. As Professor Lawrence Lessig recently noted:

If all training requires a license, then none but a handful of tech giants will be able to afford the costs of training. That’s not because authors are greedy but because the copyright system is the least efficient property system known to man.

Moreover, creators are unlikely to benefit from these licensing arrangements in many cases. Media and entertainment giants have exploited the imbalance between themselves and underpaid working artists for decades. Trying to help creators by giving them more rights under copyright is, as Cory Doctorow has written, like trying to help a bullied kid by giving them more lunch money for the bully to take. Artists aren’t getting good deals from record labels or publishers now; there’s no reason to think these companies, which already own the copyrights, will treat artists more fairly once they control the data that powers AI.

AI technologies will affect all of us, and copyright law is ill-equipped to address many of these consequences. The rules governing these technologies should be rules that serve the public—not just the small number of companies that can afford to litigate copyright battles for decades, or settle for billions.

Developers of virtual private network (VPN) apps are reporting that their products are again being pulled from Apple’s App Store in Russia. This is an unacceptable crackdown on a vital tool to protect privacy and speech online.

Why? VPNs give people a way to control their own online activities. When you visit a website through a VPN, that website only sees the VPN server's location (well, IP address) rather than your actual location. It's like sending a letter through a P.O. box so the recipient doesn't know where you really live. It can also disguise where you’re accessing information from, which can make it possible to access information banned by your government.

This is an unacceptable crackdown on a vital tool to protect privacy and speech online.

Going after tools that give people the space to communicate and access information freely is a common tactic from the totalitarian playbook. This latest demand comes after several steps the Russian government’s taken to surveil speech specifically on Apple products. In 2024, the Moscow Times reported that Russia’s state media watchdog, Roskomnadzor, went after VPN apps on the Apple App Store, after banning access to Western social media platforms and blacklisting opposition media sites. Russia then blocked Apple’s FaceTime software in 2025, according to Apple Insider.

Bloomberg also recently reported that the Russian government has added Apple and Microsoft to its state surveillance registry. This gives Roskomnadzor access to local users’ correspondence, Apple Insider reported, and puts both companies in a position to turn over customer information to the country’s security services as required.

With government control encroaching on their devices and less access to tools that give them alternate methods, people in Russia are left with shrinking options to communicate online or find information that isn’t state-sanctioned.

While Russia’s actions offer a more extreme vision of what happens when the government tries to enforce speech rules by attacking vital privacy tools, it is far from the only government doing so. Several states in the U.S., bent on making it difficult to circumvent invasive age-gating laws, have suggested banning VPNs—either to access certain content or in some cases to simply ban them outright. EFF has publicly (and loudly) criticized these proposals, because going after VPNs is a dangerous step down the road of censorship.

Attacks on speech and privacy online are deeply troubling, no matter where they happen. What those in power may see as a “loophole” in their invasive laws is actually an expression of user control. We’ll continue to speak out when we see governments going after them to take that control away.

In today’s digital world, the internet is an essential resource for young people to access information, explore community, and find themselves. But we know that this often comes alongside fears of experiencing online harms like doxxing, grooming, or bullying.

Trying to protect your family from everything all the time is impractical and exhausting, but some thoughtful planning can help families devise a workable plan that meets their needs and addresses their concerns.

That’s why this Digital Parent Week, we’re sharing easy tips on how parents and their children can work together to co-curate a digital safety plan that helps all members of the family enjoy the benefits of technology while protecting their online privacy and safety. 

Online safety begins with communication, not just restrictions. Talk with a young person about how they use the internet: their favourite apps, games, and social media platforms for example. Creating a supportive environment helps young people feel comfortable asking for help if something goes wrong online.

Together, you can think about:

1. What do we want to protect? e.g., I want to protect a young person’s privacy and mental health when they’re playing Roblox. They love Roblox and use it to communicate and hang out with their best friend, so we’d like to find a way to make it as safe as possible.
2. Who do we want to protect it from? e.g., messages from strangers, staying up too late playing, wasting money on pointless digital junk in games.
3. How bad are the consequences if we fail? e.g, losing some money on a scam or having creepy conversations with strangers that could escalate into something more nefarious or dangerous.
4. How likely is it that we will need to protect it? e.g., I don’t know the likelihood of a stranger messaging you on Roblox because I’m not sure how communication works on the platform, but I’ve heard from their friends that strangers message them all the time in some games.
5. How much trouble are we willing to go through to try to prevent potential consequences? e.g., I’m willing to learn from my child how the game works, play the game with my child, and learn how to work the parental controls. 
6. Who are our allies? e.g., my partner, our parents, as well as a young person’s best friends and their parents.

It's easy to think of a young person's experience on the internet as being totally disconnected and different from your own. But now is a great time to also interrogate your own internet habits, like the sorts of sites you engage with, tools you use, and privacy settings you've set. These questions are as valuable to help you as a parent as they are just an internet user.

