Google is rightfully facing blowback for forcing K-12 schools to enable AI if they wanted to keep using Google search. The company quickly backtracked and decoupled and turned off the services by default, but made it clear search will continue to be just another AI chatbot. This mandate forces an ultimatum on educators: accept generative AI or de-google your school.

Students, teachers, and parents across the U.S. are now years into an argument about how schools should respond to the growth of AI-enabled tools. Google decided to skip this debate and take this choice from schools. In August it activated AI chatbot Gemini for 150 million K-12 students on Google Classroom, leaving educators scrambling to respond. A few months later, Google introduced a new way to turn it off — but now administrators would also be turning off Google search.

Google walked this back somewhat, clarifying that Gemini, Gemini notebook, and Search will have their own controls and will be off by default. But because of Google’s broader approach to force AI on all search users, this change is still an example of a tech monopolist pushing unwanted changes into the classroom.

Tying AI to Search

It’s no secret that the biggest companies in AI  are operating at a huge loss, in the hope they can follow Uber’s enshittification playbook. Offer a cheap convenience at a major loss until old systems atrophy, then flip the script to reduce wages and raise consumer costs—whether that’s paying with cash or with data. 

This puts Google in the odd position of an incumbent, with around 90% of search traffic. It needs to not only make good on its own AI investment, but protect its dominance from new AI tools. It’s not just enough to offer its own AI mode, it needs to turn search into AI mode, while engaging in clumsy self-preferencing that is eating its own ad revenue.

The problem with this approach is the public is split on AI, to put it mildly. Some users will welcome these changes, but the rest are stuck in an all-or-nothing bargain. Anyone concerned  about the accuracy of AI overviews or their impact on click-through rates for online communities and small publishers can just deal with it. The bet is any inconvenience in switching to an alternative is enough to keep you trapped.

Google can and should offer a way to disable AI overviews. Smaller services like DuckDuckGo* and Brave search have simple and persisting AI settings which don’t require login. These services also don't mince words and make a distinction between generated AI summaries, suspected AI results, and the backend use of AI to curate links. 

It’s not enough to point to opaque workarounds, either. Adding “-ai” to your Google search will usually remove AI Overview, but so will “-unicorn”. This trick isn’t meant to be an AI off-switch, it’s a quirk of how AI Overview was implemented and can change at any time. These tricks also don’t generalize well to settings for system administrators. Hacks might work for now, but everyone—including administrators—deserve clear set-and-forget controls for the tools they rely on.

Pushing AI on Schools

De-googling your life isn’t easy, and for schools it can be even more difficult. For decades Google has gone after schools to foster life-long Google users—resulting in many institutions being deeply entrenched in its ecosystem despite data privacy concerns. That’s because schools face major switching costs when moving to a competitor. It takes more than flipping a setting—it means a lengthy contract process, staff retraining, and a cumbersome migration of past work. 

The difficulty of switching makes granular controls even more essential, particularly for a hot-button issue like generative AI. Few parents would send their kids to AI-driven schools, but they may want their kids to learn tools like search as they exist outside of the classroom. However, many parents and teachers concerned with AI disrupting learning are pushing major school districts to implement temporary AI moratoriums for young students. These pauses are meant to make sure any introduction of AI fits the needs of students and is done in a way that actually makes sure educators are prepared. 

But in either camp, this is a choice that must be made by schools, not Google. Teachers know more about what their students need than a trillion-dollar tech company, and this expertise should be respected in their own classrooms. 

Google’s self-preferencing and desperate attempt to eventually recoup on an AI money pit must be tempered with more fine-tune controls over generative AI. It’s in Google’s own interest to stop abusing its dominance to piss off users, advertisers, and school communities. It’s also Google’s responsibility as an adjudicated monopolist.

*DuckDuckGo is an EFF donor. EFF donors do not influence our agenda or our positions.

What does the digital future look like? Who gets to imagine it, shape it, and make it real?

Building a freer, more inclusive digital age requires not only challenging systems of surveillance and control, but also making space for creativity, community, and radical imagination. 

That's why earlier this year with the queer arts collective, we put out a call for submissions inviting people to explore the intersections of technology, identity, and digital liberation—whether that involved pointing the lens towards an underrepresented issue in digital justice efforts; sharing personal accounts of joy, pleasure, or sorrow under surveillance; or painting wide imaginations for our communities using technology for good instead of carcerality and doom.

And we’re excited to share that the project is now live! Desire Lines: Encoding Queer Digital Futures explores a digital world that dreams wilder and exists louder. Seven artists share their visions of digital liberation, spanning from early internet-coded yearning to escapist steamy chat rooms and seed-laced battle suits for revolution. 

These essays and stories remind us that digital rights aren't just about the existence of technology and its deployment as existing in a vacuum, but instead about how tech tools are a way for people to express themselves freely, find communities, explore identities, and build spaces to exist and seek joy without fear. Too often, conversations about technology focus on innovation, efficiency, and the next big thing while overlooking the people and communities most affected by the systems being built. This project was an effort to break containment and make space for something different: a chance to imagine digital futures rooted in queer creativity, resistance, and possibility.

Together with the queer arts collective, we were excited to launch the magazine and celebrate the artists and ideas that brought it to life through our session at Mozilla Festival last week, ‘Privacy x Queer Desire,’ where we started out by co-curating a community privacy plan grounded in digital fairness before launching the magazine. 

If the stories in Encoding Queer Digital Futures teach us one thing, it’s that we don't have to accept the digital future handed to us by oppressive governments and tech companies. We already have pre-Big Tech internet experiences encoded in our fondest memories that can inform our dreams for something better, and together we can build a new reality.

Read Desire Lines: Encoding Queer Digital Futures here.

“The safety of young people in the digital environment cannot be assessed without also considering the safety of young people in offline environments. For millions of young people around the world, the digital environment is their safe place, their haven from an unsafe physical environment, community, or family situation. The digital environment may be the best, perhaps only, place for them to find critical safety information and community, to explore ideas that are controversial in their families and larger physical environments, and to otherwise nourish their personal autonomy.

“For these young people, regulatory efforts that limit their access to online services or to certain features they find valuable, make their lives, in total, less safe, even if there has been some marginal safety benefit to their digital environment.

“The OHCHR must thus consider the whole of young persons' lives in any recommendations that come out of this process and not treat ‘safety, physical or mental health, and rights in the digital environment’ as disconnected from safety, physical or mental health, and rights elsewhere.”

So begins EFF’s submission to the global Call for Inputs on Child Rights and Safety in the Digital Environment conducted by the United Nations Office of the High Commissioner on Human Rights. The OHCHR is preparing a report on the issue to be presented to the UN Human Rights Council at its 64th session in the first quarter of 2027. The Human Rights Council requested the OHCHR to solicit input from a wide range of stakeholders, including child and youth perspectives, and convene five regional consultations to assess the risks to the safety of the child in the digital environment and best practices to address these risks in different geographical areas, bearing in mind current and emerging business models. 

The OHCHR acknowledges that young people today navigate a digital environment with both “unprecedented opportunities” and “serious and evolving risks,” and sets out a rights-based framing whereby “Children's 'safety' is therefore addressed through the full framework of their rights — with freedom from violence (Art. 19) and protection from exploitation and abuse (Arts. 34–36) as clearly defined obligations, situated alongside privacy (Art. 16), access to information (Arts. 13 and 17), expression (Art. 13), participation (Art. 12), and development (Art. 6). Protection and the full range of children's rights are understood as reinforcing rather than competing imperatives, and measures taken in the name of safety must not be used to restrict the enjoyment of other rights, such as the right to privacy and the right to participate.”

In light of this, EFF’s submission focused on the current general disregard for young people's speech and privacy rights by regulators around the world, all of whom seem far more interested in empowering parents rather than young people themselves, or meaningfully involving young people in the regulatory process. We emphasized the human rights-centered uses young people make of social media that were not specifically set out in the concept note. We also explained that too often, policy proposals aiming to remedy the issues of online safety for young people introduce limitations on access to online services and content rather than tackling the specific problems that people experience. 

More specifically, our submission looks at:

1. the most significant risks to young people’s safety in the digital environment
2. how digital product design and business models drive risks to children's rights online, including in AI-mediated services
3. the inclusion of young people’s views in the design, governance, and regulation of digital environments 
4. how equality and non-discrimination in access and protection can be ensured
5. the promotion of digital literacy, skills, and empowerment for young people 
6. the impact of legislative and regulatory measures from the United States to Indonesia and Australia 
7. importance of broader, more systemic interventions that can address address online harms
8. how global instruments and processes can protect young people online. 

The internet is where young people learn, find community, explore their identities, access important information, and express themselves. Curtailing these opportunities doesn't make them safer. And requiring everyone to hand over sensitive personal information just to access online spaces creates privacy risks for all users.

As the OHCHR has acknowledged, the solution to the issue of online safety should not require a choice between protecting young people from danger or protecting their rights. Instead of restricting access, governments should focus on the systems that create these risks in the first place; tech companies must be accountable for their design choices, data practices, and surveillance-driven business models; and young people need to be included in the decisions that affect them. 

Read our full submission here. 

On November 3, our colleagues at the Software Freedom Law Center, India (SFLC.in) received notifications from X that the Delhi Police had issued takedown requests targeting 42 URLs. Among the accounts and posts targeted were those belonging to SFLC.in, the Internet Freedom Foundation (IFF), and X account @geoblockedindia, as well as posts documenting legal notices and instances of online censorship. 

Takedown requests targeting SFLC.in and other digital rights groups threaten not only their work, but the public’s ability to know when and how online speech is being restricted. 

