❌

Normal view

San Francisco Demands Removal of Nudify Apps

17 July 2026 at 22:16

Matt Burgess (MacRumors, ArsTechnica):

On Thursday, San Francisco city attorney David Chiu sent legal notices to Apple and Google demanding that they remove from their app stores 13 face-swapping apps, which allow users to create AI-generated nonconsensual nude images. The letters say the Silicon Valley giants should stop “aiding and abetting” the sale of explicit deepfake images and “sever” business relationships with the app developers.

[…]

Researchers have repeatedly found and reported apps in Apple’s App Store and Google’s Play Store that allow people to generate sexual images using AI—including some apps being rated as suitable for use by children. While new laws and bans aim to tackle the scourge of explicit deepfakes online, technology and social media companies consistently direct millions of people toward the harmful tech.

Both Apple and Google have developer policies that prohibit pornography, abuse, and harassment on their platforms.

Burgess gives the impression, which is my base assumption, that these 13 apps were clear about what they do, so App Review has no excuse for missing them. But I’m sure it’s keeping us all safe in other regards.

Meanwhile, in a preprint research paper published in May, researchers from Cornell University and Georgetown University identified 420 apps offering general face-swapping capabilities on Google’s and Apple’s app stores. They tested 155 to see if they could be used to create face swaps with nude images; in 70 percent of cases, it was possible, with the apps not including safety measures to prevent this.

Previously:

Update (2026-07-21): Danny Bradbury:

Chiu isn’t arguing that hosting an app automatically makes a platform liable for what it does. Platform operators already won that battle with Section 230 of the Communications Decency Act. That 30-year-old law says websites generally aren’t responsible for content posted by users, allowing platforms to host user-generated content without getting sued every time someone defames someone in a comment thread.

Courts have often extended those protections to cover app stores too. Apple and Google are treated as distributors of whatever a third-party developer uploads, rather than publishers.

Chiu is attempting to sidestep that argument by focusing on the companies’ payment systems, noting that Apple and Google collect a cut of every in-app purchase. According to the Tech Transparency Project (TTP), that means they profit from apps that generate revenue by creating non-consensual intimate imagery.

EU Exempts Apple Watch and AirPods From Battery Removal Requirement

17 July 2026 at 22:16

Hartley Charlton:

The European Commission yesterday adopted new exemptions to its Batteries Regulation that free the Apple Watch and AirPods from having to offer user-removable and replaceable batteries.

[…]

The reasoning largely mirrors why devices like electric toothbrushes were already exempt: Opening a compact, sealed enclosure and failing to reseal it properly could let water in and create a safety risk. Products can also qualify for exemption if their construction makes battery removal inherently dangerous, or if there is no realistic way to build in user access given current manufacturing methods.

[…]

The iPhone was already exempt from the removability rule under the original regulation, thanks to its battery cycle life and water resistance rating.

Marcus Mendes:

Although the Commission has adopted the exemption, it must still undergo scrutiny by the European Parliament and the Council of the EU.

[…]

To read the European Commission’s full delegated act, follow this link.

Previously:

Update (2026-07-20): See also: Hacker News.

Update (2026-07-30): Rui Carmo:

This is one of those exceedingly rare cases where EU legislation has produced an unambiguously good outcome: from February 2027, Logitech’s European wireless devices will ship with hard-pack, user-replaceable batteries, and Logitech will sell certified replacements.

Suno Hack and Audio Scraping

16 July 2026 at 20:42

Jason Koebler (tweet, Reddit):

The AI music generation tool Suno scraped millions of songs and lyrics from YouTube Music, Deezer, and Genius, as well as from the stock music libraries Pond5, Jamendo, Freesound, the International Music Score Library Project, and podcasts via RSS feeds, according to a hacker who breached the company and shared data about Suno’s training libraries with 404 Media. The hacker was also able to access user information for hundreds of thousands of Suno’s customers, as well as Stripe payment information, they said.

[…]

As part of these legal proceedings, Suno previously admitted that it was trained on “essentially all music files of reasonable quality that are accessible on the open internet,” which included a total of “tens of millions of recordings.” Suno has been making the argument that it is allowed to train on copyrighted works as fair use in those cases, one of which has been settled.

