Pushing the Bounds: AI Risk Assessments as Accountability Moats

Nikki Muggli Blog, Paper , , , , ,

By Michael Moran

Introduction
Before the dust settled from Meta’s colossal but controversial child safety settlement, another trial kicked off in New Mexico bringing the Cambridge Analytica scandal of 2018 back into the news.[1] In that data breach and privacy scandal, Facebook violated an earlier Federal Trade Commission (FTC) order, and agreed to pay a $5 billion penalty and adopt organizational restructuring and safeguards including compliance with a mandatory privacy program.[2] Following the settlement, Meta made substantial investments into its privacy program, but recent actions suggests the company is taking advantage of “political tumult in the United States” [3] to outsource privacy compliance to AI, delegating accountability for future privacy harms to an algorithm.[4]

Meta’s Legal Obligation to Provide Data Protection Assessments
In 2019, Meta entered a 20-year settlement order with the FTC mandating the creation of a privacy program with particular staffing and independent reporting requirements. While the order attracted headlines as the largest financial penalty assessed by the FTC, Commissioner Chopra criticized the agreement for granting individual immunity to Mark Zuckerberg, Sheryl Sandberg, and other executive officers, citing the importance of individual liability to encourage corporate accountability and compliance.[5]  The 3-2 majority of the FTC believed staffing and reporting mandates could improve “the transparency of decision making and hold[] Facebook accountable via overlapping channels of compliance.”[6]

Staffing
To empower decision-makers and overlapping compliance channels, Meta was required to “[d]esignate a qualified employee or employees to coordinate and be responsible for the Privacy Program (‘Designated Compliance Officer(s)’)”.[7] The Designated Compliance Officer(s) and “Principal Executive Officer” (Mark Zuckerberg) have reporting and certification responsibilities to ensure the privacy program meets the structural safeguards mandated by the order.[8] An independent privacy committee within Facebook’s board of directors was required, in addition to contracting an external third-party assessor for additional oversight.[9] All members of the independent privacy committee must be able “to read and understand data protection and privacy policies and procedures” to exercise their oversight duties.[10]

Reporting
Related to increased transparency of decision-making, designated compliance officers are required to conduct a privacy review prior to implementing any new or modified product that presents a material risk to privacy.[11] This decision must be documented in a written “Privacy Review Statement”, which describes the product, information collected, affirmative express consent mechanisms, and a full description of privacy risks and safeguards implemented or rejected. [12] The order also obligated Meta to promptly document and report any covered incident data breaches involving 500 or more consumers.[13]The Designated Compliance Officer(s) must deliver quarterly reports to the Principal Executive Officer based upon (1) personal knowledge, (2) sub-certification by “knowledgeable personnel charged with implementing the Mandatory Privacy Program”, (3) material issues from any privacy review statements and decisions from the prior quarter, and (4) material issues raised in covered incident reports for the quarter. Based on these quarterly reports, their own personal knowledge, or sub-certification by knowledgeable charged personnel, the Principal Executive Officer certifies compliance with the order.[14]

In addition to these reporting requirements, the order specifically mandates collection of user’s affirmative express consent prior to the use of facial recognition templates, after clear and conspicuous disclosure, separate and apart from privacy policy notices.[15] Outside of the FTC order, numerous state and international laws also require Meta to conduct and document a “data protection assessment” (DPA) for any processing activity that presents a heightened risk of harm, such as collection of biometric data.[16]  

Meta’s Evolving Privacy Program
Meta marketed the FTC settlement as an opportunity to incorporate privacy by design across the organization, touting $8 billion invested in the privacy program and development of new privacy features across Meta platforms.[17] To meet the staffing requirements of the order, longtime Facebook executive, Michel Protti was promoted to Chief Compliance & Privacy Officer,  who was later joined by Erin Egan, Chief Privacy Officer, Policy, to serve as designated compliance officers. By 2024, Meta increased the number of employees focused on privacy from a few hundred to over 3000, evaluating an average of 1,4000 product features each month.[18] The “Privacy Legal team [became] embedded in the design and ongoing execution of [Meta] program[s] and advises on legal requirements during the course of our privacy review process.”[19]

To manage an increasing number of product developments, and expanding digital compliance requirements, Meta began incorporating AI automation into product design and privacy reviews in 2025; building privacy code scanning solutions to replace manual “point checking” controls by engineers. [20] Meta argues that these tools enable the compliance team to add rigor at scale; to detect and screen risks earlier, flagging issues that need mitigation or escalation, but pushing through risks deemed insignificant to avoid delays to product development.[21] Using tools such as the Diff Risk Score AI tool, Meta uses AI to assess risk, displaying a color-coded risk thresholds with potential corrective responses for engineers to incorporate.[22] Meta is aiming for 90% of all risk assessments to be automated, even in sensitive areas including AI safety, youth risk, and misinformation.[23] Assessments of novel and complex issue are reviewed by senior subject matter experts across technical, legal, and policy teams until these decisions can be mapped, codified, and phased into greater AI risk management system.[24] With the massive scale of ongoing product development at Meta, and lack of clearly articulated threshold for novel and complex issues, it is the possible the AI algorithm could dismiss risks the FTC might deem substantial, intentionally, or through pattern recognition on training data dismissing risks. Users must trust that Meta’s experts are conducting ongoing oversight, to double check for accuracy after AI’s first pass.[25]

Meta maintains that “[h]umans are still very much in control of the process”, but the strategic decisions around organizational structure and product development suggest otherwise.[26] While adjusting its risk review process to incorporate AI analysis, Meta has reduced privacy team influence and oversight, telling employees who questioned the changes to “push the bounds” of their FTC agreement.[27] Last October, Meta laid off an undisclosed number of employees in Product Risk Program Manager, Shared Services, and Global Security & Privacy teams, “moving from . . . manual [risk] reviews to a more consistent and automated process”.[28]

Pushing the Bounds
Meta is one of many companies adopting AI tools to address a complex regulatory environment.[29] In a compliance setting, AI poses familiar challenges due to the unexplainability of ‘black box’ processes, or the potential hazards of relying on AI outputs in decision-making with unknown bias.[30] AI audit trails may be improving, but organizational and legal questions remain around accountability and oversight, particularly for Meta with 13 years remaining on the FTC order mandates.