The requests cite grounds including hate speech, alleged defamation of the Hindu nationalist organization Rashtriya Swayamsevak Sangh (RSS), and concerns relating to safety and security. But the context in which these requests have emerged is particularly troubling: they target organizations and individuals whose work involves documenting restrictions on online expression and making those restrictions visible to the public. 

In other words, the organizations being targeted are among those trying to tell the public when and how its speech is being censored. 

SFLC.in is one of India's most important digital rights organizations and promotes innovation and open access to knowledge by helping developers make great free and open-source software, protects privacy and civil liberties for Indians by educating and providing free legal advice, and helps policymakers make informed and just decisions about use of technology. In 2025, we recognized their work with an EFF Award for Defending Digital Freedoms. 

IFF (the Internet Freedom Foundation) is another of EFF's close allies in India. Like EFF, IFF combines advocacy campaigns and strategic litigation to advance digital rights. They write frequently about internet shutdowns and have filed several lawsuits contesting them. 

Among SFLC.in's initiatives is its Free Speech Tracker, which documents instances of online censorship, content restrictions, and account takedowns in India. In a country where government orders to restrict online content are often opaque, this work is absolutely essential. 
 
Recent legal notices object to the tracker itself, as well as the organization’s documentation of restricted content and geo-blocked material. The allegations against SFLC.in include claims that it is "continuously opposing government directions" and publicly circulating information about restricted content, thereby undermining measures taken in the name of national security and public order. 

But documenting government censorship is not the same as undermining public safety. Reporting that content has been restricted is not an endorsement of that content, nor does it constitute an attempt to circumvent the law. It is an exercise in transparency and accountability, and one that allows journalists, researchers, civil society organizations, and the public to understand how governments exercise their power over the information landscape. 

Censorship thrives in the absence of transparency 

The use of legal complaints and platform takedown mechanisms against organizations documenting censorship creates a particularly troubling dynamic. When those who monitor restrictions on expression are threatened with having their accounts or reporting removed, the result is a chilling effect that extends far beyond the immediate targets. Other organizations or journalists may think twice before documenting controversial takedowns or challenging government orders, and the public loses access to an independent record of decisions that affect its ability to speak and access information online. 

There is also an important role here for platforms like X. Platforms must be transparent about the requests they receive, provide meaningful notice to affected users, and ensure that any restrictions are subject to appropriate scrutiny and avenues for appeal. When governments seek to restrict speech, platforms have a responsibility to avoid becoming opaque intermediaries through which censorship is quietly carried out. 

These developments are part of a broader pattern of pressure on independent civil society organizations working to defend freedom of expression and access to information in India. Digital rights groups play an indispensable role in documenting the effects of government policies, identifying patterns of censorship, and challenging restrictions that undermine fundamental rights. Their ability to do so independently is not a peripheral concern; it is a cornerstone of a healthy democratic society. 

The right to freedom of expression includes the right to scrutinize the exercise of government power. That includes the right to document censorship, question the reasons given for it, and make that information available to the public.  

EFF stands in solidarity with SFLC.in, the Internet Freedom Foundation, @geoblockedindia, and all those working to document and challenge restrictions on online expression in India. We urge the authorities in India to respect the rights of digital rights organizations to conduct their work without intimidation or retaliation, and to ensure that any restrictions on online expression comply with international human rights standards. 

 

California’s 2026 legislative session has officially adjourned and it’s time to reflect on the wins and losses that have shaped Californians’ digital rights landscape this year. This was the second year of a two-year legislative session, which meant several bills resumed their legislative paths from 2025.

EFF monitored nearly 100 bills in the state over the two-year session. These included proposed regulations on 3D printers, access to social media platforms, police, commercial, and workplace surveillance practices, AI, and other privacy concerns. While we saw some victories, alarming developments also raised serious concerns about the future of privacy protection in the state.

Celebrating Wins Use of automated decision-making and surveillance in the workplace

Governor Newsom signed vital protections on the use of automated decision-making in the workplace and workplace surveillance tools, specifically No Robo Bosses (SB 947) and AB 1883.

Championed by our labor partners, SB 947 limits how employers can use automated decision-making to fire or discipline workers, including provisions that ensure workers get vital information about automated decisions that affect them, and that an algorithm is not the only authority for these consequential decisions. Alongside it, AB 1883 prohibits the use of workplace surveillance to predict emotions or collect neural data. This stops employers from using potentially biased, invasive, and exploitative forms of AI surveillance at the workplace, marking an important step toward creating workplaces that respect the privacy and autonomy of workers. We look forward to continuing to ensure that technology in California’s workplaces is deployed fairly, thoughtfully, and with respect for all workers.

Protecting against federal overreach

EFF was also grateful to see Governor Newsom sign SB 747, which allows damages lawsuits against federal officials who violate the U.S. Constitution. Victims of constitutional violations deserve a complete remedy and this law also helps deter constitutional violations in the first place. Gaps in current law often make it difficult to seek a damages remedy against federal officials who violate the U.S. Constitution. This bill makes it easier to bring such litigation. Federal law enforcement officials have violated our First Amendment right to record on-duty police and other newsworthy subjects, and also sometimes violate our Fourth Amendment right to be free from unreasonable searches of our phones and laptops. When this happens, the people who suffer these violations should be able to sue these officials for damages.

Additionally, EFF supported two bills (which are now state law) that clarify and extend California’s shield laws to protect patients, healthcare providers, and others involved in reproductive healthcare and gender-affirming care that is legal in California. After the overturn of Roe v. Wade, California enacted numerous shield laws to protect people who provide, receive, or help others obtain healthcare that is legal in California. These laws prohibit California agencies and certain companies from helping other states enforce laws that punish this care. Yet the federal government and coordinated efforts in other states still threaten access to these legally protected healthcare services. AB 1854 addresses these threats by expanding coverage to more California businesses and individuals who receive legal demands, creating a notification process so the Attorney General can intervene to stop improper disclosures, and clarifying that law enforcement cannot arrest someone if the Governor refuses an extradition request. These protections serve as a necessary response to real and escalating tactics outside the state targeting lawful reproductive healthcare.

EFF also supported AB 1930 to protect confidential medical records from politically motivated investigations into lawful healthcare, empowering the California Attorney General’s office to meaningfully intervene and respond to out-of-state subpoenas or requests for data regarding protected care.

Young people online

EFF is dedicated to protecting the rights of young people online. We supported a handful of bills on digital literacy and cybersecurity education that were signed into law, such as AB 2071 on digital wellness instruction and AB 2298 on cybersecurity in educational standards. Unlike blanket bans, these bills address online safety through education rather than prohibition. Young people rely on the internet not just for entertainment, but for civic engagement, education, self-expression, and community—especially vulnerable youth who may lack support in their physical surroundings.

Real digital safety comes from preparation, not isolation. Research consistently shows that open, honest conversations about digital literacy and privacy with trusted adults are far more effective at protecting youth than restrictive censorship laws. Young people themselves recognize this need; in fact, AB 2071 was co-authored by a group of students actively seeking better resources to navigate their digital lives safely.

EFF and our allies were also able to stop the expansion of California’s dangerous age gating law from operating systems to browsers. The California legislature stepped back from their plan to expand the 2025 age-gating law and ultimately removed language from AB 1856 that could have compounded serious threats to users’ speech, privacy, and security just to browse the internet, and positively, removed the burdens on open-source operating systems.

Real digital safety comes from preparation, not isolation

While EFF still believes the underlying law that AB 1856 amends, AB 1043, is unconstitutional, we appreciate that the legislature did not expand this problematic age-gating framework to browsers. We were also pleased that an earlier amendment to AB 1856 reduced the threat to the open-source community by exempting open-source operating systems. Given these changes, EFF removed its opposition to AB 1856, and thanks the author for listening to concerns from advocates and developers.

Mourning Losses Updating California’s Information Practices Act (IPA)

EFF was proud to co-sponsor AB 1337 this session alongside our friends at Oakland Privacy and Assemblymember Chris Ward, who is also the chair of the legislative LGBTQ Caucus. The bill unfortunately failed to cross the finish line after stalling in the Senate.

AB 1337 would have updated California's foundational Information Practices Act of 1977 and extended its vital privacy safeguards present at the state agency level to counties and cities. Today, city and county governments collect vast amounts of sensitive personal data (from public health records such as vaccinations, to welfare assistance details, to license plate reader data) and administer programs that were likely not contemplated back in 1977. Yet the law has simply not kept up with modern data practices, and California still has no state law governing how local governments handle this information. While we could not build enough political progress to pass the bill this session, closing this local privacy gap remains an urgent need for California.

Social media ban

Another major setback was the passage (and subsequent signing) of a social media ban for youth under the age of 16 (AB 1709).

Technology and the laws that regulate it should support and empower young people, but AB 1709 falls far short of this goal. Using technology is how we learn and build community in today’s world, but laws such as AB 1709 cut young people off from essential information and experiences. They also particularly harm those already facing increased challenges who find safety in supportive online communities that they cannot always access in the physical world.

Technology and the laws that regulate it should support and empower young people

Denying minors access to digital forums or stripping out basic tools needed to navigate them will not make young people safer or healthier in the AI age. Research shows social media bans are ineffectual while denying young people opportunities to develop their own voices, share their art, practice religion, or engage in politics. These laws also hurt all of us. Age-gating requirements force everyone to give up more personal information. To verify who can pass through online gates, companies will collect even more data, concentrating power in corporate hands rather than protecting people. AB 1709 is also inconsistent with rights to free expression, meaning California will spend resources defending a law that will likely get tied up in court.

