If you're tired of censorship and surveillance, subscribe to Reclaim The Net.The UK's Online Safety Act, and the way it is being implemented, is one of the most damaging online censorship laws attempted in a Western democracy.The law is now producing its first crop of court cases, and they are many.Meta, Roblox, Quora, TikTok, and X are either suing, appealing, or judicially reviewing various aspects of the regime put in place by the country's communications regulator, Ofcom.Meta, along with Roblox and Quora are unhappy about being designated as "Category 1" services, the tier that carries the most stringent duties under the Act. Meta is contesting this status for Instagram and WhatsApp, arguing that these are private one-to-one and small group messaging services that should not be covered by the duties that come with this category.TikTok and X are also challenging Ofcom, but not their Category 1 status - rather, they, along with Meta, are fighting the information demands the regulator has served them with. Meta said that Ofcom's initial request was for an additional 10,000 pieces of information - "more information than Meta has been asked to provide by any other regulator in the world."Ofcom, on the other hand, says that it risks being "clobbered" by deep-pocketed companies and individuals. Group Director for Online Safety Oliver Griffiths shared this with the House of Lords Communications and Digital Committee on September 15, as the regulator is trying to explain why it is not moving fast enough to implement the act."We are operating in a highly litigious environment," he said. "We currently have judicial reviews being run against us on our fees regime, twice, by Meta. We have a raft of services that are bringing judicial reviews against us for trying to collect data so that we can monitor and evaluate what is happening with the regime. We have four services that are appealing to the Upper Tribunal in terms of our categorisation register."But he also said that Ofcom has to tread carefully: "We have all come to work to make this happen, but, if we run unnecessary risks, we are going to get absolutely clobbered legally by deep-pocketed individuals and firms."Category 1 status is not really a badge of honor. It's more of a workload. And it is not only a matter of being censored and forced to implement age verification, but also to report to Ofcom, which wants to know about the "moderation" taking place on these platforms.The Category 1 "special duties" are: identity verification of users, expanded user controls, transparency reporting, complaints procedures, protections for journalistic and democratic content, and measures on fraudulent advertising.As ever, the question is, who is the law for? The platforms are not really fighting it, they are just trying to make it more palatable to their bottom line. "Like many others in the industry, including TikTok, Roblox, X and Quora, we are challenging specific aspects of implementation. These are not challenges to the law itself, but how Ofcom has interpreted it," a Meta spokesperson said."This is a normal feature of any new regulatory regime being bedded in and ensures questions of process, scope and implementation get settled so the law is applied proportionately, accurately and consistently." Meta is trying to explain its actions, without ever mentioning the words "free speech" or "user rights."The only thing that is clear is that the law is being shaped by those with the deepest pockets, while those most affected by it - regular users - have no seat at the table.Meanwhile, in the UK parliament, the mood seems to be that the courts are the problem, not the law. Former junior minister for tech and the digital economy in the last Conservative government, Damian Collins, is now accusing Meta of "lawfare" - using the courts to delay implementation of the Online Safety Act.Collins wants the government to give more money to Ofcom. And he has no doubt that the legislation is sound, because, "the legislation is what the British people clearly want."The current Culture Secretary, Lisa Nandy, has revealed that the law will be "updated regularly.""I think we're going to have to start getting used to the idea, actually, that government is going to be far quicker, far more interventionist, and I think I'm going to have to see the law updated regularly because tech is changing so fast that we've got to be able to respond," she said last week on the Sky News Electoral Dysfunction podcast.Meta is also separately challenging the way Online Safety fees are calculated, and arguing that the fees should not be pegged to global revenue. A substantive hearing in this case is set for October 13 and 14, 2026.And then there's the case of 4chan and Kiwi Farms, who challenged Ofcom in a US court, but on September 15, 2026, that case was dismissed because US courts lack jurisdiction under the Foreign Sovereign Immunities Act, which gives foreign governments and their agencies immunity from most lawsuits in American courts.But Ofcom is on the case. It is consulting on a draft Code of Practice and guidance for Category 1 services, and that consultation closes on October 2. The regulator expects the duties for these services to be fully in force around the middle of 2027.