Related to the staffing and oversight requirements of the order, the use of agentic AI in risk assessment dilutes transparency of privacy decision-making. By concurrently reducing the headcount of employees tasked with oversight, and introducing AI tools to sort and triage risk assessment, Meta has at best delegated, and worst, neglected the FTC’s mandate to designate “knowledgeable personnel [to] implement[] the Privacy Program”.[31] The designated compliance officers rely on a skeleton crew that act as an accountability sink, lacking sufficient resources to provide the human oversight of privacy decisions mandated by the FTC.[32]

With agentic AI, risk research and documentation can be supercharged, but best practices recommend, and some regulators require, that humans retain decision-making authority.[33] 2019 Department of Justice guidance recommended that compliance programs design risk assessments to maintain a “finger on the pulse”, not “asleep at the switch”, almost forecasting compliance outsourcing first to vendors, and now AI.[34]

Even the most sophisticated tech and compliance professionals would be hard pressed to oversee the evolving privacy program at Meta, keeping track of the granular shift of risk decisions from novel to normal. There is no reason to assume that AI tools errors will be recognized, or self-reported, even with the order’s obligation to report covered incidents.[35] An AI analysis could underestimate a risk that that violates an uncoded concept of human dignity, or fail to recognize a risk that is novel in the aggregate, due to compounding internal or external variables. The opposite, that the tool catches risk humans miss is certainly true, but with less humans in the loop, it becomes far less likely that an engineer would internally flag borderline novel or ‘icky’ features for legal review, or whistle blow, alerting the public about pending or future privacy harms.[36] In delegating initial reviews to AI, with lower-level compliance employees serving as accountability moats, Meta’s designated compliance officers have created layers of insulation and detachment from each unique privacy decision, yet still are certifying the privacy programs, based on personal knowledge or knowledgeable personnel that is in fact an algorithm.

Move Fast and Break Things
Through AI-automated risk assessments and a model of continuous deployment of code, Meta has drastically shortened its product release cycle from nearly two months down to days.[37] The rapid development and deployment timeline is further testing the regulatory appetite of FTC, and unnerving civil libertarians with new products and features outpacing legislative privacy protections and surveillance restrictions. A recent example of Meta’s rushed and unrestrained product development challenging the plain language and spirit of the FTC order are its controversial smart glasses.[38]

Meta’s Stealth Introduction of Facial Recognition to Smart Glasses
In early June 2026, the entire computational and storage stack for on-device facial recognition was detected in the Android version of Stella, the companion app for Meta’s smart glasses.[39] This “NameTag” feature is capable of detecting, matching, and storing biometric identifiers, often called faceprints. This code had been shipped to user’s phones, and could be remotely activated by Meta, allowing users to “see [their] connections” and “[r]emember the people [they] met and make new connections”.[40] The feature had not been activated, nor was the code evident to most consumers, but WIRED and EFF researchers were able to activate the code in debug mode to demonstrate the face identification feature using the glasses and code in real time.

Following the reporting and public scrutiny, Meta removed the unactivated code from the app, dismissed the story as “misleading” and referred to the code as “exploratory”. A week after removing the code, WIRED discovered a license agreement between Meta and a vendor called Rank One, selling access to military-grade facial recognition and “liveness detection” software to differentiate between the actual live face of a person.[41] These active and substantial steps towards implementing biometric identification invited the scrutiny of state AGs and multiple class action lawsuits from parents in Illinois.[42] Even with this backlash, Meta’s new AI personal agent app Muse follows a similar playbook, probing privacy boundaries until civil society pushes back.[43] All the while, new footholds for data collection are established, speedrunning new product features while the mandated privacy program operates on AI-autopilot until the next major violation or breach is discovered.

Conclusion
Back in Albuquerque, Meta’s counsel argued that New Mexico’s case was outdated because the company has undertaken serious soul searching and implemented structural changes to protect user privacy.[44] It appears more likely that Meta has taken advantage of political tumult to delegate the responsibility of protecting human dignity and privacy further away from leadership. The New Mexico jury agreed, finding Meta leadership had made 26 misleading statements, promising consumers transparency, internal investigations and compliance initiatives that never materialized.[45] With the integration of AI assisted risk assessments, Meta has ignored the opportunity to provide greater transparency, in favor of increased productivity and blurred accountability.

[1] As part of Meta’s August 2026 teen social media addiction settlement, 48 states released Meta from liability related to the Cambridge Analytica scandal. New Mexico was not involved in that multistate agreement, having previously won its teen safety trial against Meta. The New Mexico lawsuit was filed in 2021. Mikaela Schuettler, Nearly A Decade After the Cambridge Analytica Scandal, New Mexico Alone is Taking Facebook to Trial, AP News (Sept. 9, 2026), https://apnews.com/article/facebook-meta-new-mexico-privacy-lawsuit-fe250dc752777abd4f95f49111a2008a [https://perma.cc/7VMB-N7AK].

[2] Fed. Trade Comm’n, FTC Imposes $5Billion Penalty and Sweeping New Privacy Restrictions on Facebook (July 24, 2019), https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook [https://perma.cc/JA6M-8EYX]. Meta changed its name from Facebook in 2018, hence the varying references.

[3] An internal memo at Meta recommended taking advantage of a “dynamic political environment where many civil society groups that we would expect to attack us would have their resources focused on other concerns” to release facial recognition on smart glasses. See Kashmir Hill, Kalley Huang & Mike Isaac, Meta Plans to Add Facial Recognition Technology to Its Smart Glasses,N.Y. Times (Updated Feb. 14, 2026), https://www.nytimes.com/2026/02/13/technology/meta-facial-recognition-smart-glasses.html [https://perma.cc/FM9H-GKNA].

[4] Michel Protti, How AI Is Ushering in the Next Era of Risk Review at Meta, Meta (Mar. 31, 2026),https://about.fb.com/news/2026/03/how-ai-is-ushering-in-the-next-era-of-risk-review-at-meta/  [https://perma.cc/UW4E-94RM].

[5] Dissenting Statement of Commissioner Rohit Chopra, Regarding the Matter of Facebook, Inc. Comm’n File No. 1823109, at 19 (F.T.C. July 24, 2019) (Referencing a Dept. of Justice Policy Statement on Individual Liability). Commissioner Chopra also asserts that Designated Compliance Officer certification and CEO signature to ascribe compliance without benchmarks is simply a checkbox activity at 13.

[6] Fed. Trade Comm’n supra note 2.

[7] Facebook, Inc., Docket No. C-4365, Decision and Order, § VII, at 8 (F.T.C. Apr. 27, 2020).