Gutting California’s Invasion of Privacy Act (CIPA)

CIPA was originally intended to protect personal privacy against surveillance and included a private right of action so consumers could hold corporations accountable in court. This is why EFF and allied organizations spent the two-year session strongly opposing SB 690—a bill we dubbed the "Corporate Cover-Up Act" for its attempt to weaken consumer protections in CIPA. Although SB 690 was narrowed from its original draft, we asked Governor Newsom to veto it because it strips away the law's private right of action—a vital tool for individuals fighting back against unlawful metadata surveillance. People deserve the right to decide whether to bring a lawsuit, which remains one of the most effective ways to deter corporate abuse. Unfortunately, the Governor signed the bill and even urged the legislature to go further next year. It's especially alarming to see this disregard for accountability as the federal government and law enforcement agencies seek data from businesses or data brokers to target people based on political beliefs, religious affiliations, or health decisions.

We expect to see further attacks on CIPA next legislative session, as Governor Newsom’s signing statement called for “additional work in this area” and urged the legislature to “take this on next year to ensure a fair balance between protecting private information and preventing rapacious litigation."

Banning the sale of sensitive personal information

California also missed the opportunity to join other states in restricting the sale of sensitive data. We are deeply disappointed that Governor Newsom vetoed AB 1542, which would have ensured sensitive personal information stays private by banning its sale outright. There's a nationwide movement to protect consumers by making intimate details off-limits for businesses to sell or share. From precise geolocation and genetic data to private messages, health records, sexual orientation, and immigration status, sensitive data reveals the most private aspects of our lives. Monetizing this information fuels financial scams, predatory pricing, and warrant-free government surveillance. By vetoing this bill, California not only fails to lead but falls behind other states, by missing a critical opportunity to protect our most vulnerable communities.

3D printing

The California legislature unfortunately also passed AB 2047, which aimed to make every 3D printer come pre-loaded with censorship software. It's a law that is trying to prevent an act that is already illegal in the state, and just won't work. It was part of a recent sweep of misguided state bills which purport to go after "ghost guns," but actually “enshittify” 3D printers by introducing privacy risks and a new way to restrict or upcharge users. Lawmakers even considered including misdemeanor charges that would have impacted people using alternative open-source programs. Fortunately an outpouring of opposition from makers and civil liberties advocates resulted in a bill so limited that, despite having passed and been signed into law, will not affect makers until ASTM International publishes a standard — something the organization had not been considering doing.

Where California Missed the Mark Consumer privacy

California lawmakers also missed key opportunities to curb commercial surveillance. EFF supported AB 2564, which prohibits retailers from engaging in surveillance pricing, the invasive practice that allows corporations to offer the same product to two different people at two different prices based on scrutiny of their personal data. Unfortunately, the bill stalled on the last day of session.

The legislature also failed to move AB 322, which would have safeguarded the privacy of Californians by placing restrictions on the collection, use, and sale of location data. Last year, EFF published a rubric for comprehensive location privacy laws, outlining baseline standards states should meet to shield individuals from pervasive location surveillance. Since then, states like Connecticut, Maryland, New Jersey, Oregon, and Virginia have enacted new consumer privacy restraints on geolocation data. Yet, even as these states move the ball forward, most of their laws leave significant gaps that still must be filled. California failed to make that change and protect residents from location surveillance.

Automatic license plate readers

California lawmakers have lagged in enacting meaningful limits on automated license plate readers with all proposed ALPR regulation bills failing to pass since 2022. SB 1013 initially appeared on track to pass with broad support, but ultimately stalled in the final days of the session.

EFF maintains high standards for ALPR legislation, favoring full bans or, at minimum, strict warrant requirements and brief data retention limits. While we remained neutral on earlier versions of SB 1013, EFF and our partners ultimately opposed the bill after late amendments compromised key privacy protections. The final draft would have doubled the current data retention period and allowed agencies to archive rather than delete data unrelated to active investigations—effectively shifting away from data minimization toward indefinite retention. (We saw San Francisco adopt a similar proposal this year). We encourage California lawmakers to draw from our ALPR legislative agenda to enact robust safeguards or ban ALPR mass surveillance altogether.

Looking Ahead

Next session, we expect ALPR legislation to be top of mind as states across the country reckon with the harms the technology has caused. We will also be monitoring the results and action following the state’s audit into California’s fusion centers. Following calls from advocates to address privacy abuses and a lack of transparency, the Joint Legislative Audit Committee approved Senator Sabrina Cervantes’ audit request in March 2026. This builds on our past experiences working with JLAC audits to expose law enforcement overreach—such as the state auditor's damning 2020 report on law enforcement’s use of automated license plate readers and our 2016 push to fix the deeply flawed CalGang database. The audit will examine the legal authority, governance, and funding of the centers, map out state and private data systems accessed by personnel, and review protocols for handling data breaches and unauthorized surveillance. This audit will mark the first comprehensive review of these facilities in 13 years and should be released by Summer 2027. We hope lawmakers use the findings to rein in these centers and their unauthorized surveillance.

Other “zombie bills” are also expected to return next year, including legislation regarding the use of copyrighted material to train AI systems. Throughout the two-year session, EFF raised serious concerns about AB 412, a bill that would require AI developers to identify and disclose copyrighted works used in generative AI training. We argued that complying with such a mandate is practically impossible, as it demands information that often does not exist and cannot realistically be obtained. While we are glad the legislature paused to consider the best approach rather than rushing this policy forward, we expect legislation targeting fair use and AI training to return next session.

More broadly on AI, vulnerabilities and security issues have dominated recent news cycles, and everyday Californians feel real anxiety about the risks of AI. We expect to see numerous bills addressing issues like existential risk and kill switches, as Assembly and Senate privacy committees in California have held informational hearings on these topics over the last month.

We hope to work with legislators to address the threats of AI and ensure that technology supports rights, justice, freedom, and innovation for all people. Laws should always ensure that technology empowers rather than oppresses.

Join us to celebrate the legacy of Aaron Swartz on Nov. 8, 2026. With the organizers of Aaron Swartz Day, we’re honoring his life with an in-person and remote hackathon. This event is supported by several organizations that carry on his work, including the Internet Archive—which is hosting the in-person event—the Freedom of the Press Foundation, Creative Commons and the Free Law Project.

Aaron Swartz was a digital rights champion who believed in the need for an open internet. His life was cut short in 2013, after federal prosecutors charged him under the Computer Fraud and Abuse Act (CFAA) for systematically downloading academic journal articles from the online database JSTOR. Facing the prospect of a long and unjust sentence, Aaron died by suicide at the age of 26.

EFF was proud to call Aaron a friend and ally. We continue to stand with programmers and developers engaged in cutting-edge exploration of technology through our Coders' Rights Project.

Hackathon participants can contribute code, documentation, and design to several open-source and public-interest projects. These include Secure Drop, Open Library, Quantifying the Commons, Onion Press, and our own Atlas of Surveillance.  EFF Director of State Affairs Hayley Tsukayama will also join hackathon participants at the Internet Archive at 11 a.m. for an Atlas of Surveillance on-boarding session.

Contributors across experience levels are welcome. The Aaron Swartz Day organizers are also open to adding new projects and workshops, so please contact them at aaronswartzday@gmail.com if you’d like to suggest a workshop or project—particularly open-source projects on Github that participants can continue to work on after the event. For more details on how to participate in-person or remotely, please visit the Aaron Swartz Day and International Hackathon page at www.aaronswartzday.org.

Event Details

• Date: Sunday, November 8, 2026
• Time: 10:00 AM – 5:00 PM PST
• Social Lunch: 1:00 PM – 3:00 PM PST
• In-person Location: Internet Archive Headquarters, 300 Funston Ave, San Francisco, CA 94118
• Admission: Free, but please RSVP here

Yesterday, along with the ACLU, EFF filed an amicus brief in the Ninth Circuit court of appeals in United States v. Spurlock, a case involving a “tower dump” warrant. These overbroad warrants require cellular providers to turn over location data about every phone in a given area at a given time. This is the first such case to be heard by a federal appeals court since the US Supreme Court ruled this summer that highly similar “geofence” warrants are searches under the meaning of the Fourth Amendment.

Spurlock involves an investigation into two murder victims discovered on the side of a rural California highway. Police also found a car belonging to one of the victims several miles away on the same highway. They quickly sought a tower dump warrant for an area covering this stretch of road, which eventually revealed location data on nearly 1,700 unique phones. Faced with a motion to suppress, the district court relied on a Fifth Circuit court of appeals decision about geofence warrants to hold that tower dumps are similarly categorically unconstitutional “general warrants” that violate the Fourth Amendment. However, the court refused to suppress evidence on the basis of the “good faith doctrine.”

Our amicus brief on appeal makes several key arguments.

First, we point out that the Supreme Court’s decision in the geofence case Chatrie v. United States this summer only strengthens the arguments that tower dumps are unconstitutional general warrants. Tower dumps are a somewhat older technique than geofence warrants, but they are both “reverse location searches,” in which police “tap into an all-encompassing database, allowing them to undertake nearly perfect, retrospective surveillance of countless persons and places.” This is the sort of untargeted “general warrant” the framers of the Fourth Amendment wanted to prevent. As we write in the brief, “Searching all people in an area without probable cause to believe they were all involved in the criminal activity under investigation reproduces the evils of general warrants and is not constitutionally permitted.” It’s this rule of law that prevents police from searching the houses of a hundred, or even a thousand people in the vicinity of a crime.

Second, we note that even if high courts continue to allow tower dump and geofence warrants in any cases, core Fourth Amendment law requires strict limits to protect the privacy of innocent bystanders, including limits on the scope and duration of the warrants, as well notice to affected individuals and after-the-fact deletion and minimization of irrelevant data.

Finally, we argue that the Fourth Amendment requires the court to set aside the good faith doctrine in cases like these and actually decide the constitutional issue. Too often courts pass the buck in cases involving novel surveillance techniques, leading to situations where police can continue using the technique for years or even decades without a definitive ruling.

