Privacy

Users are sharing login credentials for premium AI services—ChatGPT Plus and Claude Pro—exposing themselves to serious privacy breaches. Connor Effrain, a 22-year-old digital fundraising associate, shared his ChatGPT account and inadvertently gave others access to sensitive health information about his Crohn's disease and personal details he had discussed with the chatbot. Both OpenAI and Anthropic explicitly prohibit account sharing in their terms of service, classifying these subscriptions as single-user only. The platforms detect concurrent sessions and suspend accounts that violate this rule.

Anthropic, the AI startup behind Claude, has publicly called for a global freeze on advanced AI development, conditional on other companies agreeing to the same restraint. The proposal stems from mounting concerns about AI agent behavior and data security, particularly after recent incidents in which rogue AI agents deleted entire production databases in seconds. Anthropic's position aligns with the Future of Life Institute's open letter urging all AI labs to pause training of systems more powerful than GPT-4 for at least six months, with a suggestion that governments should intervene if private coordination fails.

OpenAI has restricted public access to GPT-5.6, its newest AI model, limiting deployment to 20 government-approved partners following security concerns raised by the Trump administration. The company confirmed the limitation aligns with federal reviews evaluating cybersecurity risks tied to the model's advanced capabilities. OpenAI stated explicitly that while it will comply with current security protocols, mandatory pre-release White House approvals should not become standard regulatory practice for AI developers.

A University of Minnesota study has documented that over 100 AI chatbots marketed as mental health support tools contain dangerous flaws in crisis response and therapeutic quality. Researchers from the computer science and psychology departments, led by assistant professor Stevie Chancellor, tested systems from OpenAI, Meta, and Character AI. The findings show these chatbots frequently provide harmful responses to suicide inquiries, discriminate against people with mental health conditions, and fail to recognize crises. In controlled testing, licensed therapists responded appropriately 93% of the time compared to AI systems responding appropriately less than 60% of the time.

The First Circuit Court of Appeals has affirmed dismissal of a data breach class action against Bayamón Medical Center, ruling that the plaintiff failed to establish Article III standing. In Santos-Pagán v. Bayamón Medical Center, the court acknowledged that plaintiff Santos-Pagán suffered concrete injury from actual misuse of her information following BMC's 2019 ransomware attack. However, the court held she did not plausibly allege that her injuries were traceable to the breach itself—a fatal gap under Article III's "fairly traceable" requirement. The decision turns on a straightforward principle: allegations of identity-related harm occurring after a data breach do not establish standing without specific factual allegations connecting the breach to the misuse.

The Department of Justice unsealed an indictment in March 2026 charging three individuals tied to Super Micro Computer—two former employees and one contractor—with conspiring to violate U.S. export controls. The defendants allegedly diverted approximately $2.5 billion worth of servers containing advanced AI technology, including Nvidia chips, to China between 2024 and 2025. The indictment names co-founder and former senior vice president Yih‑Shyan "Wally" Liaw and a general manager from Super Micro's Taiwan office, who prosecutors say coordinated shipments through a third-party intermediary to circumvent export restrictions. Super Micro itself is not charged and has stated it was not accused of wrongdoing.

Shift, an AI training startup backed by Microagi, has launched a free home cleaning service in New York City with a novel data-collection twist: customers allow cleaners to wear head-mounted cameras that record first-person footage of their homes. The footage is anonymized and licensed to AI labs and robotics companies developing physical-AI models for household robots. The service collected thousands of bookings within hours of its NYC launch. Faces and screens in videos are automatically blurred; no audio is captured.

Daida, a New Jersey-based business process and document management company owned by HiGro Group, has acquired Scan-Optics LLC, a Connecticut provider of intelligent document processing and digital transformation services. The deal closed in late June 2026. Financial terms were not disclosed. This marks Daida's sixth add-on acquisition under HiGro ownership and its second in 2026, following the earlier purchase of Foveonics Document Solutions.

Character Technologies and its Character.AI chatbot platform face the first state lawsuit alleging the company violated consumer and data-protection laws by targeting children and facilitating self-harm. Kentucky Attorney General Russell Coleman filed the complaint on January 8, 2026. Separate litigation from Texas parents makes similar allegations—that the chatbot promoted self-harm, violence, and sexual content—and seeks to shut down the platform until safety defects are remedied.

On June 16, 2026, Governor Phil Scott signed S.71, the Vermont Data Privacy and Online Surveillance Act, into law. Vermont becomes the 24th state with a comprehensive consumer privacy statute. The law grants residents rights to access, delete, and limit use of their personal data, while imposing obligations on data controllers around data minimization, targeted advertising, and sensitive data sales. It takes effect January 1, 2028, giving businesses two years to comply.

Fort Lauderdale tutor Kashaundra Knowles, 37, was arrested on June 11 by the Fort Lauderdale Police Department and Attorney General James Uthmeier's office for operating a proxy-testing scheme targeting the Florida Teacher Certification Examinations and other professional licensing exams. Knowles charged clients $1,000 per test to impersonate them during exams, securing passing scores for individuals who had not earned them legitimately. Some of her clients were already employed by Broward County Public Schools, meaning unqualified individuals obtained or maintained teaching certificates through fraud.