Corbin Bolies:

Suno has long acknowledged that its AI music generator relied on the scraping of millions of songs available across the internet, but a new hack reveals just how the company pulled from streaming services and websites[…] all while user information remained vulnerable.

[…]

“Our goal has always been to help people create original new music, not replicate someone else’s. That’s why we build our models around what we call ‘Original Creation, By Design,’” the spokesperson said in a statement. “For example, we intentionally do not use artist names as a category of training metadata because we want our models to help people create brand new songs, not music that replicates other artists’ existing work. It’s also why we built Suno with detection filters that block or prevent a user from using specific artist, song, or album names as prompts, and prevent users from uploading lyrics or sound recordings that match existing works.”

Previously:

Apple Sues OpenAI Over Trade Secrets

13 July 2026 at 20:02

Sarah Perez (PDF, Hacker News, MacRumors):

The iPhone maker alleges that this misconduct, which it says reveals a pattern of theft from OpenAI employees who previously worked at Apple, was directed by OpenAI’s senior leadership, including Chief Hardware Officer Tang Tan.

The lawsuit, which was filed in the U.S. District Court for the Northern District of California, accuses Tan of using Apple’s confidential project code names during OpenAI’s recruiting process, asking job candidates to bring in Apple hardware components to their interviews, coaching departing Apple employees on how to evade the company’s security procedures, and asking for details about the company’s unannounced products.

Apple’s allegations are detailed and shocking, and it sounds like they have a lot of evidence.

Chance Miller:

The lawsuit names Chang Liu and Tang Tan as two of the defendants. Tang Tan served as VP of product design at Apple, leading iPhone and Apple Watch product design. He departed the company in February 2024 to work with Jony Ive. Chang Liu, meanwhile, worked at Apple for eight years and was a senior system electrical engineer before departing to join OpenAI in January 2026.

Apple’s lawsuit also names OpenAI and io Products as defendants.

OpenAI’s hardware efforts are being led by Jony Ive, Apple’s former chief design officer.

[…]

Ive, Hankey, and Cannon are not personally mentioned anywhere in Apple’s initial filing today.

Emma Roth:

Here are the most surprising claims in Apple’s 41-page filing.

Marcus Mendes (MacRumors):

OpenAI’s Director of Strategic Communications, Drew Pusateri, took to X to comment on the company’s behalf.

In his post, he claims OpenAI has “no interest in other companies’ trade secrets,” adding that OpenAI remains “focused on building innovative technology that empowers people everywhere.”

This seems like a weak response, given that Apple says it reported its findings to OpenAI in February and never heard back. Presumably, they’ve already investigated but see the situation as serious enough that they need to say as little as possible.

It’s not clear to me the extent to which Apple believes the behavior was limited to the named defendants. It’s hard to believe that the rest of OpenAI’s leadership—including Altman and Ive—were unaware, given the scale of their recruiting from Apple. It’s equally hard to believe that they were aware and thought they could get away with it. I guess little from Altman would surprise me at this point. I’d like to believe that Ive wasn’t part of it, but then are we to believe that his former coworkers all kept him in the dark?

Nick Heer:

What is immediately notable about this whole thing is the myriad conflicts of interest. Apple, of course, has a current partnership with OpenAI to power Apple Intelligence features, something repeatedly mentioned on the previous version of its marketing webpage, and conspicuously absent on the current one.

But the history runs far deeper. Among the defendants in the suit is io Products — do not blame me for that capitalization choice — founded by Jony Ive and acquired by OpenAI last May. Total mentions of “Ive” in the body of this lawsuit? Zero. Also, one of the investors in Ive’s company was Emerson Collective, founded by Laurene Powell Jobs, and which now has equity in OpenAI. Neither Emerson nor Powell Jobs are defendants.

M.G. Siegler:

It all reads a bit as if Apple has been building up evidence of these allegations for some time and recently got their smoking gun. It’s not just nebulous “trade secrets” either, there are specific mentions down to “metal finishing techniques” that Apple apparently invented and protected.

It also comes a little less than a month after OpenAI was rumored to be threatening Apple with a lawsuit over the perceived failure of their deal to bake ChatGPT into the iPhone. As I wrote at the time, even just that threat was clearly not going to go over well in Cupertino.