Whether they call it AI summaries, knowledge panels, or AMP, Google takes actions that are less about functionality and more about locking you into its own ecosystem. Knowing that makes it possible for all of us to choose better services than Google's, defeating their anticompetitive goal. In this case, as it is so often, knowledge is power.  

In the old days, when dinosaurs roamed the earth and getting online involved your computer making eldritch shrieking, Google was a website that took whatever you typed in and gave you a list of links that best matched what you were searching for. As it's grown beyond that, however, the core function of Google Search has moved from giving you the best answer to your query to a number of other things, most of them about making money for Google. 

This is obviously not a new observation. It's at the core of what EFF Special Advisor Cory Doctorow named "enshittification." But it's important to remember that whatever shiny new name or technology is wrapped around these tools, it's not about the wrapping, it's about the monetization. 

In the case of Google Search, the company has a history of rolling out new "features" that are less helpful to the searcher and more designed to keep you and your data within the Google ecosystem. One easy example of enshittification is putting sponsored links and ads at the top of search results, forcing you to scroll down past a bunch of not relevant links to get to your answers. Or, in some cases, accidentally clicking on sponsored links that might be designed to give you the opposite information of what you're looking for or for a competitor to the product you intended to buy.  

The other clumsy version of this is Google's self-preferencing, where Google's own services—say YouTube if you're looking for a video—are weighted so that they appear at the top of a search over a competitor's. Similar to this was Google's push for websites, particularly news ones, to be made available via what it called "Accelerated Mobile Pages" or AMP, which in theory stripped out features that might make loading a page on mobile too slow, but also handed over control of how webpages looked on mobile to Google and turned mobile links, often by default, into Google links.  

But the other way that Google has historically kept your—and your valuable eyeballs—on its website has been to just obviate the need to even click on a link and leave Google at all. The first version of this was what Google calls "knowledge panels." These are snippets of information shown on the results page of a search that purport to answer your question. Knowledge panels predate the AI push and haven't always been what you could call accurate.  

Knowledge panels are extremely similar to the AI summaries we now see at the top of Google Search results, except that instead of pulling quotes from specific linked sources, it's the AI doing the summarizing, though also sometimes with links. They are basically the same thing, mostly changed only in branding, because AI is now the cool kid on the block. The goal is essentially the same—it's less about providing you with the best answer to your query and more about making you think it's unnecessary to click a link and leave Google's ecosystem. And, more importantly, it keeps you on Google's pages longer to read the content. More time on the page is more time exposed to ads and sponsored links and more money for Google.  

The biggest irony here is that it didn’t even work. People choosing to use “AI mode”—and possibly made accustomed to getting information as text instead of links through the knowledge panels and the AI summaries at the top—has caused “lower monetization” via ads. Ads, remember, are Google’s main source of revenue. Like newspapers before them, Google is finding that counting on a monopoly on ad space maybe isn’t the most sound strategy in a shifting technological landscape. And to get out of the hole it has made for itself, it is lighting cash on fire to try to get back on top. Perhaps they should consider pivoting to video.  

Every time you see a feature like this, no matter what it is called or what "new" technology they claim fuels it, remember that it is Google's monetary incentives that drive the decisions and not necessarily the tech itself. And you can always choose to ignore it, scroll past, disable it, or even go to another service entirely.  

The U.S. Postal Service used social media surveillance to monitor and report on protests across the political spectrum, government records show.

The records, disclosed to EFF and other requesters suing the postal service under the Freedom of Information Act, show that the agency’s internet Covert Operations Program, or iCOP, routinely sifted through social media posts organizing and discussing protests with little records of any oversight or legal justification.

EFF filed suit in 2021 after Yahoo News disclosed the program’s existence and how the agency used it to monitor First Amendment protected activities. After years of delays and technical failures that led the agency to lose access to a trove of emails discussing the program, the postal service disclosed records to EFF and several other requesters this year.

The Postal Service used iCOP to surveil First Amendment activities

The disclosures include a series of bulletins created from iCOP, which show that the postal service used the program in 2020 and 2021 to monitor and circulate information about a wide range of planned protests. They included a planned “Million MAGA March,” a guns rights advocacy event and counter-protest in Virginia, a nationwide Save the Post Office Saturday protest, and planned protests in front of then-Postmaster General Louis DeJoy’s home in Washington, D.C.

Many of the bulletins provide dry descriptions of the events being planned and reference public discussions or events on major social media services. Others seem to imply or anticipate that the protests would turn violent.

For example, in discussing planned national and international protests scheduled for March 20, 2021, the bulletin references potential violence in light of “online inflammatory material.” Yet the bulletin acknowledges that the agency has “no intelligence to suggest specific threats.” This bulletin was described by Yahoo News when it disclosed iCOP’s existence.

Another bulletin discussing an ongoing Black Lives Matter protests in response to police shooting and killing people styles itself as a “National Civil Unrest Update.” The bulletins also recount and monitor threats sent to then-Postmaster DeJoy.

The Postal Service also disclosed three email chains to EFF that, while heavily redacted, show how the agency queried iCOP and disseminated what it found (Read the emails here, here, and here). The government agreed to release the email messages as part of settling EFF’s FOIA suit this fall. To EFF’s knowledge, they are the only existing materials that reflect how the agency queried iCOP.

Postal Service renames iCOP and loses access to records about it

According to the agency, after Yahoo News disclosed the program in 2021, the postal service renamed it and publicly said that it had stopped issuing bulletins. But the documents do not say that the agency’s social media surveillance stopped.

At the same time, EFF and several other FOIA requesters sought records detailing how the agency used iCOP and what rules the postal service had for using the program and distributing information it gained from surveilling social media. EFF spent years pushing the agency to disclose email communications about the program, which the agency had stored on an external hard drive. Amid these negotiations, someone dropped the hard drive, rendering it inoperable, agency officials said. By the time that happened, the agency had already deleted the underlying email messages pursuant to the agency’s retention schedule.

Minimal records disclosed about internal limits on surveillance programs

EFF’s FOIA request sought internal rules, guidance, and training that would show what safeguard the Postal Service imposed to protect First Amendment rights. The agency disclosed very few documents in response to this part of EFF’s request.

For example, a series of slides give an overview of the program, but do not explain how officials used iCOP. The closest thing to internal guideline that the agency disclosed were talking points the Chief Postal Inspector authored in response to questions about iCOP.

The inspector wrote that, “In reviewing social media postings to gather information we did not single out any particular group and did not base what was reviewed on race, religion, gender, sexual orientation, immigration status, or a person’s exercise of First Amendment freedoms.” The statement echoes language in the bulletin stating that its purpose is not to infringe on First Amendment rights; Other parts of the talking points characterize the surveillance as providing officials with situational awareness.

The postal inspector’s talking points go on to say that “the recent attention on iCOP has highlighted opportunities for improvement, including enhanced executive oversight. We have stopped the distribution of the bulletins like the one you have seen in the media reports.”

Setting aside that it’s unclear whether internal oversight occurred or resulted in any changes, the claim that iCOP did not infringe on First Amendment rights rings hollow. As the records disclosed show, surveilling and reporting on social media users’ efforts to organize rallies and protests was a feature of iCOP.

But more fundamentally, the claims by Postal Service officials fail to recognize that surveillance directly chills First Amendment rights. Further, the government can misuse the information it obtained as part of its social media surveillance to harass or retaliate against those exercising their constitutional rights.

Although EFF’s case seeking records about iCOP has ended, we will continue to bring more transparency to the government’s use of social media surveillance and look for ways to challenge the practice, especially when people are caught in the dragnet for exercising the First Amendment rights.

Related Cases: EFF v. USPS - Social media monitoring (iCOP)

The government’s surveillance powers grew rapidly after Sept. 11, 2001, some in public view and some in secret. EFF suspected but couldn’t prove that the National Security Agency was spying on Americans' communications. The New York Times sat on a story about it for over a year, finally publishing it in December 2005. Then, in January 2006, a retired AT&T technician named Mark Klein walked into EFF's office with a manila folder of documents that blew the story wide open. 

Welcome to the third episode of “Privacy’s Defenders,” a podcast about the people – lawyers, journalists, hackers, and others – who’ve fought to secure your digital liberties since before most people even knew what the internet was.

%3Ciframe%20height%3D%2252px%22%20width%3D%22100%25%22%20frameborder%3D%22no%22%20scrolling%3D%22no%22%20seamless%3D%22%22%20src%3D%22https%3A%2F%2Fplayer.simplecast.com%2Fe7dd937c-3319-4a9a-9245-f9ed34b9419d%3Fdark%3Dtrue%26amp%3Bcolor%3D000000%22%20allow%3D%22autoplay%22%3E%3C%2Fiframe%3E Privacy info. This embed will serve content from simplecast.com

   

(You can also find this episode on YouTube.)

In this episode, former EFF Executive Director Cindy Cohn talks with former EFF lawyer Kevin Bankston, who was at his desk drafting a lawsuit against AT&T when Klein showed up. Less than two weeks later, EFF sued the phone company on behalf of its own customers in Hepting v. AT&T. Cindy speaks again with now-retired Justice Department lawyer Tony Coppolino, who asked for the opportunity to defend the case. He called EFF with a warning after Klein’s documents were filed in court: If they were classified, EFF would be in big trouble. You’ll also hear from Klein himself, and from Carolyn Jewel, a romance novelist and AT&T customer who became the lead plaintiff in EFF's related case against the NSA. 

It's the story of a secret room in a San Francisco phone company building, a heroic whistleblower, and the people who refused to let mass surveillance stay hidden. 