[8] Id. at 8-11, 16-17.

[9] Id. at 12.

[10] Id. at 4.

[11] Id. at 14.

[12] Id.

[13] Id. at 5, 13.

[14] Id. at 23.

[15] Id. at 11.

[16] Cal. Code Regs. tit. 11, § 7150 (Lexis Advance through Register 2026, No. 34, August 21, 2026); Colo. Rev. Stat. § 6-1-1309(1), (2); N.H. Rev. Stat. Ann. § 507-H:8, Article 6(1)(f); Regulation 2016/679 of the European Parliament and of the Council of Apr. 27, 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), art. 35, 2016 O.J. (L 119) 33 (EU).

[17] Michel Protti, Reflecting on Meta’s $8 Billion Investment in Privacy, Meta (Jan. 28, 2025),https://about.fb.com/news/2025/01/meta-8-billion-investment-privacy/, [https://perma.cc/UW4E-94RM].

[18] Michel Protti, Investing in Privacy, Meta (Jan. 25, 2024),https://about.fb.com/news/2024/01/investing-in-privacy/ [https://perma.cc/A79S-46GJ].

[19] Meta Privacy Progress Updates; Governance, https://www.meta.com/actions/privacy-progress/ [https://perma.cc/X73T-KH25].

[20]  The Privacy Aware Infrastructure allows Meta to demark “policy zones” across systems with distinct embedded purpose limitation rules for data. Wenlong Dong et. al, How Meta Enforces Purpose Limitation Via Privacy Aware Infrastructure at Scale, Engineering at Meta (Aug. 27, 2024), https://engineering.fb.com/2024/08/27/security/privacy-aware-infrastructure-purpose-limitation-meta/ [https://perma.cc/638N-WHE8].

[21] Meta, Responsible AI in Practice, https://www.meta.com/actions/privacy-and-risk/ [https://perma.cc/ZGL3-G35B], Responsible AI in Practice video.

[22] Rui Abrea et al., Moving Faster and Reducing Risk: Using LLMs in Release Deployment, Meta (Oct. 8, 2024), https://arxiv.org/abs/2410.06351 [https://perma.cc/C44S-AYJA].

[23] All Things Considered, Meta Plans to Replace Humans with AI to Assess Risks, NPR (May 31, 2025),  https://www.npr.org/2025/05/31/nx-s1-5407870/meta-ai-facebook-instagram-risks.

[24] Meta, supra note 17.

[25] Protti, supra note 4.

[26] Joe Duball, Meta’s Risk Assessment Updates Look Toward ‘Holistic’ Approach, IAPP (June 11, 2025), https://iapp.org/news/a/meta-s-risk-assessment-updates-look-toward-holistic-approach [https://perma.cc/U43S-HSK7].

[27] Hill, supra note 3.

[28] Jyoti Mann, Meta Tells Some Employees Their Jobs Are Being Replaced by Tech — Read the Memo, Business Insider (Oct. 23, 2025), https://www.businessinsider.com/meta-job-cuts-risk-org-replaced-by-tech-layoffs-2025-10 [https://perma.cc/N789-RUBF].

[29] JPMorgan Chase, Goldman Sachs, and Salesforce have announced plans to bolster their compliance programs with AI, in lieu of hiring. Jonathan Vanian, Meta Replacing Humans with AI for FTC-mandated Privacy Reviews CNBC (Oct. 23, 2025), https://www.cnbc.com/2025/10/23/meta-replacing-humans-with-ai-for-ftc-mandated-privacy-reviews.html [https://perma.cc/XE3H-H4J4].

[30] Explainability and model validation are particularly necessary in compliance settings to justify appropriate incorporation of AI-outputs in risk-management decisions. Int’l Compliance Ass’n, AI in Compliance – What It Is, How It’s Used, and Why Governance Matters (May 2026), https://www.int-comp.org/insight/ai-in-compliance/ [https://perma.cc/7KK5-ZE8N].

[31] Facebook, Inc., Dkt. No. C-4365 (F.T.C. Apr. 27, 2020), p. 17.

[32] By tasking employees with oversight over ever-increasing AI outputs, inevitable errors can be tied to the employee, not the corporate leadership decision to adopt the AI tool. Cory Doctorow borrows the term“accountability sink” from Dan Davies, applicable here to insulate both the CEO and Chief Compliance Officers from accountability for the risk assessments. Berkman Klein Ctr. Internet & Soc’y, Cory Doctorow on Enshittification and Reverse Centaurs at 17:57(YouTube, Oct. 8, 2026), https://www.youtube.com/watch?v=fYtIt0NjX2s.

[33] The EU requires human in the loop for any high-risk AI systems, and California also requires human corroboration for any AI-powered employment decisions. The NIST AI Risk ManagementFrameworkfocuses on a human-centric approach. See Regulation (EU) 2024/1689 of the European Parliament and of the Council, art. 14, 2024 O.J. (L 2024/1689); see also Chris Marr, State AI Laws Up the Ante for Human Oversight of Job Decisions, Bloomberg Law (Oct. 8, 2026)

 https://news.bloomberglaw.com/daily-labor-report/state-ai-laws-up-the-ante-for-human-oversight-of-job-decisions [https://perma.cc/MKB8-N5KP]; see generally Natl’t Inst. of Standards & Tech. NIST AI 100-1, Artificial Risk Management Framework (AI RMF 1.0) (Jan. 2023), https://doi.org/10.6028/NIST.AI.100-1.

[34] William D. Semins & Lauren Norris Donahue DOJ Revises Corporate Compliance Guidance Calling Attention to Three Areas Where Most Companies Fall Short, K&L Gates (May 16, 2019), https://www.klgates.com/thought-leadership/DOJ-Revises-Corporate-Compliance-Guidance-Calling-Attention-to-Three-Areas-Where-Most-Companies-Fall-Short-Risk-Assessments-Compliance-Culture-and-Continuous-Compliance-Program-Improvement-05-16-2019 [https://perma.cc/F6PN-37RX].

[35] In 2023, based on continued violations, the FTC sought to prohibit Meta from releasing new or modified products, services, or features without written confirmation of compliance. A heavily redacted public version indicates the independent assessor, Protiviti, identified deficiencies in risk assessment, transparency, and reporting. In re Facebook, Inc., Docket No. C-4365, Order to Show Cause, at 5-9. (F.T.C. May 3, 2023).