John Gruber (Mastodon):

Footnote 13 on p. 15 states:

Apple and OpenAI have a commercial relationship involving the integration of OpenAI’s ChatGPT into Apple Intelligence. The companies have entered into a written agreement governing that integration. That agreement is not at issue here. OpenAI’s acts of trade secret misappropriation alleged herein do not arise from and have no connection to that agreement.

Be that as it may legally speaking, in practical terms it seems untenable for that Apple Intelligence partnership to continue after this.

Jason Snell:

All that bubbling-under-the-surface tension between Apple and OpenAI is now out in the open!

M.G. Siegler:

Namely, while Apple frames OpenAI – or at least its fledgling hardware division – as “rotten to its core” (interesting terminology!), they really only have a case against two and maybe three individuals. But they also clearly believe that if this case goes to trial, they will have a case against a lot more.

[…]

The parallels to the Anthony Levandowski situation after he left Google for Uber have been drawn.

[…]

It is interesting that Apple is not suing Yu-Ting “Alyssa” Peng, who is named in the suit as a co-conspirator with Liu while she was still employed at Apple, before she also subsequently went to work at OpenAI. Is it possible she’s cooperating or has cooperated with Apple in this investigation?

[…]

Even if these allegations are found to be untrue or embellished, can he reasonably stay at OpenAI now? And perhaps that’s the real outcome Apple is looking for here, as they clearly frame him as the ringleader of the 400-plus people who have come over to OpenAI from Apple.

Hartley Charlton:

OpenAI’s ambitions to build a hardware rival to the iPhone are already running into trouble because of Apple’s trade secret lawsuit, according to Bloomberg’s Mark Gurman, who argues the damage is showing up well before any court ruling.

[…]

The scale of the talent drain is a major part of why this matters to Apple. More than 400 former Apple employees now work at OpenAI, including former Apple design chief Jony Ive, and Gurman says the company poached so heavily from Apple’s iPhone product design group specifically that Apple had to rebuild parts of the team. Apple has responded with bigger retention bonuses and executives personally working to keep engineers from leaving.

Jeff Johnson:

OpenAI stole stuff? I can’t believe it! I thought they were done with stealing after they stole literally everything on the internet.

Colin Cornaby:

I’m sure there’s no problem with sending this company all your source code they pinky swear not to train on.

Steve Troughton-Smith:

I can’t believe this awful company solicited confidential information and stolen trade secrets, hiring from this other company while pretending to partner with them. ‘Rotten to the core’ indeed

😛

He’s referencing Apple doing this to Masimo. And, of course, Steve Jobs himself directed Apple to engage in illegal hiring practices.

Previously:

Update (2026-07-17): See also: Dithering.

Tim Hardwick (FT, Hacker News):

Apple has reportedly sent legal letters to dozens of former Apple employees now working at OpenAI, telling them to preserve potentially relevant documents and communications as it continues to pursue its trade secret lawsuit against the AI company.

Update (2026-08-06): Hartley Charlton (PDF):

OpenAI has asked a federal judge to dismiss Apple’s lawsuit accusing the AI company of stealing trade secrets, calling the allegations “meritless.”

Previously:

Apple Still Designated a Gatekeeper

9 July 2026 at 19:38

Tim Hardwick:

Apple’s challenge against the EU’s designation of its App Stores and iOS platform as “gatekeepers” was dismissed by Europe’s top court on Wednesday, reports Reuters.

[…]

The company also disputed the classification of iMessage as a number-independent interpersonal communications service, or NIICS, which would subject the app to EU telecoms rules. But the General Court said Apple’s actions regarding the iMessage service are inadmissible.

William Gallagher:

Back in 2023, Apple acknowledged that it qualified under the then-new definition of being what the EU called a gatekeeper service. But key to that is the size of the operation, and since 2024, Apple has been claiming it runs five smaller App Stores rather than one large one.

[…]

“Irrespective of the devices in question,” ruled the judges, “those stores have the same purpose, namely to connect app developers with end users in order to facilitate the distribution of software applications.”

Steve Dent:

Apple disagreed with the decision but didn’t say yet if it would appeal. “We firmly believe the DMA’s mandate goes beyond what is lawful and proportionate, threatening to erode decades of privacy and security protections we’ve built and leaving our users vulnerable to new risks,” an Apple spokesperson said in a statement to multiple outlets. “We will continue advocating for the innovation and privacy our European customers deserve.”