The “Privacy’s Defenders” podcast is a follow-up to Cindy’s book, “Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance,” bringing to life pivotal moments in the voices of those who fought for your rights. Sales of “Privacy’s Defender” benefit EFF, so pick up your copy today!  

Joanne Elgart Jennings co-produced and created this podcast.   

Jarrod Sport co-produced, mixed, and mastered it.   

Corinne Ruff is our story editor. 

We had additional help from Rachel Estabrook and Alison Broverman. 

The original music was composed and performed by Nat Keefe of Hot Buttered Rum with Ben Andrews on the fiddle. 

On November 11, Lina Attalah, founder and editor-in-chief of the independent Egyptian news outlet Mada Masr, will face trial for the second time in just two weeks. This time, she faces charges of spreading false news, an accusation that has become one of the Egyptian government's most frequently used tools for prosecuting journalists. 

The trial follows a conviction on October 27, when Attalah was found guilty of managing an unlicensed news website. The Mada Masr team had repeatedly applied for a license, but their attempts went unacknowledged. The proceedings took place in a single hearing, which Mada Masr states included serious violations of her right to a fair trial. She was sentenced to the maximum fine of 3 million Egyptian pounds (approximately 55,000 USD), forcibly removed from the courtroom, and held for seven hours until the fine was paid. The court also ordered Mada Masr's closure and the confiscation of all equipment belonging to the organization. 

The current wave of repression has also targeted Matsada2sh, a fact-checking and open-source intelligence initiative. Its entire six-person newsroom was violently arrested, illegally detained, and interrogated under torture before being charged with terrorism-related offenses and spreading false news. The team remains in pretrial detention. 

According to CPJ, at least 25 other journalists are currently incarcerated in Egypt. 

Governments seeking to control the flow of information increasingly rely on a combination of legal harassment, financial pressure, criminal prosecution, and restrictions on the infrastructure that makes independent publishing possible. Egypt's media licensing regime is a particularly troubling example. Requiring news organizations to obtain government authorization to operate creates an obvious mechanism for restricting who gets to publish and whose voices are allowed to reach the public.  

The charge of spreading false news is similarly dangerous. Governments around the world have increasingly invoked the language of misinformation to justify restrictions on speech, often without meaningful safeguards against political abuse, as we laid out in our recent submission to the United Nations Office of the High Commissioner for Human Rights. Governments should never be the arbiters of which reporting is permissible, particularly when that reporting concerns their own conduct. 

Why Mada Masr matters 

Founded in 2013, Mada Masr has spent more than a decade doing the kind of journalism that authoritarian governments find most threatening: documenting abuses, amplifying marginalized voices, and reporting on issues that powerful institutions would prefer remain hidden. 

Its reporting has given torture survivors and the families of political prisoners a platform. It has opened space for debate about reproductive rights. It has brought frontline reporting from Sudan and Gaza, and stood alongside refugees facing xenophobic attacks and security crackdowns. 

Emerging as a digital-first publication, in a media environment where traditional outlets were increasingly constrained, being purely digital allowed Mada Masr’s founders to build an independent publication outside the structures of legacy media.  

At a time when only 43% of Egyptians had access to the internet, going fully digital meant taking a big risk, but it was one that has been rewarding: Despite being blocked by the Egyptian government since 2017, Mada Masr has continued to reach Egyptian and global audiences, and Attalah has received numerous accolades, including the Knight International Journalism Award, the Ordre des Arts et des Lettres, and a spot in TIME Magazine’s 100 most influential people (2020). 

Mada Masr has also consistently engaged with technology and advocated for a free and independent internet for the global majority. It has covered dozens of hot-button tech stories in recent years, from Egypt’s Cybercrime Bill and Israel’s use of AI weaponry in Gaza, to stories about the “privacy chaos” caused by biometrics to more personal essays about the importance of the internet and tech. In August, they launched an open call for proposals on original critical reporting on artificial intelligence. 

Mada Masr may be thoroughly Egyptian, but it doesn’t belong just to Egypt. Its team has made into a publication that represents the kind of independent, local, grounded journalism that international audiences need, particularly at a time when international reporting on state repression is lacking. They built on-the-ground networks to center local voices in Sudan (publishing in both English and Arabic on the conflict) and Gaza out of a sense of cross-border responsibility and solidarity. 

This is precisely why its potential closure should concern everyone who cares about a free press. The ability to publish independently, investigate powerful institutions, and to share information without government interference is fundamental to the exercise of free expression.  

From solidarity to action 

The international community has repeatedly expressed concern about restrictions on press and internet freedom in Egypt. More than 100 organizations have now joined statements of solidarity with Mada Masr, and with Matsada2sh.  

These expressions of support matter, particularly when journalists are increasingly isolated and under threat—but solidarity must also translate into sustained political and institutional pressure. 

The international governments and institutions that maintain relationships with Egypt—including those in the European Union, the United Kingdom, and the United States—should make clear that the prosecution of journalists and the forced closure of independent media outlets are unacceptable.  

The cases against Lina Attalah, Mada Masr, and Matsada2sh must be dropped. The journalists who remain in detention must be released. And Egypt's licensing regime, with its profound chilling effects on access to information and independent knowledge production, must be brought to an end. 

There is a particular urgency to defending independent media at a moment when governments are finding ever more ways to restrict the circulation of information. Whether through internet shutdowns, platform restrictions, surveillance, or the criminalization of reporting, the result is often the same: fewer opportunities for people to understand what is happening around them, to challenge official narratives, and to hold power accountable. 

We cannot allow the closure of one of Egypt's most important independent newsrooms and the prosecution of its editor-in-chief to become another routine episode in the global erosion of press freedom. Nor should we wait until the last independent journalists have been silenced before recognizing what has been lost. 

To learn more about Lina Attalah in her own reads, you can read our Speaking Freely interview from January 2026. 

  

In courts across the country, publishers and creators are suing large AI companies for training generative AI models on copyrighted works. It’s easy to see these cases as a David-and-Goliath showdown between authors and publishers fighting for a cut of Big Tech company profits. But this fight is actually much larger. It affects billions of people who aren’t represented in the case at all, including researchers, artists, activists, journalists, people with disabilities, and anyone who accesses and shares content online.   

That’s why EFF is stepping in to defend the public’s rights in these cases. Today, EFF filed an amicus brief in In re OpenAI, explaining how the court’s ruling on fair use could impact people worldwide. If fair use gets narrowed, it will impede work that benefits the public, like medical research and investigative journalism, and even limit access to privacy protection tools.

Let’s be clear: creators and workers deserve support as AI changes their fields, and Big Tech companies must be held accountable for the harms they cause. But giving copyright holders more control over the web won’t accomplish either of these goals. If the plaintiffs prevail in these cases, courts would have to rewrite copyright law in ways that hurt everyone except powerful media and tech companies.

Rewriting Fair Use Makes Everyone Worse Off

Copyright exists for one reason: to stimulate creativity and innovation in service of the greater public good. Unfortunately, the plaintiffs in this lawsuit are arguing to limit everyone’s fair use rights, in ways that would thwart the basic purpose of copyright. The harms of shrinking fair use will go far beyond generative AI, impacting everyone.

Initial speculation that AI models would be infringement machines, churning out works highly similar to those on which they were trained, has proven unfounded. And courts have already found fair use in cases where copyrighted works were used to train generative AI models, recognizing that training uses those works for a fundamentally different purpose.

Plaintiffs in these cases argue that, even if the use is transformative, using their works to train AI is still unfair, because the AI models could generate new, non-infringing works that might compete with plaintiffs’ own works. They also argue that scraping or downloading the data without permission—or in some cases, from websites containing infringing copies—was independently infringing and/or rendered any subsequent uses of that data unfair.

These arguments would put beneficial research and reporting at risk. First, if copying without permission rules out fair use, the law will never protect transformative uses that benefit us all. Researchers, journalists, and other watchdog groups gather information the same way AI companies do—but they do it to serve the public interest, and often to hold Big Tech itself accountable. For example, journalists and nonprofit researchers have used “crawling” or “scraping” to investigate potentially anticompetitive practices by tech companies, and research misinformation and hateful content posted on X. Their data acquisition techniques are virtually identical to those used by AI giants—but they lack those companies’ deep pockets.

Requiring users to show that copyrighted material was lawfully obtained would also threaten everyday internet use. As EFF’s brief explained, that requirement would “cast legal doubt on the billions of copies we collectively make every day through routine online activities like opening emails, clicking on an embedded link, visiting websites, sharing pictures, streaming music, and watching videos. All of this activity requires intermediate copying.”

Fair use is what lets us all use the internet without being compelled to track the source of every image, video, and article that we click on, and make sure the rights are all cleared.

Additionally, while rightsholders are understandably concerned about competition from AI generated works, copyright law exists to promote new creation, not protect authors who published first. Under the plaintiffs’ theory, no one could stand upon the shoulders of giants. Copyright could prevent people from writing new books inspired by themes in a favorite novel or genre, or prevent academic researchers from publishing literature reviews that distill insights from prior research—simply because readers might prefer those new publications over those that came first.

Finally, general-purpose AI models are neither designed nor usually used to create works targeted at any particular market. These models have been used to generate new insights and tools for medicine, science, journalism, art, and accessibility. For instance, an AI-powered tool called Be My AI uses Open AI’s GPT models to provide visual descriptions for people who are blind or have low vision. Generative tools have also accelerated scientific research, and researchers have used these tools to develop new medical treatments and medications for conditions previously thought to be incurable.

Mandatory Licensing Would Entrench Big Tech

Some creators and publishers argue that AI developers should just get a license. But requiring permission for every work used would give the largest companies massive advantages over small competitors and impede academic research. As Professor Lawrence Lessig recently noted:

If all training requires a license, then none but a handful of tech giants will be able to afford the costs of training. That’s not because authors are greedy but because the copyright system is the least efficient property system known to man.