If you're tired of censorship and surveillance, subscribe to Reclaim The Net.A federal district court in the Central District of California has ruled that police queries of automated license plate reader (ALPR) databases are not Fourth Amendment searches.The case is United States v. Riley, 2:25-cr-00380, and the decision came in the form of a September 10, 2026, order denying a motion to suppress evidence.The court’s reasoning, as outlined in the ruling, is that the detectives only came away with eight photographs from the database – four of a white Dodge Charger and four of a gold Chevrolet Malibu.This, the court said, is “clearly distinguishable from and less extensive than the ‘near perfect surveillance’ achievable through the historical CSLI at issue in Carpenter and the Google Location History data at issue in Chatrie.”Stanford law professor Orin Kerr, who wrote about the ruling on September 16, said “This is just a trial court decision, of course, and I assume it will be appealed to the court of appeals.” He added that it is the first court decision he is aware of that considers the question of ALPR data in the wake of the Supreme Court’s Chatrie v. United States decision in June, and noted that the 11th Circuit Court of Appeals heard oral arguments on the same issue on July 29 and has not yet ruled.That ruling established that acquiring Google Location History is a search, because it records the location of a user’s cell phone every two minutes or so and gives a “sweeping, granular, and comprehensive tool” to track people’s movements.Two defendants, Melvin Riley and Kenneth Holley Jr., are charged with Hobbs Act robbery, conspiracy to commit robbery, conspiracy to commit kidnapping, and kidnapping.The charges stem from two investigations, in Culver City and Carson, that both used ALPR data.The number of photographs is the key to the court’s decision, and it quoted the relevant case law to say that the data obtained by the police here could not create “an all-encompassing record” of a defendant’s whereabouts, nor could it “recreate the complete paths that Defendant traveled in those cars, even in combination with information from other sources.”The police had no “intimate window” into the defendant’s personal life, the ruling continued, and the data did not reveal “familial, political, professional, religious, and sexual associations.”And, the court said, this was not “dragnet type law enforcement practices.”The conclusion is that the ALPR queries “do not constitute searches for purposes of the Fourth Amendment.”The court also rejected the argument that the ALPR systems in question are “extensive, retroactive,” and allow for “deductions about individual’s daily movements over an extended period of time that ‘go to the privacies of life, the epitome of information expected to be beyond the warrantless reach of the government.'”The court noted that a previous ruling in the Northern District of Ohio in 2025 found that a defendant has no reasonable expectation of privacy “in the appearance of his vehicle or in his license plate number.”The court also found that the systems used by Culver City and Carson are not as comprehensive as the one in the Baltimore aerial surveillance case that the Fourth Circuit found unconstitutional.The eight photographs at the heart of this ruling were discovered in the following way: Culver City Detective Preston looked at “less than 100 photographs” in the Flock database, and found four that matched the white Dodge Charger. A subsequent search by plate number yielded one more. In Carson, Detective Maciel found four photographs of the gold Chevrolet Malibu. And a Home Depot in the same shopping center as the McDonald’s had its own Flock system, which captured a photograph of the gold sedan’s license plate and gave it to the police.Culver City uses Flock, which has 52 cameras at 28 intersections – “four percent of the city’s intersections” – and takes “18 million photographs a month,” storing them for 30 days. Only the Culver City police can search the database, and they can do it by plate number, location, roof rack, back rack, decals, bumper stickers, make, model, or color.In Carson, the Motorola system has 85 cameras at 31 locations, covering 75 percent of the city’s entry points. In April 2025, the data was stored for five years, and the police could access it with a case number.The court noted that there is no way for citizens in either city to opt out of the systems.

If you're tired of censorship and surveillance, subscribe to Reclaim The Net.A US court has decided not to break up Google’s advertising business, despite finding that the giant has engaged in anticompetitive conduct in that space.Instead, Google will have to follow a set of rules imposed by the court, in order to give a chance to competitors in the market.The court “rejects Plaintiffs’ proposals for structural remedies in the form of the divestiture of AdX, the open-sourcing of DFP’s final auction logic, and the contingent divestiture of DFP Remainder. Most of the parties’ proposed behavioral remedies, as modified by this Court, have been accepted,” the opinion reads.The 106-page opinion was written by Judge Leonie Brinkema of the US District Court for the Eastern District of Virginia, Alexandria Division, and explains a decision announced earlier in the month.The document, filed on September 2 and kept under seal for two weeks for redaction review, was unsealed and made public on September 16.We obtained a copy of it for you here.In 2025, the same court found that Google had “willfully engaged in a series of anticompetitive acts to acquire and maintain monopoly power in the publisher ad server and ad exchange markets for open-web display advertising.”The ruling said that Google tied its publisher ad server and its ad exchange “together through contractual policies and technological integration” – and that it “further entrenched its monopoly power by imposing anticompetitive policies on its customers and eliminating desirable product features.”The conduct was found to have “substantially harmed Google’s publisher customers, the competitive process, and