Apple still has two cases pending with EU courts. The first is a challenge to the EU Commission’s decision last year forcing Apple to open iOS to third-party developers, and the second is an appeal against the €500 million fine imposed in April last year for anti-steering violations.

Previously:

UK CMA Proposals for External Payments and NFC

3 July 2026 at 19:23

Ben Lovejoy:

The EU required Apple to permit third-party app stores, while a US court ruled that developers have the right to direct iPhone users to third-party payment platforms for app purchases and subscriptions. Britain’s Competition and Markets Authority (CMA) is now proposing to apply this latter rule in the UK.

Tim Hardwick (John Gruber):

The U.K.’s competition regulator has proposed letting app developers direct users to payment options outside Apple’s App Store and Google’s Play Store, in a move aimed at increasing competition and reducing the fees charged by the two companies.

[…]

The regulator said any fees Apple and Google charge developers for enabling such “steering” must be fair and reasonable, remain below existing App Store and Play Store commissions, and allow developers to either pass savings on to consumers or reinvest them in innovation.

John Gruber (Mastodon):

Requiring Apple to allow apps to steer users to the web to make payments is, I’ve long argued, sensible regulation. I’ve also long argued that Apple has been obstinate in disallowing it. If in-app payments — through Apple’s system — can’t compete with out-of-app payments on the web, something is wrong with IAP. But it’s wrong to assume that payments outside IAP will result in lower prices and better policies for users.

Nick Heer:

They may increase prices when costs grow but that does not mean they do the opposite. But who cares? Lower costs permit more flexibility on pricing and, even if that money ends up in the pockets of developers instead of Apple, is that supposed to be a bad thing? Is there a reason why someone should be upset that they might pay the same amount but an indie developer gets to keep more of it?

The proposed policies are pretty straightforward from what I can see. Among other obligations, Apple is not allowed to use or require scare tactics when users are routed to an external payment mechanism and, while it is allowed to charge a steering fee, it is not allowed to count services not used by developers offering third-payments nor double-count for services already accounted for by other developer fees. Also, the CMA calls bullshit on Apple’s claim that third-party payments are particularly risky[…]

Previously:

Update (2026-07-30): Juli Clover:

Apple said new UK App Store rules would give regulators a “highly intrusive” role dictating how it runs its business, reports Reuters. Apple submitted feedback to the UK’s Competition and Markets Authority as it considers forcing Apple to change its App Store rules around steering.

[…]

UK regulators said Apple can charge developers a fee, but it must be fair and reasonable, and below existing App Store commissions, so developers can pass savings to customers or reinvest them in innovation.

According to Apple, the CMA’s proposed rules would undermine innovation and investment, and would amount to price regulation because of the restriction on fees.

Hide My Email Vulnerability Exposes Real Address

2 July 2026 at 20:44

Joseph Cox (MacRumors, Hacker News):

A vulnerability in Apple’s “Hide My Email” tool lets almost anyone discover a person’s real email address that is supposed to be hidden by the feature, and Apple has failed to fix it for more than a year, according to a security researcher and 404 Media’s own tests.

[…]

“Apple Hide My Email is leaking email addresses that are supposed to be hidden. We reported the issue and replication instructions to Apple over a year ago. We don’t know why it hasn’t been fixed, but we don’t feel comfortable waiting any longer. Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses,” Tyler Murphy, the co-founder of EasyOptOuts, which discovered and reported the issue to Apple, told 404 Media.

“Free, publicly accessible people-search sites make it easy to link an email address to other personal details, so people relying on Hide My Email for safety may be at risk,” Murphy added.

[…]

To test the issue I generated a new Hide My Email address and provided it to Murphy. Around five minutes later, he replied with my real email address linked to my Apple account which was supposed to be hidden.

Ben Lovejoy:

Murphy said that he reported the issue to Apple in June of last year, and the company told him it was looking into it. Apple said it had been fixed in March of this year, but Murphy found that wasn’t the case. He again contacted Apple, with the company saying that it would appreciate him not revealing the existence of the flaw until it had been resolved.

Apple then said it planned to address the issue in June, but since it still hasn’t been fixed[…]

Tyler Murphy:

March 19, 2026: Using the reproduction instructions from our initial report, we determined that the vulnerabilities hadn’t been fixed.

May 22, 2026: We realized that the vulnerabilities may have greater severity and scope than we thought initially and reported this to Apple. Apple never acknowledged the report of increased severity.