[36] Former Facebook execs and leadership report that Meta CEO Mark Zuckerman doesn’t like being told no, nor being told how Facebook products were hurting people. See Sarah Wynn-Williams, Careless People: A Cautionary Tale of Power, Greed, and Lost Idealism (Flatiron Books, 2025); Video posted by CBC Docs, Facebook, Whistleblower Frances Haugen: “Mark [Zuckerberg] doesn’t want to be told that he’s hurting people.” (Aug 21, 2026),https://www.facebook.com/cbcdocs/videos/facebook-whistleblower-frances-haugen-mark-zuckerberg-doesnt-want-to-be-told-tha/1344912297713251/

[37] Chuck Rossi et al., Continuous Development of Mobile Software at Facebook, Int’l Symposium on Found. Software Eng’g at 12, (Nov. 13, 2016), https://research.facebook.com/file/956687151563855/fse-rossi.pdf [https://perma.cc/SZ4M-HJ2N].

[38] Stories of users easily disabling the glasses minimal privacy measures and filming strangers has led to multiple lawsuits involving the “pervert glasses”. Victor Tangermann, Zuckerberg’s Pervert Glasses Have Been So Publicly Shamed That Meta’s Reportedly Now Working on a Version With No Camera, Futurism (Sep. 16, 2026), https://futurism.com/future-society/zuckerberg-pervert-glasses-shamed-meta-no-camera [https://perma.cc/6Q9B-XMPZ].

[39] Buchodi, Meta’s Smart Glasses Companion App Ships a Complete, Dormant Face-recognition Pipeline on a Stock Account, (June 4, 2026), https://www.buchodi.com/meta-glasses-facial-recognition/ [https://perma.cc/AZ9X-G85Y].

[40] Dhruv Mehrotra & Dell Cameron, Meta Silently Added Face-Recognition Code for Its Smart Glasses to Millions of Phones, WIRED (June 4, 2026), https://www.wired.com/story/meta-smart-glasses-face-recognition-nametag-connections/ [https://perma.cc/5V44-TG6U].

[41] Dell Cameron & Dhruv Mehrotra, Meta Tapped a Pentagon Supplier to Prototype Face Recognition for Its Glasses, WIRED (June 15, 2026), https://www.wired.com/story/meta-rank-one-computing-face-recognition-smart-glasses/ [https://perma.cc/7ADH-3CZL].

[42] Alvarez v. Meta Platforms, Inc., No. 1:26-cv-10773, Compl. (N.D. Ill. Sept. 4, 2026). https://www.biometricupdate.com/wp-content/uploads/2026/09/Alvarez_et_al_v_Meta_Platforms_Inc__ilndce-26-10773__0001.0.pdf ; Mike Scarcella & Jody Godoy Meta to Pay $1.4 Billion to Settle Texas Facial Recognition Data Lawsuit, Reuters (July 31, 2024), https://www.reuters.com/technology/cybersecurity/meta-platforms-pay-14-bln-settle-texas-lawsuit-over-facial-recognition-data-2024-07-30/  [https://perma.cc/F978-MEB4].

[43] Default settings allow Meta to further train its AI models, and encouraging users to share personal details with the Labubu-esque personal agent. Jonathan Vanian, Meta Pushes into Personal AI Agents As Company Faces Public Reckoning Over Privacy and Safety, CNBC (Updated Sept. 8, 2026, 3:09PM)

 https://www.cnbc.com/2026/09/08/meta-personal-ai-agents-public-reckoning-privacy-safety.html [https://perma.cc/M2FG-CS7V].

[44] Schuettler supra note 1.

[45] Special Verdict Form at 21-29, State of New Mexico v. Meta Platforms, Inc, No. D-101-CV-2021-00132 (N.M. Dist. Ct. Santa Fe. Cty., Sept. 25, 2026).

Fiscal Sovereignty, Cyberattacks, and the Case for Collective Counterattacks 

Nikki Muggli Blog , , , , ,

By Rebecca Hatt

            Charles Tilly famously said that “war made the state, and the state made war.”[1] Whatever the limitations of the war-making theory of state formation may be, it articulates an enduring truth: states need resources to exercise sovereignty.[2] Historically, a state had to be able to extract revenue to raise armies, secure her borders, and govern the territory. In the modern world fiscal capacity is just as essential, but the threats to it are no longer as straightforward. Increasingly threats to the fiscal capacity of a government can come from states, criminal organizations, corporations, individuals, and even AI bots that are not actively controlled by a human, all organized outside of the country’s sovereign space and designed to leverage unwilling host infrastructure around the globe.

International law has not yet adapted to this shift. Traditional frameworks use rules that purport to govern state responsibility and countermeasures by relying heavily on the concepts of identifiable states, identifiable conduct, attribution, and conventional ideas of injury.[OG1] [3] Cyberattacks quickly frustrate those frameworks by obfuscating actors and actions and ultimately [OG2] producing unique injuries. It is no longer necessary to create physical damage to seriously impair and harm a state. Furthermore, cyberspace allows private actors to mount increasingly sophisticated attacks against civilian and state targets. The ease of moving virtual currency relatively anonymously provides a powerful profit motive that incentivizes top minds to keep improving their black hat skills. [OG3] The ability to route attacks through otherwise unconnected third parties also creates additional opportunities to avoid detection or enforcement actions[OG4] .

These types of issues become particularly severe when cyber operations threaten a state’s fiscal institutions. Because fiscal capacity is an important component and even a prerequisite of effective sovereignty, international law should meaningfully address threats against this capacity and allow for substantial deterrence efforts. The fluidity of cyber threats allows any number of state, non-state, or AI actors [OG5] to cross borders in cyberspace and inflict untold international damage and nonetheless evade traditional attribution rules. This reality increasingly demands that states act collectively to address sophisticated threat actors.