Moreover, creators are unlikely to benefit from these licensing arrangements in many cases. Media and entertainment giants have exploited the imbalance between themselves and underpaid working artists for decades. Trying to help creators by giving them more rights under copyright is, as Cory Doctorow has written, like trying to help a bullied kid by giving them more lunch money for the bully to take. Artists aren’t getting good deals from record labels or publishers now; there’s no reason to think these companies, which already own the copyrights, will treat artists more fairly once they control the data that powers AI.

The Future of AI Is Too Important to Leave to Big Content or Big Tech

AI technologies will affect all of us, and copyright law is ill-equipped to address many of these consequences. The rules governing these technologies should be rules that serve the public—not just the small number of companies that can afford to litigate copyright battles for decades, or settle for billions.

Developers of virtual private network (VPN) apps are reporting that their products are again being pulled from Apple’s App Store in Russia. This is an unacceptable crackdown on a vital tool to protect privacy and speech online.

Why? VPNs give people a way to control their own online activities. When you visit a website through a VPN, that website only sees the VPN server's location (well, IP address) rather than your actual location. It's like sending a letter through a P.O. box so the recipient doesn't know where you really live. It can also disguise where you’re accessing information from, which can make it possible to access information banned by your government.

This is an unacceptable crackdown on a vital tool to protect privacy and speech online.

Going after tools that give people the space to communicate and access information freely is a common tactic from the totalitarian playbook. This latest demand comes after several steps the Russian government’s taken to surveil speech specifically on Apple products. In 2024, the Moscow Times reported that Russia’s state media watchdog, Roskomnadzor, went after VPN apps on the Apple App Store, after banning access to Western social media platforms and blacklisting opposition media sites. Russia then blocked Apple’s FaceTime software in 2025, according to Apple Insider.

Bloomberg also recently reported that the Russian government has added Apple and Microsoft to its state surveillance registry. This gives Roskomnadzor access to local users’ correspondence, Apple Insider reported, and puts both companies in a position to turn over customer information to the country’s security services as required.

With government control encroaching on their devices and less access to tools that give them alternate methods, people in Russia are left with shrinking options to communicate online or find information that isn’t state-sanctioned.

While Russia’s actions offer a more extreme vision of what happens when the government tries to enforce speech rules by attacking vital privacy tools, it is far from the only government doing so. Several states in the U.S., bent on making it difficult to circumvent invasive age-gating laws, have suggested banning VPNs—either to access certain content or in some cases to simply ban them outright. EFF has publicly (and loudly) criticized these proposals, because going after VPNs is a dangerous step down the road of censorship.

Attacks on speech and privacy online are deeply troubling, no matter where they happen. What those in power may see as a “loophole” in their invasive laws is actually an expression of user control. We’ll continue to speak out when we see governments going after them to take that control away.

In today’s digital world, the internet is an essential resource for young people to access information, explore community, and find themselves. But we know that this often comes alongside fears of experiencing online harms like doxxing, grooming, or bullying.

Trying to protect your family from everything all the time is impractical and exhausting, but some thoughtful planning can help families devise a workable plan that meets their needs and addresses their concerns.

That’s why this Digital Parent Week, we’re sharing easy tips on how parents and their children can work together to co-curate a digital safety plan that helps all members of the family enjoy the benefits of technology while protecting their online privacy and safety. 

Start with Open Conversations

Online safety begins with communication, not just restrictions. Talk with a young person about how they use the internet: their favourite apps, games, and social media platforms for example. Creating a supportive environment helps young people feel comfortable asking for help if something goes wrong online.

Together, you can think about:

1. What do we want to protect? e.g., I want to protect a young person’s privacy and mental health when they’re playing Roblox. They love Roblox and use it to communicate and hang out with their best friend, so we’d like to find a way to make it as safe as possible.
2. Who do we want to protect it from? e.g., messages from strangers, staying up too late playing, wasting money on pointless digital junk in games.
3. How bad are the consequences if we fail? e.g, losing some money on a scam or having creepy conversations with strangers that could escalate into something more nefarious or dangerous.
4. How likely is it that we will need to protect it? e.g., I don’t know the likelihood of a stranger messaging you on Roblox because I’m not sure how communication works on the platform, but I’ve heard from their friends that strangers message them all the time in some games.
5. How much trouble are we willing to go through to try to prevent potential consequences? e.g., I’m willing to learn from my child how the game works, play the game with my child, and learn how to work the parental controls. 
6. Who are our allies? e.g., my partner, our parents, as well as a young person’s best friends and their parents.

It's easy to think of a young person's experience on the internet as being totally disconnected and different from your own. But now is a great time to also interrogate your own internet habits, like the sorts of sites you engage with, tools you use, and privacy settings you've set. These questions are as valuable to help you as a parent as they are just an internet user.

Sometimes even just figuring out what conversations are worth having can take some effort, we've put together some ideas to get you started in our guide.

Make Privacy a Family Priority

Digital security training can feel overwhelming but this is why a community-oriented approach helps. In speaking with your family and friends, you can build out digital security practices that work for you. This makes it more likely that your privacy practices will become second nature to you and your loved ones.

Use secure messaging services for every communication: Choosing a secure service ensures that your privacy is protected from government and corporate surveillance. If you can convince your family to get on board, options like Signal provide the most extensive privacy protections out of the box through its use of end-to-end encryption and limited data collection. But we understand that sometimes it's easier to stick with whatever the family already uses for a group chat, like WhatsApp, Apple's iMessage, or Google Messages, so take the time to familiarize yourself with the limits of WhatsApp and RCS encryption.

Consider the content posted online: It's easy to accidentally share personal information through photos, messages, and other content. Children and adults may unknowingly share personal information through photos, messages, location settings and app permissions. Take time together to review privacy settings, check which apps can access the camera or location, and discuss why personal details should be shared carefully. Make sure you have family agreement about when and where to post photos of each other or your home.

Create incident response plans: Developing a plan for if or when something bad happens is a good practice for anyone, but especially with younger people. It’s important to strategize with your family around what to do in the event of such things happening, and doing so before an incident occurs is much easier than when you’re presently facing a crisis.

Alongside this, simple steps like using strong and unique passwords on all devices, including those that are shared in the family, can make a real difference. Regardless of age, there’s no time like the present to get started on good security hygiene, and for many that starts with a password manager and two-factor authentication.

How to Think About Parental Controls

Many sites permit parents to control features such as personalization, algorithmic feed, autoplay, endless scroll, reactions, notifications, and time limits. Talk as a family about which features are important and useful and which are problematic. The conversations above around boundaries and digital literacy are a more effective way to prepare youth for accessing the internet. To develop true autonomy, young people need the privacy to discover the world for themselves without their parents monitoring the contents of every conversation they have.

Explore new apps together and revisit family rules as they grow. These decision points where you’re exploring with a young person what you’re both comfortable with can be good moments to “find your way to a yes” for whatever feature or tool or game they’re asking about. The questions they ask, along with your responses, provide a road map for what to look for in privacy controls that can get you to a place where everyone is comfortable engaging with that technology. 

Small Steps = Big Difference

There is no one size fits all to the tech questions and concerns a parent will face, and keeping young people safe online is not about removing every risk and monitoring every click. This Digital Parenting Week, you can start to focus on what’s important for your family and how to best achieve those goals. 

If you're still not sure where to start, installing EFF’s Privacy Badger on every computer in your household is a great starting point to protecting everyone's privacy.

For more detailed information on all these tips and more, visit EFF’s Online Privacy Guide for Parents and Youth.

In the most recent update to Apple’s devices, iOS 27.2, the company has introduced a new setting to “Exclude Apps” from Siri AI, fulfilling one of our asks from our Encrypt It Already campaign earlier this year.

One of our main concerns with new AI features on devices is how those features interact with end-to-end encrypted content, particularly with secure messaging apps. Many AI features require cloud processing, and despite privacy protections engineered into these systems, the content of secure messaging apps may leave a user’s device without their knowledge. That changes the privacy concerns around using those tools. In a perfect world, users would be able to put a barrier up to ensure data from certain apps doesn’t leave the device. Here was our initial ask:

You should be able to tell the operating system’s AI to not access an app, even if that comes at the “cost” of missing out on some features. The setting should be straightforward and easy to understand in ways the Gemini and Apple Intelligence controls currently are not.

At launch, we found the settings to control Siri AI’s app access behavior pretty confusing. You had to toggle several options to block Siri AI off from accessing an app, or disable Siri AI entirely. Turning off Siri AI and reverting to Siri Classic is, for now, still a good option if you’d prefer to use the older version.

The most recent update is far more clear and does more to protect your data. And, just as expected, it comes at the cost of some features. That’s a good thing, actually. The features not working shows that the new setting is effective. 

Here’s how to add apps to the exclusion list, once you’ve updated to 27.2:

• Open Settings > Siri > Excluded Apps
• Tap “Add Apps” and select any apps you’d like to add to the exclusion list

Now Siri AI cannot access the contents of the app. Excluding an app also means you may lose some features. For example, if you exclude the Apple Messages app, you will no longer be able to have Siri AI read or respond to messages for you. Even the “onscreen awareness” feature, where you invoke Siri and ask it for information about what you’re currently looking at, will not work anymore. For example, if you exclude Signal, you cannot invoke Siri and ask it to discern any information in the Signal app. You’ll just get these messages:

What’s the State of This on Android?