ultimately, consumers of information on the open web” – while violating Sections 1 and 2 of the Sherman Act.The case was originally filed in 2023. The remedies phase included four months of discovery and an 11-day bench trial with 26 witnesses and over 100 exhibits.In the latest ruling, Judge Brinkema said that the solution to this, sought by the government – divestiture of AdX – is “neither feasible nor an appropriate remedy.”The judge said that the time it would take to migrate AdX to a new owner would be up to 540 days from the signing of the deal, and another two years to migrate customers, on top of the time needed to find and approve a buyer.The functionality of AdX after the sale could not be guaranteed, the court said, and this is technology that “absolutely has to work for customers.”And the judge invoked equity, saying that the court must “consider the harms that might befall other market actors, even if that means ... forgoing a remedy that could help restore competition.”And, “antitrust remedies must cause as little injury as possible to the interest of the general public,” the opinion said, citing a 1911 Supreme Court ruling, American Tobacco.As for the proposal to open-source the auction logic of DFP, the court found it “neither appropriate nor reasonable.”And the judge also rejected the government’s push for this as based on a “lack of trust that Google will comply with an order from this court and an unrealistic desire for certainty.”Google will instead have to connect AdX to rival publisher ad servers and to Prebid, and connect DFP to Prebid. The giant will also have to share data with third parties, and will be banned from discriminatory bidding.A Monitor and a Technical Committee will also be appointed, as both sides had asked for.The judge said that these measures will be enough to “effectively pry open to competition the ad tech markets that were injured by Google’s unlawful conduct and prevent Google from reverting to anticompetitive conduct in these markets.”The injunction will last six years, as requested by Google, and not 15, as the government wanted. The court said that a longer period “runs the risk of ‘impairing rather than enhancing competition’” – and that markets “are often more effective than the heavy hand of judicial power when it comes to enhancing consumer welfare.”In a rapidly changing industry, imposing a remedy “is not unlike trying to shoe a galloping horse,” the opinion said.As the Open Markets Institute executive director Barry Lynn put it, the ruling is “more proof the U.S. judiciary is abdicating its congressionally mandated duty to apply the text and spirit of the nation’s antitrust laws.” The Open Markets Institute has received funding from the Open Society Foundations and the Omidyar Network Fund.The judgment will take effect 60 days after entry, except for the work on appointing the Monitor, which starts immediately. The parties have 30 days to file one jointly proposed final judgment.The ruling also covers Google’s use of first-party data, and here the judge found that the giant can continue to use it “without sharing it with third parties” in order to comply with publisher preferences, its internal privacy policy and privacy law.The carve-outs, the court said, “should balance the importance of consumer privacy and the significant resources that Google has invested in upholding and maintaining privacy protections.”The court noted that Google’s advertising tool does not currently use first-party data to bid on open-web display ads at all, so “this concern is premature. For now, this non-discrimination remedy merely puts in writing the status quo.”

If you're tired of censorship and surveillance, subscribe to Reclaim The Net.A US congressman has introduced a bill that, if it becomes law, will write into US statute the ability of courts to order VPNs and DNS resolvers to block sites.The American Copyright Protection Act of 2026 was introduced by Rep. Darrell Issa (R-CA), and the text of the bill, dated September 14, was referred to the House Judiciary Committee.For the first time in the US, a site-blocking bill mentions VPNs by name. The definition of "service provider" now "includes providers of broadband internet access services, providers of domain name resolution services, and virtual private networks, but excludes root nameserver operators and top level domain registries."The bill, which was not yet posted, is sponsored by the congressman who chairs the Judiciary subcommittee on courts, intellectual property, artificial intelligence and the internet, and who is retiring at the end of this term.The bill text states that the service providers it targets must have at least 100,000 monthly users or subscribers in the US. Excluded are those buying internet service in order to provide it to patrons or employees, such as airports, libraries, universities, or restaurants.Copyright holders would have to first ask a court to declare that an online location is a "foreign piracy site" – on a preponderance of the evidence. Once that is done, they can petition the court to issue an order that service providers block the site.Those targeted in this way would have 14 days to object, but judges can speed up or slow down the process, depending on the circumstances – such as to block live sports broadcasts inside the time they are taking place.Judges will also be able to volunteer to be on a special docket for these cases, and the Judicial Conference of the US will have to maintain the list of those judges, and publish it on the website of the Administrative Office of the US Courts.Issa said during a June 30 hearing that rightsholders "have raised concerns with the speed" of the current system of taking down content from the internet via DMCA notices. And then he asked, "Can we do it at the speed of sound? Can we do it at the speed of light? More importantly, in a 45-minute or sometimes a fraction of that live sports broadcast, can we do it soon enough to make it no longer profitable for those who pop up and sell their clandestine wares?"The congressman has previously linked online piracy with financing of terrorist