Fiscal Capacity is Key to Sovereignty

A state cannot govern effectively without the ability to raise and deploy resources. Margaret Levi’s work explains the idea that states survive because they extract resources and that in doing so they balance relationships between coercion, legitimacy, compliance, and capacity.[4] Because successful taxation is one of the defining characteristics of an effective state, fiscal capacity is itself a mechanism and an exercise of sovereignty. Douglas North’s institutional theory further suggests that taxation is a part of the political and economic architecture that structures state authority and shapes economic performance.[OG6] [5] Strong governments can tax predictably because their citizens trust governmental institutions.[6] Making credible commitments thus expands fiscal capacity. Michael Mann similarly distinguishes the power of rulers from the “infrastructural power” of state institutions to implement decisions throughout society.[7] Modern scholars like Besley and Persson have treated fiscal and legal capacity as foundational components of state capacity.[8] International organizations like the OECD [OG7] increasingly reflect similar ideas, describing financial capacity as central to resilience, emergency response, and governance.[9] NATO has also incorporated financial resilience and critical infrastructure into its concept of security[OG8] .[10]

            The Montevideo Convention on the Rights and Duties of States defines statehood through assessments of permanent population, defined territory, government, and capacity to enter relations [OG9] with other states .[OG10] [11] Fiscal capacity does not appear on that list,[OG11]  however, each of those attributes relies on the state’s ability to raise and deploy resources.[12] Without a practical ability to raise, control, and distribute capital, formal sovereignty may persist, but there is minimal capacity to exercise and protect that sovereignty.[13]

Cyberattacks produce exactly this type of harm without triggering any of the options normally available to a country under attack in accordance with international law. The 2022 ransomware attack against Costa Rica serves as an important example. Multiple institutions and government ministries [OG12] were attacked simultaneously, which impaired tax collection, customs, international trade, healthcare, government administration, and other public services until resolved, and ultimately led to a declaration of national emergency.[14] Some scholars have called this a “data disaster,” a new category of risk to sovereignty that demonstrates that relying on physical damage in international legal frameworks overlooks [OG13] the most serious modern threats[OG14] .[15]

The Limitations of Current Countermeasures

If cyber operations can meaningfully impair sovereignty without producing conventional physical destruction, then what does international law permit states to do to combat such measures?

S[OG15] tates have increasingly viewed legal [OG16] countermeasures as a mechanism for enforcing international obligations[OG17] , and this tactic could serve as a possible solution to the problem at hand. International law lacks a centralized mechanism of enforcement authority to resolve every interstate issue and to subsequently compel compliance. Instead the international arena is made up of a relatively loose collection of relationships between nations with varying degrees of formality and organization. This structure, or absence of structure, makes countermeasures [OG18] an effective tool to deter aggression and encourage compliance by allowing an injured state to take limited actions against the state to which the attack has been attributed that would otherwise violate their international obligations. The International Law Commission’s Articles on Responsibility of States for Internationally Wrongful Acts (“ARSIWA”) provide the principal framework and explain that the injured state is limited to countermeasures that are proportionate and designed to induce compliance rather than inflicting punishment.[16]

This structure makes sense when State A commits a physical wrongful act against State B. Acts in Cyberspace are rarely so straightforward. A ransomware attack may be committed by a criminal organization operating from State A, routed through infrastructure in State C, and directed against government or “too big to fail” private financial institutions in State B. The “home state” of the attackers may support but not control the hackers, knowingly allow them to operate, lack the investigatory or enforcement capacity to address the issue, or have no knowledge of them whatsoever. This makes traditional attribution difficult if not impossible.

Costa Rica is again a good example. The attacks that crippled portions of the government were financially motivated professional operations from a hacker group not technically affiliated with their host state. While this makes attribution impossible under current law, it does little to change the perception that Costa Rica was the victim of another state’s attempt to extract their resources. The absence of a flag does not defray the harm.

Resolving the Ambiguity Around Collective Countermeasures

            In addition to the attribution problem, whether uninjured states are allowed to participate in countermeasures on behalf of another, and to what extent, is not settled law.[17]

ARSIWA acknowledges that certain obligations are owed to the international community as a whole, particularly regarding serious breaches such as genocide and violations of other erga omnes[OG19]  obligations. In these cases, other countries should be able to invoke responsibility despite the harm being indirect.[18] However, Article 54 does not address measures taken by states other than the injured state(s).[19] Conversely, collective retorsions, merely unfriendly acts, are generally uncontroversial. Nevertheless, given the severity of the threat and the prevalence of non-state actors retorsions are unlikely to be a sufficient deterrent.

Cyber threats make resolving this uncertainty around collective countermeasures increasingly important. A smaller or less technologically sophisticated state may lack the capacity to identify and defend against an attacker operating on its networks.[20] Malicious operations may also pass through third states without their knowledge. In those circumstances, international cooperation can provide technical expertise, intelligence, and resources that the affected state otherwise does not have access to. Under existing sovereignty principles, however, states assisting another state’s territory or networks, and possibly transiting or working in others, must remain vigilant and diligent to ensure compliance with the requirements for consent and their own international obligations.[21]

            Another ambiguity that must be addressed by international law arises when a state knows that serious malicious cyber activity originates from its territory but is unwilling or unable to address it. What obligations, if any, should the state have to prevent their territory or infrastructure from being used for cyber operations that cause harm abroad? How would this fit with 0 person companies where it becomes possible for an independent AI to be created in State A, and choose to operate without human input from compromised networks in State B, resulting in the ransom of private or public entities in States C, D, and E? The threat actor is functionally international and independent with the possibility to strike indiscriminately and simultaneously wherever and whenever it identifies an exploitable vulnerability. This reality favors collective countermeasures simply because that is the only way to attempt to match the structure of the threat itself. There are not clear borders in cyberspace, and the threat actor is not constrained by the limits of sovereignty. Thus new structural solutions such as collective countermeasures must be contemplated to address the novel form and nature of the opponent.[22] [OG20] 

Attribution is Only Getting Harder

            Attribution requires tracing an act to a human being and then up to the state they were acting on behalf of. In cases with traceable actors and physical actions it is still often impossible to gather sufficient evidence to show that the state is legally responsible for the person’s actions[OG21] . Layers of autonomous systems become far removed from a person or a state; yet the damage an AI agent can do is no less real. Neatly mapping responsibility will become increasingly impractical as technology continues to evolve.