This update from Apple is also a good excuse to check in on the process on Android. It has improved a little, but is not as straightforward as Apple’s new settings, and lacks the ability to set the screen context feature per-app. But you do have some control over what Gemini can access: 

• Open up the Gemini app
• Tap your user photo, then Settings > Personal Intelligence > Connected Apps
• Revoke access to any apps you do not want Gemini to have access to

This process seems to work well enough for some data and we like that it’s opt in, but it’s not exactly intuitive. For example, Signal doesn’t appear there because Signal doesn’t support Gemini’s app access feature at all. That means Gemini can’t access the content of Signal directly, which is good. 

But Gemini can read notifications if you’ve enabled the “Device Assistance” Connected App (which you likely have, since that also enables basic features, like setting a timer—check under Settings > Personal Intelligence > Connected Apps), and it can use screen context unless you’ve disabled the Device controls > Screen context > “Use screen and app data” option in the Gemini Settings. These two features may access the contents of the Signal app or notifications, if you choose to use them. We’d prefer a more hard-lined approach that reduces the chances of user error here: Google should give users the ability to turn these features off per app.

Apple clearly understands that some users want stronger controls over what Siri AI can and cannot access. But we think they should go further and offer the option to only use “on device” AI features, similar to what Samsung offered with its Galaxy AI. We’re happy to see this change and think all operating systems need to consider similar controls moving forward.

A federal appeals court should curb the government’s abuse of grand jury subpoenas to unmask social media users who criticize lawless immigration enforcement.

That is the message from the ACLU, EFF, and other civil liberties and trade groups who filed a friend-of-the-court brief in a sealed case in the U.S. Court of Appeals for the District of Columbia.

The case involves the government’s investigation of an anonymous Reddit user who commented on a post about an immigration officer in Minnesota. The Department of Homeland Security (DHS) first issued an administrative subpoena to Reddit to unmask the user. When the user challenged the subpoena in court on free speech and statutory grounds (as many others have), DHS withdrew it. But then the government obtained a separate grand jury subpoena—a subpoena issued by a prosecutor to gather evidence to present to a grand jury before any criminal charges are filed—for much of the same information. The user then challenged the grand jury subpoena too, and the case is currently being appealed.

The right to speak anonymously is essential. It preserves privacy and shields critics from government retaliation. In the past year, the Department of Justice (DOJ) has issued grand jury subpoenas to social media companies for their users’ personal data. This is frequently done for improper purposes and without really showing that social media users have committed any crime. These subpoenas have the effect of intimidating and chilling critics, as immigration authorities have engaged in invasive, unconstitutional, and sometimes violent conduct.

As the amicus brief makes clear, courts should not defer to the government’s claims regarding the legitimacy of using grand jury subpoenas to unmask internet users. Instead, the subpoenas must receive proper First Amendment scrutiny. Like many other types of legal processes, grand jury subpoenas are issued by federal officials without prior court approval. And they too can be abused to harass or retaliate against people critical of the government.

The amicus brief was filed in early September and recently unsealed. The brief was signed by the American Civil Liberties Union of DC, EFF, the Center for Individual Rights, the Foundation for Individual Rights and Expression, the Cato Institute, and NetChoice.

It is notable that NetChoice signed the amicus brief. It is a trade group that represents many companies who have received similar subpoenas including Reddit, Google, Meta, PayPal, among others. EFF has called on these companies to do more to defend their users’ speech and privacy rights in the face of these subpoenas.

When we give our private information to the government to pay taxes, apply for a job, or vote, we should be able to trust that our data won't later be used against us. But in a betrayal of that trust, the federal government has been pooling the information it has about us on an unprecedented scale—and using it for purposes we never agreed to.

EFF and other groups are fighting back. In our latest EFFector newsletter, we're talking about a recent victory in our lawsuit against the government for sharing federal workers' confidential personnel files with DOGE.

JOIN OUR NEWSLETTER

For over 35 years, EFFector has been your guide to understanding the intersection of technology, civil liberties, and the law. This issue covers our free tracker blocker coming to Safari, a call to action for net neutrality in California, and a big win in our lawsuit against the DOGE data grab.

Prefer to listen in? EFFector is now available on all major podcast platforms. This time we're talking to EFF's F. Mario Trujillo about the dangers of government data grabs—and what defenders of privacy are doing to stop it. You can find the episode and subscribe on your podcast platform of choice:

%3Ciframe%20height%3D%22200px%22%20width%3D%22100%25%22%20frameborder%3D%22no%22%20scrolling%3D%22no%22%20seamless%3D%22%22%20src%3D%22https%3A%2F%2Fplayer.simplecast.com%2F59368254-4a09-4fcf-89fc-911a7c26dcc9%3Fdark%3Dfalse%22%20allow%3D%22autoplay%22%3E%3C%2Fiframe%3E Privacy info. This embed will serve content from simplecast.com

   

Want to protect your right to digital privacy? Sign up for EFF's EFFector newsletter for updates, ways to take action, and new merch drops. You can also fuel the fight for privacy and free speech online when you support EFF today!

Everyone knows, or should, that perfect (balanced, targeted, transparent, swift and swiftly appealable) content moderation at scale is impossible. That doesn’t mean powerful social platforms don’t have to try to get at least reasonably close, especially when access to good information can have a profound effect on political participation and speech.

That’s why so many people, including the Meta Oversight Board, criticized Meta for suspending a major political Instagram account for hours during a huge early voting push on October 17; and for allegedly boosting one candidate in Brazil’s recent presidential election. Meta denies deliberate interference in either instance, blaming “mistakes” in its automated content moderation systems (including AI tools that can’t tell the difference between enthusiastic follower engagement and a bot attack).

Mistakes or not, with early voting in the U.S. midterms already underway, these events serve as a stark reminder that all major social media platforms need to have stronger systems in place to ensure that they serve, rather than impede, democratic communication.

Access to good information can have a profound effect on political participation and speech.

This is not inherently an “AI” problem: automated systems can process content at a scale that humans never could, potentially enabling better moderation at scale and alleviating the psychological load on ill-paid moderators whose jobs require them to view incredibly disturbing content. But automated systems also reproduce existing biases, struggle to understand context, and often make mistakes that disproportionately affect journalists, activists, artists, and other vulnerable and marginalized communities. And moderation errors are even more likely when the language is spoken principally by the global majority. In 2020, leaked document showed that Meta’s algorithms incorrectly deleted nonviolent Arabic-language content 77 percent of the time, while failing to detect hate speech under the company’s own policies in many instances. Where these systems are faltering in Arabic, they’re positively failing in less-resourced languages. As a 2025 report from the Center for Democracy and Technology found, labeled datasets in certain languages and dialects such as Maghrebi Arabic and Kiswahili contain inconsistencies, bias, and inaccuracies due to the limited hiring of annotators who actually speak the languages as well as shifts in the languages themselves. An investigation into ChatGPT’s outputs in several low-resource languages demonstrates the depth of problem.

But language disparities are just one of several concerns as automated moderation becomes more widespread. From the systemic suppression of content from Palestine to the repeated misclassification of LGBTQ+ content as adult or explicit material, these varied examples demonstrate the risks of overreliance on automated moderation—and the need for stronger safeguards.

Fortunately, there is a great deal companies, policymakers, and civil society can do to help ensure that highly automated systems operate in ways that respect human rights, minimize predictable harms, and provide meaningful accountability when they fail. If companies are going to continue relying on automation to moderate users’ speech—and there is little reason to believe they won’t—then accountability must evolve alongside these technologies.

That work should start with publicly committing to the Santa Clara Principles 2.0. Specifically:

1. Automated technologies should help, not replace, human moderators. For example, automated systems can help flag and prioritize content for review, while humans can interpret context, handle sensitive cases, and refine system performance. This investment is particularly important during the weeks immediately before and after an election.
2. Companies must be transparent about when and how automation is used in content decisions.
3. Companies must regularly audit their automated systems for bias, with particular attention to low-resource languages, vulnerable and marginalized communities, and conflict zones.
4. Companies should strengthen personal data protection guarantees and policies. Automated content moderation often relies on personal data and profiling, so companies should think carefully about what data these systems use, what's necessary and proportionate and how their systems shape moderation outcomes.
5. Users must have the ability to appeal, and to provide context when they believe human or automated moderation decisions have wrongfully removed their content. Appeals should be promptly evaluated and decided by human moderators.
6. Companies should regularly assess the human rights impact of their moderation decisions, and issue public statements of the results
7. If they rely on third-party vendors, companies should carefully (and regularly) audit those vendors for compliance with these same principles
8. Lawmakers should avoid promoting and passing legislation that effectively or explicitly mandates automated moderation systems
9. Policymakers should also refrain from attempting to dictate platforms technical and design choices to favor or disfavor particular expression.
10. Policymakers should work to educate the public about how their personal data may be collected and used in electoral contexts.

These recommendations understand that automated content moderation isn’t just a technical problem for clever engineers and product teams to solve. Because content moderation shapes public discourse and fundamental rights, its design and oversight must respond to the concerns of policymakers, civil society, independent researchers, and the communities most affected by these systems.

One other distinct and enduring problem makes transparency, checks, and accountability all the more urgent: too few companies have far too much power over our political communication and organizing. Social media gave people the ability to wrest some control over political messaging away from media oligopolies. But we’ve met the new boss and while it’s not the same as the old boss, the song is pretty familiar. The real promise of the web to democratize communication is not likely to be met by social media oligarchs, no matter how sophisticated their content moderation practice.

New records obtained by EFF expose additional issues with Medicare’s AI-driven prior authorization program and show why we need stronger legal limits around government use of automated decision-making. 