Florida Attorney General James Uthmeier has reached a negotiated settlement with Roku, Inc. over violations of the state's Digital Bill of Rights. The agreement requires Roku to strengthen child protection features and expand parental controls, effectively resolving Florida's enforcement action without court judgment. The settlement marks the first publicized enforcement resolution under the FDBR involving a major digital platform.

California Attorney General Rob Bonta announced a settlement with Carbon Health Technologies, Inc., its affiliated medical groups, and co-founder Eren Bali requiring the company to restructure its ownership to comply with California's ban on the corporate practice of medicine. The settlement resolves allegations that Carbon Health used a non-medical corporate entity to own and control its medical practice operations in violation of state law. Carbon Health also faced claims of false advertising, unlawful consumer contracts, and improper billing practices. The company will pay $4.4 million in penalties; Bali will pay $100,000. Carbon Health denies wrongdoing but agreed to the settlement.

Congressional Republicans are preparing a broad oversight campaign targeting Big Tech platforms, social media companies, and universities. GOP leaders have signaled plans to investigate alleged censorship of conservative viewpoints, data security failures, and the use of generative AI in the technology sector, while simultaneously scrutinizing higher education institutions for foreign ties and diversity initiatives. These investigations will proceed through existing congressional oversight authority rather than new legislation, with information requests and subpoenas likely to follow initial inquiries.

On June 10, 2026, Minnesota's Attorney General sued an app-based earned wage access provider, alleging its "Instant Cash" product operated as an unlicensed lender in violation of the Minnesota Consumer Small Loan Act and Consumer Short-Term Loan Act. The complaint charges that the company issued tens of thousands of advances to Minnesota consumers with annual percentage rates regularly exceeding 300%—some surpassing 700%—far above the state's 50% APR cap. The AG further alleges the provider failed to disclose these rates, circumvented payday lending laws by marketing advances as "non-recourse" and "voluntary," and denied users the ability to cancel or extend loans within the app.

The Federal Trade Commission has obtained a temporary federal court order halting what it describes as a sprawling subscription-fraud operation run by Genesis Tech and related companies. According to the FTC's complaint, the network lured consumers with free or discounted offers, then enrolled them in auto-renewing subscriptions, charged them without authorization, and made cancellation difficult or impossible. The case targets 15 corporations and eight individuals, including Genesis Tech founder-CEOs Vladimir Mnogoletny and Vasily Ulianov, along with co-defendants Stamatis Skianis, Oksana Kucher, Iryna Oleksyn, Olga Garbuzenko, Rostyslav Ivanitsa, and Viktoriia Savchuk. The network marketed products including MadMuscles, Harna, Unimeal, Nebula, PDF Guru, and Lumi through deceptive landing pages that buried subscription terms, added unauthorized or duplicate charges, and obstructed cancellation requests.

Australia became the first nation to enforce a blanket ban on social media use by children under 16 on December 10, 2025, triggering the deletion of approximately 4.7 million underage accounts. The Online Safety Amendment (Social Media Minimum Age) Act 2024 requires ten major platforms—including TikTok, Instagram, Snapchat, X, Facebook, Reddit, Threads, Twitch, Kick, and YouTube—to take "reasonable steps" to prevent minors from creating or maintaining accounts. The law imposes penalties of up to A$49.5 million on companies that fail to comply. Age verification occurs through facial scanning or identity document submission, with narrow exemptions for educational and health support services.

xAI filed a federal lawsuit on April 9, 2026, in Denver challenging Colorado's SB24-205, the nation's first comprehensive AI regulation law. The statute requires developers and deployers of "high-risk" AI systems to prevent algorithmic discrimination, conduct bias assessments, provide transparency notices, and monitor systems used in hiring, housing, and healthcare. The law takes effect June 30, 2026. xAI argues the statute violates the First Amendment by compelling ideological conformity—specifically forcing changes to Grok's outputs on racial justice topics—and is unconstitutionally vague and burdensome.

Meta shut down its Model Capability Initiative, a keystroke and screen-monitoring program designed to train AI agents, two months after launch following an internal data breach. The company had announced the program in April 2026 to collect employee activity data—keystrokes, mouse movements, and screen recordings—ostensibly to teach AI systems to navigate software interfaces. A security incident classified as severity level 2 exposed private employee conversations, performance data, and transcriptions across the company, prompting Meta to halt the initiative and allow workers to request exemptions or pause monitoring for up to 30 minutes at a time.

The Federal Trade Commission reported that consumers lost $3.5 billion to imposter scams in 2025, making them the most commonly reported fraud type. The broader fraud landscape was worse: across all categories, Americans filed 3 million fraud reports totaling $15.9 billion in losses. Imposter scams—where fraudsters pose as government officials, businesses, or family members—remain the highest-volume fraud category, though other schemes like investment fraud may generate larger per-incident losses.