groups and criminal networks.Issa is not alone in trying to push through site-blocking legislation. There are at least two other efforts, one of which is the Foreign Anti-Digital Piracy Act, introduced by Rep. Zoe Lofgren (D-CA) in January 2025. In July of the same year, the Block BEARD Act was presented by two Democratic and two Republican senators.The latest bill has been met with criticism from digital rights advocates, such as Re:Create's Brandon Butler, who called it "anything but American" and warned that forcing infrastructure providers, DNS resolvers, and VPNs to filter internet traffic would put user privacy at risk and cause "catastrophic collateral damage to the open web."Meredith Rose of Public Knowledge (a group that has previously called for more government regulation of the internet and media) criticized the proposal for potentially allowing one court to "cut off access to a website globally, based on a single individual's filing and an expedited procedure." Rose also warned that overblocking could have the same effect as it did in Europe, where it has brought down "digital infrastructure for hotels, car mechanics, retail shops, telehealth programs, and even a nunnery."In Europe, over 500 non-streaming sites have been blocked by Italy's Piracy Shield, including a Catholic convent and a telehealth platform, while in Spain, the system used to protect LaLiga matches has blocked 5.8 percent of the popular internet, taking down sites like those of Harvard University and Greenpeace, according to Re:Create. University of Twente researchers reported in September 2025 that at least "hundreds of legitimate websites [were] unknowingly affected by blocking" under Piracy Shield.The Motion Picture Association (MPA), which has been pushing for site-blocking for years and gave Issa an award last year, said in a letter in June that more than 50 countries already have site-blocking regimes, while "the United States still lacks a site-blocking mechanism to combat digital piracy." The MPA has not commented on the new bill.The latest bill also deals with what happens when sites are overblocked – that is, when the wrong ones are blocked by courts or service providers. In that case, the affected party can file a motion to "cure a defect," but first, they must enter an appearance and submit to the court's jurisdiction, serve the copyright owner and every service provider, and wait for their response. Then, they must certify that they are not the piracy site they have been accused of being and are not affiliated with it.If the motion succeeds, the court may award damages to the overblocked party, but only up to $250,000, and only if they can prove that the copyright owner was responsible for the error.

If you're tired of censorship and surveillance, subscribe to Reclaim The Net.Signal is rolling out Signal Login in its Android 8.28 beta, a feature that for the first time allows users to register for the app without a phone number. On the one hand, this is a major development because it removes the biggest roadblock to wider adoption of the privacy-minded messenger, and that is its very own core dependency on phone numbers. On the other, there are several caveats.More: Signal's Phone Number Problem Finally Has an AsteriskThe phone number has always been Signal’s weakest link, privacy-wise, because it is the link to a real-world identity, that of a telecom subscriber, and also to a physical SIM card that can be swapped by an attacker. But now Signal says that the Account ID and Recovery key replace the phone number.This is how Signal describes Signal Login: “an optional registration method that allows users to create a Signal account without providing a phone number.”And this is how the nonprofit explains the payment: “The price at launch is $2.99 / €3.49 (EUR price includes VAT), although this may vary by region and currency.” The payment is a one-time payment, and Signal promises that it uses “the same zero-knowledge proofs as Signal’s donation system, meaning there is no direct link between your payment and your Signal account.”The Account ID and Recovery key are the only two pieces of information that can be used to access the account, Signal said, adding, “When you purchase a Signal Login, you’ll be given an Account ID and a Recovery key. This is also the Recovery key used for on-device backups and Signal Secure Backups, even if you enable backups at a later time.”The key is sensitive information, and Signal advises users to “save your Account ID and Recovery key in a password manager.”If both are lost, the account is gone – it cannot be recovered. This is different from the current system, where a phone number can be used to recover an account. Two-factor authentication is available for accounts created with Signal Login, as TOTP-based 2FA.The optional username, which was rolled out recently, can also be used with this type of account, and without it, nobody can start a chat with you – you can either start the chat, or join a group using a group link. Devices linked to an account created with Signal Login work the same as those linked to a phone-number account.For now, Signal Login is available only to those creating new accounts, and only on Android, with iOS to follow later. It also requires Play Services on Android because the only payment method currently accepted is Play Store’s in-app payment. As AboutSignal, which reported the rollout, put it, “It’s currently not yet possible to buy a Signal Login account on a device that has no Play Services.”Signal, the site noted, says “they have plans to add more payment methods, but currently only offer Play Store in-app payments, which requires Play Services.”“Signal Login currently only works for new accounts,” the nonprofit said.It is unclear at this time whether de-Googled devices that have Play Services sandboxed, such as those running GrapheneOS, or those using the microG implementation of Google’s API that doesn’t require Play Services, can be used to buy Signal Login.The ability to remove a phone number from an existing account may come later.More: Signal's Phone Number Problem Finally Has an Asterisk