            The obligations and responsibilities of each state that served as a host, knowingly or unknowingly, during the creation and operation of the AI agent are open and urgent questions. Furthermore, there is a practical imbalance between states with varying levels of expertise and resources in this area. This reality counsels against an overly strict standard and makes it challenging to consistently defend against increasingly sophisticated attacks that may have an international ripple effect.[23]

[OG22] 

Adapting to the Threat

            Traditional frameworks of international law do not have to be entirely discarded  to deal with the uncertainty in cyberspace. Caution is advisable to avoid mistakes that might escalate tension between states.[OG23]  However, the traditional safeguards can and must evolve to effectively reconcile the realities of modern statehood with the fluidity of the threat. Fiscal institutions are parts of the infrastructure through which modern states exercise sovereignty. Their importance must be acknowledged. When cyber operations threaten fiscal capacity, even if there is no physical damage, there must be a legal and effective method of deterrence under international law. Simultaneously, the multiparty nature of cyber operations makes bilateral countermeasures increasingly impractical.[24] While the legality of collective countermeasures remains contested, this area of the law demands more attention and a set of rules specific to engagements in cyberspace. Those rules must balance the benefits of collaborative countermeasures and preventative measures with both a state’s right to sovereignty and an individual citizen’s right to privacy during interventions.[OG24] [OG25] 

[1] Charles Tilly, Coercion, Capital and European States, A.D. 990 – 1992 (1992). 

[2] Id.

[3] See Gabčíkovo-Nagymaros Project (Hung./Slovk.), Judgment, 1997 I.C.J. 7, 55–57, ¶¶ 82–87 (Sept. 25).

[4] Margaret Levi, Of Rule and Revenue (1989).

[5] See Douglass C. North, Institutions, Institutional Change and Economic Performance. (James Alt & Douglass North eds., 1990).

[6] Barry R. Weingast, The Economic Role of Political Institutions: Market-Preserving Federalism and Economic Development,11 J. L. Econ. & Org.1, 1-31 (1995).

[7] Michael Mann, The Autonomous Power of the State: Its Origins, Mechanisms and Results, 25 Eur. J. Socio. 185, 185-213 (1984).

[8] Timothy Besley and Torsten Persson, The Origins of State Capacity: Property Rights, Taxation, and Politics, 99 Am. Econ. Rev. 1218, 1218-44(2009).

[9] OECD, Restoring Public Finances (2025).

[10] NATO, 2026 Resilience Baseline Requirements, Baseline Requirement 1, Objective 1(3) (Sept. 15, 2026), https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2026/09/15/2026-resilience-baseline-requirements

[11] Convention on Rights and Duties of States art. 1, Dec. 26, 1933, 49 Stat. 3097, 165 L.N.T.S. 19.

[12] See id.; Besley & Persson, supra note 8, at 1218–19.

[13] See François Delerue, Cyber Operations and International Law, Cambridge Univ. Press, 2020.

[14] See Matt Burgess, Conti’s attack against Costa Rica Sparks a new ransomware era, Wired: Security (June 12, 2022, at 07:00), https://www.wired.com/story/costa-rica-ransomware-conti/ [https://perma.cc/JRQ2-86EF].

[15] See Tomer Simon & Ben Haklai, Data Disaster – A new threat for sovereignty, 125 Int’l J.  Disaster Risk Reduction 1, 1-9 (2025).

[16] Draft articles on Responsibility of States for Internationally Wrongful Acts, with commentaries (2001), https://legal.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf [https://perma.cc/M7B3-G69J].

[17] Alexandra Hofer, Third-Party Countermeasures: Making Custom Out of Ambiguous Practice?, 74 Int’l & Compar. L. Q. 287, 287-317 (2025).

[18] See Martin Dawidowicz, Third-Party Countermeasures in International Law (Cambridge Univ. Press, 2017).

[19] Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries, arts. 22, 42, 48–54, [2001] 2 Y.B. Int’l L. Comm’n, U.N. Doc. A/56/10.

[20] Samuli Haataja, Cyber Operations and Collective Countermeasures Under International Law, 25 J. Conflict & Sec. L. 33, 33–51 (2020).

[21] See Miles Jackson & Federica Paddeu, The Countermeasures of Others: When Can States Collaborate in the Taking of Countermeasures?, 118 Am. J. Int’l L. 231 (2024).

[22] See Michael N. Schmitt,  ‘Below the Threshold’ Cyber Operations: The Countermeasures Response Option and International Law, 54 Va. J. Int‘l L. 698, 698-730 (2015).

[23] See Jeff Kosseff, Collective Countermeasures in Cyberspace, 10 Notre Dame J. Int’l & Comp. L. 18 (2020).

[24] See Michael N. Schmitt & Sean Watts, Collective Cyber Countermeasures?, 12 Harv. Nat’l Sec. J. 373, 373–411 (2021).

Can Vehicles be Criminal Voyeurs?

mdecrow@maine.edu Article, Blog , , ,

Can Vehicles be Criminal Voyeurs?

Rebecca Hatt

 

New vehicles come equipped with cameras and microphones that surveil the exterior, and often the interior, of the car in the name of safety and interactivity.[1] Some cameras only help with parking, however, many go much further than that.[2] For instance, Tesla’s exterior cameras surveil the outside of the car in Sentry mode, on the lookout for vandals or collisions, and the interior cabin cameras are known to record on impact and to monitor for attentiveness while using supervised features.[3] The theory is that these cameras help protect against damage, theft, and unsupervised use.[4] While these are laudable goals, the theoretical intention and the opt-in model of data sharing isn’t enough to escape state voyeurism laws in states like Maine.[5] In Maine, a person is guilty of violation of privacy if that person intentionally installs or uses in a “private place without the consent of the person or persons entitled to privacy in that place, any device for observing, photographing, recording, amplifying or broadcasting sounds or events in that place.”[6] When these vehicles, or those equipped with after-market dashcams, are parked in private garages, or used for private purposes in such a way that activity in them would normally be private, the recording conflicts with a person’s reasonable expectations of privacy, and with this criminal statute. An opt-in from the driver is not sufficient to allow the vehicle to breach the privacy of others under the law, and even if the driver sought to obtain consent from every passenger or passerby, some people are not able to give legal consent. Despite the impossibility, car makers like Tesla include disclaimers that “[i]t is your sole responsibility to consult and comply with all local regulations and property restrictions regarding the use of cameras.”[7] So when a child is changing at the back of the car using towels or a Car Cabana to provide privacy, who’s watching, how do we know, and who does the law protect?[8]

Continue reading →

Mandating Zero Trust Architecture as a Condition of Cybersecurity Coverage

mdecrow@maine.edu Article, Paper , , , , , ,

Mandating Zero Trust Architecture as a Condition of Cybersecurity Coverage

Joe Jambor

 