June 30, 2026: Apple again reported that the vulnerabilities were fixed and asked us to verify. We determined that the vulnerabilities hadn’t been fixed.

Jeff Johnson:

This is every fucking Feedback I file.

John Gruber:

Not good. Especially the “We reported the issue and replication instructions to Apple over a year ago” part.

This is becoming a pattern. At least Apple still allows third-party e-mail providers.

Nick Heer:

Very few details are available right now. I have seen speculation that the original email address is revealed when someone replies using their hidden email address, but the impression I get from Cox’s reporting is that no user interaction is necessary[…]

[…]

I am also unclear about how, as of May, the EasyOptOuts guys found the “vulnerability may have greater severity and scope” than initially reported. Ominous, though.

Previously:

Update (2026-07-13): Jeff Johnson:

I don’t know whether I’ve accidentally stumbled upon that vulnerability, or perhaps in this case the Hide My Email user just messed up in some way, but I’ve definitely discovered a bizarre and troubling Hide My Email bug in Mail app (on macOS Sequoia 15.7.7).

[…]

Bizarrely, however, Mail app displayed an alert that I’ve never seen before, “This message was forwarded to you by Hide My Email,” despite the fact that I have previously received many emails from people using Hide My Email.

[…]

  • Why I am seeing two different @icloud.com email addresses, one of which appears to be the sender’s unhidden address?
  • Why are the To: and From: fields in my reply disabled?
  • Why is my reply not from my @underpassapp.com email address but rather displayed falsely as from the sender’s @icloud.com address and really from my unrelated Apple Account address?

Update (2026-07-16): Joe Rossignol:

Apple this week was sued over a reported “Hide My Email” flaw that could expose a user’s real email address. The proposed class action lawsuit alleges that Apple violated California’s false advertising law and other consumer protection statutes by knowingly offering a feature that does not work as advertised.

This is interesting in that the June 2025 bug report is the evidence that Apple “knew” the feature didn’t work, while “Apple continued to represent to consumers that Hide My Email would actually hide users’ email.” How long are they supposed to get to fix a bug?

Update (2026-07-20): Jeff Johnson:

The misleading user interface elements in Mail app are a bug, but by themselves they’re not a vulnerability. The vulnerability is that when I send a reply to my maliciously crafted email, my Apple account email address is disclosed in the “From” field of the sent reply! In other words, the Mail app interface lies, fails to show the true sent value of the “From” field.

There are a couple of crazy aspects to this information disclosure vulnerability:

  1. It does not require that the victim actually use Hide My Email! I never use it. As I mentioned in my previous blog post, I don’t even have an icloud.com email account.
  2. It does not matter which of the victim’s email accounts receives the email from the attacker. If your Apple account email address is a@foo.com, but you receive a maliciously crafted email addressed to b@bar.com, Mail app will still send your reply from a@foo.com, thereby disclosing your Apple account address.

Update (2026-07-21): Juli Clover:

Apple addressed a vulnerability in Hide My Email that exposed a user's real email address, reports 404 Media. Apple told the site the issue was fully fixed in a patch released on July 3.

[…]

While the bug has now been addressed, email logs that pre-date the fix could still expose user email addresses.

Update (2026-07-22): See also: Hacker News.

Jeff Johnson:

It appears that the vulnerability I discovered, and which still occurs, is different from the vulnerability reported by others[…]

Meta and YouTube Addiction Lawsuits

1 July 2026 at 21:05

Cecilia Kang, Ryan Mac, and Eli Tan (March, Hacker News):

The social media company Meta and the video streaming service YouTube harmed a young user with design features that were addictive and led to her mental health distress, a jury found on Wednesday, a landmark decision that could open social media companies to more lawsuits over users’ well-being.

[…]

Citing features like infinite scroll and algorithmic recommendations, K.G.M. sued Meta, which owns Instagram and Facebook, and Google’s YouTube, claiming they led to anxiety and depression.

Nick Heer:

For its part, the Wall Street Journal editorial board is standing up for beleaguered social media companies in an editorial today criticizing everything about these verdicts, including this specific means of liability, which it calls a “dodge” around Section 230.