Sometimes even just figuring out what conversations are worth having can take some effort, we've put together some ideas to get you started in our guide.

Digital security training can feel overwhelming but this is why a community-oriented approach helps. In speaking with your family and friends, you can build out digital security practices that work for you. This makes it more likely that your privacy practices will become second nature to you and your loved ones.

Use secure messaging services for every communication: Choosing a secure service ensures that your privacy is protected from government and corporate surveillance. If you can convince your family to get on board, options like Signal provide the most extensive privacy protections out of the box through its use of end-to-end encryption and limited data collection. But we understand that sometimes it's easier to stick with whatever the family already uses for a group chat, like WhatsApp, Apple's iMessage, or Google Messages, so take the time to familiarize yourself with the limits of WhatsApp and RCS encryption.

Consider the content posted online: It's easy to accidentally share personal information through photos, messages, and other content. Children and adults may unknowingly share personal information through photos, messages, location settings and app permissions. Take time together to review privacy settings, check which apps can access the camera or location, and discuss why personal details should be shared carefully. Make sure you have family agreement about when and where to post photos of each other or your home.

Create incident response plans: Developing a plan for if or when something bad happens is a good practice for anyone, but especially with younger people. It’s important to strategize with your family around what to do in the event of such things happening, and doing so before an incident occurs is much easier than when you’re presently facing a crisis.

Alongside this, simple steps like using strong and unique passwords on all devices, including those that are shared in the family, can make a real difference. Regardless of age, there’s no time like the present to get started on good security hygiene, and for many that starts with a password manager and two-factor authentication.

Many sites permit parents to control features such as personalization, algorithmic feed, autoplay, endless scroll, reactions, notifications, and time limits. Talk as a family about which features are important and useful and which are problematic. The conversations above around boundaries and digital literacy are a more effective way to prepare youth for accessing the internet. To develop true autonomy, young people need the privacy to discover the world for themselves without their parents monitoring the contents of every conversation they have.

Explore new apps together and revisit family rules as they grow. These decision points where you’re exploring with a young person what you’re both comfortable with can be good moments to “find your way to a yes” for whatever feature or tool or game they’re asking about. The questions they ask, along with your responses, provide a road map for what to look for in privacy controls that can get you to a place where everyone is comfortable engaging with that technology. 

There is no one size fits all to the tech questions and concerns a parent will face, and keeping young people safe online is not about removing every risk and monitoring every click. This Digital Parenting Week, you can start to focus on what’s important for your family and how to best achieve those goals. 

If you're still not sure where to start, installing EFF’s Privacy Badger on every computer in your household is a great starting point to protecting everyone's privacy.

For more detailed information on all these tips and more, visit EFF’s Online Privacy Guide for Parents and Youth.

In the most recent update to Apple’s devices, iOS 27.2, the company has introduced a new setting to “Exclude Apps” from Siri AI, fulfilling one of our asks from our Encrypt It Already campaign earlier this year.

One of our main concerns with new AI features on devices is how those features interact with end-to-end encrypted content, particularly with secure messaging apps. Many AI features require cloud processing, and despite privacy protections engineered into these systems, the content of secure messaging apps may leave a user’s device without their knowledge. That changes the privacy concerns around using those tools. In a perfect world, users would be able to put a barrier up to ensure data from certain apps doesn’t leave the device. Here was our initial ask:

You should be able to tell the operating system’s AI to not access an app, even if that comes at the “cost” of missing out on some features. The setting should be straightforward and easy to understand in ways the Gemini and Apple Intelligence controls currently are not.

At launch, we found the settings to control Siri AI’s app access behavior pretty confusing. You had to toggle several options to block Siri AI off from accessing an app, or disable Siri AI entirely. Turning off Siri AI and reverting to Siri Classic is, for now, still a good option if you’d prefer to use the older version.

The most recent update is far more clear and does more to protect your data. And, just as expected, it comes at the cost of some features. That’s a good thing, actually. The features not working shows that the new setting is effective. 

Here’s how to add apps to the exclusion list, once you’ve updated to 27.2:

• Open Settings > Siri > Excluded Apps
• Tap “Add Apps” and select any apps you’d like to add to the exclusion list

Now Siri AI cannot access the contents of the app. Excluding an app also means you may lose some features. For example, if you exclude the Apple Messages app, you will no longer be able to have Siri AI read or respond to messages for you. Even the “onscreen awareness” feature, where you invoke Siri and ask it for information about what you’re currently looking at, will not work anymore. For example, if you exclude Signal, you cannot invoke Siri and ask it to discern any information in the Signal app. You’ll just get these messages:

This update from Apple is also a good excuse to check in on the process on Android. It has improved a little, but is not as straightforward as Apple’s new settings, and lacks the ability to set the screen context feature per-app. But you do have some control over what Gemini can access: 

• Open up the Gemini app
• Tap your user photo, then Settings > Personal Intelligence > Connected Apps
• Revoke access to any apps you do not want Gemini to have access to

This process seems to work well enough for some data and we like that it’s opt in, but it’s not exactly intuitive. For example, Signal doesn’t appear there because Signal doesn’t support Gemini’s app access feature at all. That means Gemini can’t access the content of Signal directly, which is good. 