Abstract

The Change Healthcare breach in February 2024 exposed the protected health information of 190 million individuals and cost UnitedHealth Group nearly $3 billion. The breach occurred because two-factor authentication was turned off on a single portal, but was ultimately destructive because once the intruder was inside the system, there was little that could be done to stop them. This Article argues that cybersecurity insurers are uniquely positioned to prevent breaches like this one by driving adoption of Zero Trust Architecture (ZTA), the “never trust, always verify” framework codified in NIST Special Publication 800-207, by requiring its implementation as a condition of coverage. Despite its proven success rate, full ZTA adoption remains critically low, with only ten percent of large enterprises projected to reach a mature Zero Trust posture by the end of this year, as cost, institutional resistance, and legacy technology continue to impede progress. Market incentives alone have failed to move the needle. Drawing on four intersecting bodies of law; the contractual doctrine of conditions precedent in insurance agreements, federal sectoral cybersecurity regulatory frameworks including the FTC Safeguards Rule and HIPAA’s Security Rule, the state insurance regulatory architecture under the McCarran-Ferguson Act, and the rapidly evolving common law standard of reasonable cybersecurity, this Article establishes that insurer-mandated ZTA requirements are legally permissible, practically achievable through a phased implementation framework tailored to enterprises of all sizes, and essential to stabilizing the cyber insurance market while reducing legal liability for insureds.

Continue reading →

The Blueprint for a Civil Rights Lawsuit against Government Surveillance Contractors Introduction

mdecrow@maine.edu Article, Paper , , , ,

The Blueprint for a Civil Rights Lawsuit against Government Surveillance Contractors

John Blegen

 

Introduction

In March of 2026, FBI Director Kash Patel, while speaking before the House Permanent Select Committee on Intelligence made a brazen admission. When asked by Ron Wyden, a Democratic senator from Oregon, whether the FBI purchases Cell Phone Location Data from internet advertisers, Patel replied:

“We do purchase commercially available information that’s consistent with the constitution and the laws under the Electronic Communications Privacy Act, and it has led to some valuable intelligence for us.”

Ron Wyden replied that if true, this practice by the FBI would constitute “an outrageous end run around the Fourth Amendment [that is] particularly dangerous given the use of artificial intelligence to comb through massive amounts of private information.”[1]

This FBI practice is not just an “outrageous end run around the Fourth Amendment,” but an outright violation of Americans’ Fourth Amendment right to privacy against unwarranted government surveillance.

In Carpenter, the Supreme Court held that it is illegal for the government to access cell phone location data information without a warrant.[2] Carpenter mentions no exception to this rule for information that has been purchased from wireless carriers or data brokers. It is not the property rights wireless carriers possess over this information that the Fourth Amendment protects; it is the right to privacy against unchecked government surveillance as ensured by the Constitution.

Patel’s argument would be the same as saying, the government is free to pay a private thug to break into a suspect’s apartment and acquire his wardrobe, or his private collection of firearms, or his diary, or any other piece of evidence without a warrant, so long as they do not do so themselves. It is a brazen admission of the FBI’s intent to not follow the Constitution.[3]

What allows Patel to be brazen enough to make such a statement is the fact that there currently exists no legal mechanism by which the public can validate their right to privacy against government surveillance. This is the case due to decades of congressional lethargy on the issue of data and tech surveillance, as well as the Federal Trade Commission’s refusal to enforce what little data protection laws do exist.[4]

It is also the result of years of the Supreme Court hollowing out plaintiffs’ ability to bring lawsuits against the federal government for violations of the Constitution.[5]  Such civil suits may be brought pursuant to 42 U.S.C. § 1983, which allows suits against states for actions taken in violation of individuals’ Federal Rights, and Bivens actions, which are the equivalent of a 1983 lawsuit against the federal government.

This paper contends that 1983 actions could provide a fruitful method for individuals to validate their right to privacy and push privacy forward against government surveillance, as well as third-party surveillance conducted by AI-surveillance companies like Palantir, which synthesizes mass amounts of data from across various sources into one “fusion” profile and Clearview AI, which provides facial recognition software to law enforcement agencies, both at the state and federal level.

As I will explain below, Section 1983 is an effective tool to limit both these private companies and the government because precedent has held that government contractors may also be subject to a Section 1983 lawsuit when they are performing government functions.

This paper also examines Bivens actions, with the caveat that Bivens law has been deeply neutered by Supreme Court precedent, making it effectively impossible to bring a lawsuit against the federal government for violation of federal rights, even though 1983 allows the same to be done against the states – as implausible as that sounds.

Continue reading →

Using the Current FISA Reauthorization Debate to Close the Data Broker Loophole and Introduce Relational Data Governance Over Mass Surveillance Programs

mdecrow@maine.edu Article, Paper , , , ,

Using the Current FISA Reauthorization Debate to Close the Data Broker Loophole and Introduce Relational Data Governance Over Mass Surveillance Programs

Michael Moran

 

With the upcoming sunset of Section 702 of the Foreign Intelligence Surveillance Act (FISA), congressional debate weighing national security and surveillance capabilities against civil liberties has returned, emerging around the capital like cicadas with increasing volume and urgency.[1] Amidst increasingly ubiquitous surveillance applied both at home and abroad, the “data broker loophole” has attracted particular scrutiny from lawmakers and privacy advocates.[2] This loophole allows law enforcement and intelligence agencies to circumvent a warrant requirement by purchasing commercially available personal data. At a time of heightened state surveillance capability and documented governmental data aggregation[3], introducing elements of Salomé Viljoen’s relational theory of data governance could constructively restructure this debate, weighing public safety needs against the collective harm of surveillance programs.

Current debates around FISA are still rooted in historical comparisons of public safety against individual data rights, but reframing that debate to consider these rights collectively may lead to a more durable solution.[4] Viljoen’s framework for data governance calls for a population-level lens of surveillance harm, and democratic mechanisms to evaluate privacy and data rights and uses in a more inclusive and responsive manner.[5] Reforms to increase transparency and advocacy in the Foreign Intelligence Surveillance Court (FISC), alongside the introduction of a data-governance entity, standalone, or within the FTC, could facilitate societal conversations around surveillance, rebuild public trust, and avoid the high stakes, all-or-nothing reauthorization cycles we face today.

In this article, I first define the data broker loophole in the context of FISA reauthorization and then outline the fundamentals of Viljoen’s relational theory of data governance. Next, I address why focusing on closing data pipelines or data broker loopholes is insufficient alone, without accompanying reforms that incorporate relational data governance. I then briefly propose some institutional reforms to incorporate democratic mechanisms into existing foreign surveillance oversight.