EFF sued the government back in March for information about the Wasteful and Inappropriate Service Reduction (WISeR) model, a new Medicare program that uses AI to evaluate prior authorization requests for certain medical services. We previously released records showing that WISeR has resulted in delays and denials of care, operational chaos, and reports of patient harm. Today, we’re publishing over 800 new pages of records, including:

• Requests for information (RFIs) or requests for corrective action plans (CAPs) sent from the Centers for Medicare & Medicaid Services (CMS) to four of the six WISeR vendors, along with the vendors’ responses.
• Applications of 66 companies to the WISeR model, including those of the 6 selected companies. 
• Task orders and contracts for the evaluation, implementation, and monitoring of the WISeR model.

Documents obtained through EFF’s lawsuit are available here.

These newly released documents show that the WISeR rollout was rushed and rocky from the start, highlighting the dangers that arise when governments treat AI like a silver bullet for complex problems. The documents also highlight the need for more transparency about safeguards against inappropriate, AI-driven denials. The public still lacks the information needed to assess whether clinician review is providing meaningful oversight of AI systems and whether appropriate data is being used to evaluate prior authorization requests. 

EFF has long argued that AI has no place in consequential government decisions about peoples’ rights or access to benefits, such as immigration enforcement and policing decisions. That’s because using automated decision-making in these contexts risks decisions that violate people’s rights or deprive them of benefits they’re entitled to based on biased or inappropriate considerations and without proper due process or accountability if there is an error. 

By outsourcing decision-making to private AI companies without sufficient transparency, testing, or legal limits, WISeR jeopardizes seniors’ access to medical care. Congress should step in to place greater legal limits on the use of automated decision-making in Medicare. 

WISeR’s Rollout Was Rushed and Rocky 

CMS launched the WISeR program just six months after announcing it, ignoring calls from medical providers to delay its rollout. In records previously released by EFF, CMS acknowledged this “extremely condensed timeline.” 

New records suggest that WISeR’s unusually rapid rollout contributed to widespread problems in the first few months of the program. CMS did not disclose the extent of these issues to the public, even as agency employees privately contacted vendors about potential noncompliance with program requirements. 

In the first three months of the program, CMS sent RFIs or requests for CAPs to at least four of the six WISeR vendors. These requests, which describe delays, technical failures, and a lack of communication with providers, suggest that widespread problems during the program’s rollout were not limited to one vendor or state. 

These letters underscore the severity of the problems with the program. For example, CMS requested information from one vendor, Virtix, about numerous reported issues, including “determination turnaround times that exceed established guidelines,” “denials that appear inaccurate or inconsistent with applicable criteria,” and “inadequate customer service.” CMS’s RFI to Zyter–a vendor that uses Palantir software infrastructure–observed that the agency had received reports that “Zyter is not issuing determination letters in a timely manner” and communications indicating that it “may lack adequate processes for responding to and escalating provider/supplier concerns.” The vendor Innovaccer received two CAP requests and a “Performance Notice of Non-Compliance” over its failure to implement a fully functional portal for WISeR providers and suppliers.

Excerpts from CMS’ letters to vendors describe problems during WISeR’s rollout:

Excerpt from the RFI for Virtix, March 17, 2026

Excerpt from the RFI for Zyter, February 27, 2026

Excerpt from the Performance Notice of Non-Compliance for Innovaccer, February 20, 2026

Vendors’ responses to CMS provide further evidence that WISeR’s rushed rollout contributed to its problems. Innovaccer claimed it warned CMS months in advance that it might not be ready to provide full portal functionality by the launch date, even before signing a Participation Agreement. Another vendor claimed that “technical and workflow stabilization challenges were encountered due to the compressed implementation timeframe” it faced after joining the WISeR program a month after the other vendors. 

Excerpt from Innovaccer’s Proposed CAP, January 16, 2026

The issues reflected in CMS’s letters to vendors, and the vendors’ responses, illustrate the risks of deploying automated decision-making systems without proper testing or safeguards. While vendors’ responses describe fixes for the problems CMS identified, after-the-fact remedies cannot undo the harms that patients and providers already experienced during WISeR’s rushed rollout. 

More Transparency Needed About AI Safeguards

The public still knows far too little about any safeguards that WISeR vendors may have adopted—in part because the government chose to conceal some of this information. Transparency about these safeguards is critical to protecting patients, especially because WISeR’s payment structure gives vendors, as the government put it, “an incentive to deny as many claims as possible.” 

 Information provided by a vendor about safeguards that it says "ensure the responsible and clinically appropriate application of automation” appears to have been redacted from records released to EFF

The public has limited means to evaluate the effectiveness of even the safeguards that weren’t redacted from records released to EFF. For example, one vendor’s application touts safeguards like “Human-in-the-loop (HITL) workflows,” “Continuous model monitoring,” and “Transparent audit trails.” Yet it remains unclear whether these measures effectively prevent improper prior authorization denials. Some evidence suggests they may not: the company denied more requests than it approved in the first few months of the program, and CMS inquired about “denials that appear inaccurate or inconsistent with applicable criteria.”

Ultimately, the records obtained by EFF raise more questions than they answer about the safeguards used by WISeR vendors. 

Having a Human in the Loop Is Probably Not Enough

CMS has emphasized having a human in the loop as a key safeguard against inappropriate, AI-driven denials. The WISeR FAQ page on the CMS website states that “Non-affirmations will require the review of a human clinician and cannot be performed solely by technology.” But whether human review provides any meaningful protection depends on the details of its implementation, such as whether human reviewers have enough time to evaluate requests and practical authority to override AI recommendations. We still lack many of those details for WISeR vendors. 

A growing body of scholarship points to the substantial limitations of “human in the loop” policies as guardrails for AI systems. AI-generated recommendations can unduly influence human decisions, leading reviewers to over-rely on automated judgements and rubber stamp them as correct. Even worse, at least one health insurance company actively pressured clinical reviewers to accept its AI systems’ recommendations. Another company built a system that allowed clinical reviewers to reject claims without opening patient files; clinical reviewers using this system spent an average of just 1.2 seconds on each case.

Is the Right Kind of Data Informing Companies’ Decisions?

Some WISeR vendors’ applications offer general descriptions of the types of data informing their decisions. But far more details are needed to allow medical professionals to assess whether the data inputs to these AI systems are appropriate for evaluating prior authorization requests. 

Inappropriate training data or input data can lead to biased, unfair, or inaccurate decisions. CMS guidance for Medicare Advantage organizations using AI to make coverage decisions emphasizes the importance of basing decisions on individual patients’ circumstances. It cautions against using “an algorithm that determines coverage based on a larger data set instead of the individual patient's medical history, the physician’s recommendations, or clinical notes.” 

WISeR vendors’ applications reference data sources like “provider behavior,” “patient demographics,” “utilization management datasets,” “provider and payer performance metrics,” and “historical claims data.” Whether these sources could introduce bias or give too much weight to population-level patterns depends on how vendors use them to inform individual decisions. But we don’t yet have these important details about vendors’ data and algorithms. By outsourcing decision-making to private companies’ AI systems, the government has made it harder for the public to evaluate whether decisions are being made fairly.

Next Steps

As the government expands its use of automated decision-making, the potential for consequential mistakes increases rapidly. The records we’ve obtained so far raise questions about the rushed rollout and lack of guardrails for automated decision-making by the U.S. government. EFF urges transparency, oversight, and legal limits to protect people from the harms of automated decision-making in high risk systems.  

Related Cases: EFF v. CMS

A nonprofit service that protects internet users’ privacy is leaving France. Quad9, a free DNS resolver, has said it will reluctantly stop serving users in France on November 24. This follows a French court order that Quad9 must block access to websites that are accused of infringing the copyrights of a sports broadcaster. Forcing a responsible privacy service out of an important market is a predictable result of trying to force infrastructure providers to be copyright police.

When you visit a website, a DNS resolver reads the domain name you type in—like eff.org— and translates it into a numerical IP address that’s used to direct data across the internet. A DNS resolver can see the names of websites you connect to, so its privacy policies are important. Quad9 is an NGO that’s incorporated in Switzerland, in part to protect its users from data demands. The company also helps protect users from malware and phishing by blocking domains that are known to be malicious. Services like Quad9 offer an alternative to the DNS resolvers of local internet service providers and wireless carriers, which are vulnerable to demands from law enforcement, censorship, and commercial surveillance.

In a blog post explaining its decision, Quad9 explains that the French court’s order forces it to make a decision that, either way, is bad for users. It could either “extend French law to the whole world (blocking globally)” or try to identify and block users only in France—something that it can’t do reliably, and a move that could leave the company facing massive fines if it fails to block websites perfectly within France. Quad9 says it is facing about 20 other lawsuits in France seeking similar blocking orders. 

Rather than accept these demands, Quad9 has decided to withdraw its service from France. That is a real loss for French users who rely on the service to protect their privacy and security. It is also the right thing to do, when faced with the alternative: making promises it can’t keep, or abandoning users’ rights worldwide. 

Quad9’s decision will not remove any allegedly infringing material from the internet. The organization doesn’t host websites. Users looking for particular websites can  easily switch to another DNS resolver. So the material targeted by copyright holders will remain online and accessible, even while they drive a privacy-protecting service out of France. 

These events matter beyond the borders of France, and U.S. lawmakers should pay attention. Congress is considering multiple site-blocking proposals, which would require ISPs and other intermediaries, including DNS resolvers, to block access to websites in the name of protecting copyright. These bills threaten speech and our ability to access information online, and they are invitations to abuse. The Quad9 withdrawal shows another cost: if internet services get forced into being copyright cops, users can lose services that they rely on for privacy and security. 

Worse still, if neutral services like Quad9 are forced to build site-blocking systems for the benefit of copyright holders, it becomes far easier for other powerful interests, including repressive governments, to demand the same systems be used to censor speech they dislike, globally. 

Congress should reject site-blocking bills. They’re a threat to the open internet, and don’t help creators or creativity.