But Gemini can read notifications if you’ve enabled the “Device Assistance” Connected App (which you likely have, since that also enables basic features, like setting a timer—check under Settings > Personal Intelligence > Connected Apps), and it can use screen context unless you’ve disabled the Device controls > Screen context > “Use screen and app data” option in the Gemini Settings. These two features may access the contents of the Signal app or notifications, if you choose to use them. We’d prefer a more hard-lined approach that reduces the chances of user error here: Google should give users the ability to turn these features off per app.

Apple clearly understands that some users want stronger controls over what Siri AI can and cannot access. But we think they should go further and offer the option to only use “on device” AI features, similar to what Samsung offered with its Galaxy AI. We’re happy to see this change and think all operating systems need to consider similar controls moving forward.

A federal appeals court should curb the government’s abuse of grand jury subpoenas to unmask social media users who criticize lawless immigration enforcement.

That is the message from the ACLU, EFF, and other civil liberties and trade groups who filed a friend-of-the-court brief in a sealed case in the U.S. Court of Appeals for the District of Columbia.

The case involves the government’s investigation of an anonymous Reddit user who commented on a post about an immigration officer in Minnesota. The Department of Homeland Security (DHS) first issued an administrative subpoena to Reddit to unmask the user. When the user challenged the subpoena in court on free speech and statutory grounds (as many others have), DHS withdrew it. But then the government obtained a separate grand jury subpoena—a subpoena issued by a prosecutor to gather evidence to present to a grand jury before any criminal charges are filed—for much of the same information. The user then challenged the grand jury subpoena too, and the case is currently being appealed.

The right to speak anonymously is essential. It preserves privacy and shields critics from government retaliation. In the past year, the Department of Justice (DOJ) has issued grand jury subpoenas to social media companies for their users’ personal data. This is frequently done for improper purposes and without really showing that social media users have committed any crime. These subpoenas have the effect of intimidating and chilling critics, as immigration authorities have engaged in invasive, unconstitutional, and sometimes violent conduct.

As the amicus brief makes clear, courts should not defer to the government’s claims regarding the legitimacy of using grand jury subpoenas to unmask internet users. Instead, the subpoenas must receive proper First Amendment scrutiny. Like many other types of legal processes, grand jury subpoenas are issued by federal officials without prior court approval. And they too can be abused to harass or retaliate against people critical of the government.

The amicus brief was filed in early September and recently unsealed. The brief was signed by the American Civil Liberties Union of DC, EFF, the Center for Individual Rights, the Foundation for Individual Rights and Expression, the Cato Institute, and NetChoice.

It is notable that NetChoice signed the amicus brief. It is a trade group that represents many companies who have received similar subpoenas including Reddit, Google, Meta, PayPal, among others. EFF has called on these companies to do more to defend their users’ speech and privacy rights in the face of these subpoenas.

When we give our private information to the government to pay taxes, apply for a job, or vote, we should be able to trust that our data won't later be used against us. But in a betrayal of that trust, the federal government has been pooling the information it has about us on an unprecedented scale—and using it for purposes we never agreed to.

EFF and other groups are fighting back. In our latest EFFector newsletter, we're talking about a recent victory in our lawsuit against the government for sharing federal workers' confidential personnel files with DOGE.

JOIN OUR NEWSLETTER

For over 35 years, EFFector has been your guide to understanding the intersection of technology, civil liberties, and the law. This issue covers our free tracker blocker coming to Safari, a call to action for net neutrality in California, and a big win in our lawsuit against the DOGE data grab.

Prefer to listen in? EFFector is now available on all major podcast platforms. This time we're talking to EFF's F. Mario Trujillo about the dangers of government data grabs—and what defenders of privacy are doing to stop it. You can find the episode and subscribe on your podcast platform of choice:

%3Ciframe%20height%3D%22200px%22%20width%3D%22100%25%22%20frameborder%3D%22no%22%20scrolling%3D%22no%22%20seamless%3D%22%22%20src%3D%22https%3A%2F%2Fplayer.simplecast.com%2F59368254-4a09-4fcf-89fc-911a7c26dcc9%3Fdark%3Dfalse%22%20allow%3D%22autoplay%22%3E%3C%2Fiframe%3E Privacy info. This embed will serve content from simplecast.com

Want to protect your right to digital privacy? Sign up for EFF's EFFector newsletter for updates, ways to take action, and new merch drops. You can also fuel the fight for privacy and free speech online when you support EFF today!