Continue reading →

Challenges with Adopting Blockchain Technology in the Wine Industry

mdecrow@maine.edu Article, Blog ,

Challenges with Adopting Blockchain Technology in the Wine Industry

Amanda Violette

 

I. Introduction

A bottle of wine encapsulates a complex narrative shaped by geography, craftsmanship, logistics, and market dynamics, and, more recently, climate change.[1] Traditionally, much of this narrative has remained opaque, especially to American consumers.[2] While French wines have been highly regulated since the early 20th century with the intent of preventing fraudulent products from damaging the wine industry, American wines became regulated by the Alcohol and Tobacco Tax and Trade Bureau (TTB) later using American Viticultural Area regulation to provide warnings about the dangers of alcohol on the label.[3] However, now, with American wines, only information about the grape origin is required, leaving the consumer to question whether the wine lived up to its intended character and authenticity.[4]

Continue reading →

Data Minimization’s Wolf Problem: Learning from Constitutional History to Design Effective Privacy Remedies

mdecrow@maine.edu Paper , , ,

Data Minimization’s Wolf Problem: Learning from Constitutional History to Design Effective Privacy Remedies

Caroline Aiello

 

I. Introduction

Nearly every modern privacy law restricts or seeks to limit how much data companies can collect and how they can process that data. Collectively, these provisions are known as data minimization standards. A foundational feature of privacy law, the concept of data minimization dates back to the earliest guidance and drafting of privacy laws. Widely considered a pivotal segment of a law, determining its effectiveness and severity, these provisions are hotly contested by industry leaders and consumer advocates throughout the legislative process.

For all the attention devoted to crafting an effective data minimization standard, legislators have overlooked a fundamental lesson from constitutional law: vague standards without concrete rules and meaningful remedies do not protect rights. The Fourth Amendment’s journey from an ineffective guarantee to an enforceable constitutional protection illustrates this principle. For over a decade after the 1949 holding in Wolf v. Colorado, the Supreme Court acknowledged the application of a prohibition on unreasonable searches and seizures to the states but declined to impose the exclusionary rule as a remedy.[1] During that period, the Court assumed that alternative mechanisms like tort suits and disciplinary actions would deter misconduct. As Justice Murphy warned in his dissent in Wolf, such alternatives were “deceptive,” and that alternatives to exclusion were effectively no remedy at all.[2]

This Article argues that federal data privacy legislation must learn from the Fourth Amendment’s institutional history. A federal privacy law’s data minimization standard should not merely set vague standards and hope that disclosure requirements, consent mechanisms, and scattered enforcement actions will protect consumer privacy. Instead, Congress should establish specific, substantive data minimization requirements that enumerate prohibited uses of personal data, backed by federal enforcement authority and meaningful penalties that create genuine deterrence. Just as the exclusionary rule transformed the Fourth Amendment from an aspirational principle into an enforceable right, federal substantive standards with robust remedies can transform data minimization from a theoretical protection into a practical safeguard.

This Article proceeds in five parts. Part II introduces data minimization, explaining the mechanical components of the law and what business practices they regulate. Part III analyzes and introduces current data minimization laws and enforcement actions both in the United States and internationally. Part IV examines the Wolf v. Colorado to Mapp v. Ohio progression, detailing how the Supreme Court’s twelve-year experiment with state-level Fourth Amendment enforcement failed and why federalization of the exclusionary rule ultimately proved necessary. Part V makes the affirmative case for federal substantive data minimization standards, proposing specific prohibited uses rather than reliance on interpretation of a reasonableness principle, and arguing for enforcement mechanisms that go beyond nominal accountability. Part VI addresses counterarguments, including concerns about business flexibility and innovation. The Article concludes by explaining how Congress can avoid repeating constitutional history’s mistakes and instead create a federal privacy framework that makes data minimization rights real rather than rhetorical.

Continue reading →

“Segregate-and-Suppress:” A Solution in Search of a Solution

mdecrow@maine.edu Paper , , , , , ,

“Segregate-and-Suppress:” A Solution in Search of a Solution

Viv Daniel

 

 I. Introduction

The following paper is an analysis of Eric Goldman’s 2025 article published in the Stanford Technology Law Review, The “Segregate-and-Suppress” Approach to Regulating Child Safety Online.[1] Goldman’s article identifies an emerging legislative trend meant to protect children online, which he terms “segregate-and-suppress,” and argues that this legislative strategy is misguided because it damages privacy online, it is detrimental to the online information ecosystem, and it hurts many of the very children it was designed to protect. A segregate-and-suppress law is a law targeting publishers of content and information via websites and/or apps, which requires a publisher to distinguish between users on the basis of age, and to limit access to content for users deemed to be minors.[2]

This paper will begin by describing the problem that segregate-and-suppress was created to solve, to give context to the creation and implementation of these laws. Next, it will provide examples of the kinds of laws which fall under Goldman’s scrutiny and describe Goldman’s critiques of segregate-and-suppress and his alternative suggestions to it. Finally, this paper will evaluate the strength of Goldman’s arguments and proposed alternate solutions. This paper posits that, while Goldman’s argument is valuable to an honest debate of the topic, it would be strengthened by acknowledging the extent of the problem segregate-and-suppress is meant to solve, and by giving more consideration to the breadth of compromise-driven solutions available to alleviate threats to children’s safety online.

Continue reading →

No Harm, No Court: An International Approach to Data Privacy Harms and Article III Standing

mdecrow@maine.edu Article, Blog , ,

No Harm, No Court: An International Approach to Data Privacy Harms and Article III Standing

Emily Fowler

 

In the United States, cases brought regarding privacy violations are being dismissed early in the litigation process because U.S. law remains tied to historical analysis of injuries, whereas other legal systems around the world are taking a more forward-thinking approach to these issues. Trends in recent cases show that claims for privacy violations, such as the capture of individual interactions with websites through session-replay technology, are being dismissed for lack of standing.[1] Article III standing is a concept based in Constitutional Law. Under Article III, federal courts’ authority is limited so that they may only hear “Cases” and “Controversies”.[2] To bring a case or controversy before a federal court, plaintiffs must have standing (a “personal stake” in the case).[3] Three elements must be met to have standing: (1) there is “an ‘injury in fact’ that is both ‘concrete and particularized’ and ‘actual or imminent’”; (2) “the injury is ‘fairly traceable’ to the challenged conduct”; and (3) the injury likely “‘will be redressed by a favorable decision.’”[4]

Continue reading →