[…]

Product design, though, is a different question. It would be a mistake, I think, to read Section 230 as a blanket allowance for any way platforms wish to use or display users’ posts. (Update: In part, that is because it is a free speech question.) From my entirely layman perspective, it has never struck me as entirely reasonable that the recommendations systems of these platforms should have no duty or expectation of care.

Nick Heer, on an April Massachusetts lawsuit:

To me, a non-lawyer, much of the actual text of the ruling (PDF) explaining why this lawsuit was not immediately turfed on Section 230 grounds seems pretty reasonable. For example, the judge says “[u]nder the default settings, Meta enables approximately forty types of notifications” for the Instagram app, which the government alleges “is designed to overwhelm young users and compel them repeatedly to reopen Instagram”. We can argue whether this is a meaningful thing for a government to police or if it is just another example of Meta resorting to tacky growth-hacking techniques instead of trusting their product is sufficiently compelling on its own. (Most days when I open Instagram in my browser, it puts a red badge over the notifications tab and suggests I have one new follower. I do not; I never have. It lies to me every time, presumably because it knows most people, including me, will usually click on that, thereby increasing a number on a dashboard somewhere.)

Mike Masnick:

couple weeks back, Jonathan Haidt published another entry in his ongoing campaign to convince the world that social media is inherently ruining kids’ lives. This one was a victory lap titled “Seven Lines of Evidence Against Social Media,” treating recent developments — including the social media addiction verdicts against Meta that most people are misunderstanding — as vindication of his thesis.

[…]

But then something inconvenient happened for Haidt’s thesis: Pew went and did a brand new study exploring teens’ experiences on TikTok, Instagram, and Snapchat. This one asked the kids themselves.

[…]

Indeed, the research repeatedly suggests that for the very small number of kids who are facing mental health problems and overrelying on social media in response, the answer is a targeted intervention to help those individuals — not a broad “ban kids from social media” program.

Previously:

Chatrie v. United States

30 June 2026 at 20:49

Amy Howe:

The Supreme Court on Monday ruled that when law enforcement officials used a “geofence warrant” – a warrant that instructed Google to provide location data for cellphone users who were near a particular place during a specific time period – to obtain evidence used to convict a Virginia man of a 2019 bank robbery, they conducted a “search” for purposes of the Fourth Amendment. By a vote of 6-3, the justices sent Okello Chatrie’s case back to the lower court for it to consider whether, as the Fourth Amendment requires, the search was “reasonable.”

Writing for the majority, Justice Elena Kagan emphasized that “[a]n individual has a reasonable expectation of privacy in records about his cell phone’s location, and police intrude on that constitutionally protected interest when they demand the information—even though for only a limited time, and from a third-party tech company.”

[…]

For purposes of whether the government conducted a search, Kagan said, it does not matter that law enforcement officials “access[ed] only a short amount of cell-phone location information.” […] Nor does it matter, Kagan continued, that Chatrie gave Google permission to collect and use the location data.

Previously:

App Store Complaint From Chinese Developers

30 June 2026 at 20:48

Hartley Charlton:

A group of 48 China-based iOS developers have filed an antitrust complaint against Apple with the country’s market regulator over the App Store’s commission rates, the South China Morning Post reports.

The developers sent an open letter to China’s State Administration for Market Regulation (SAMR), alleging that Apple failed to deliver on a promise to offer the lowest commission rate to the Chinese market. The group asked the SAMR to investigate and penalize Apple for allegedly abusing its market dominance to impose “unfair and excessively high” costs on local developers.

Apple lowered the fees in March but not as much as it did in Brazil and Japan.

Previously:

Kids Online Safety Act

30 June 2026 at 20:48

Amanda Silberling (May 2025):

The Kids Online Safety Act (KOSA) has been reintroduced into Congress. If passed into law, this bill could impose some of the most significant legislative changes that the internet has seen in the U.S. since the Children’s Online Privacy Protection Act (COPPA) of 1998.

As it currently stands, KOSA would be able to hold social media platforms legally accountable if it’s proven that these companies aren’t doing enough to protect minors from harm. The bill includes a long list of possible harms, such as eating disorders, sexual exploitation, substance abuse, and suicide. Though it overwhelmingly passed through the Senate last year, the bill was stifled in the House.

[…]

“Apple is pleased to offer our support for the Kids Online Safety Act (KOSA). Everyone has a part to play in keeping kids safe online, and we believe [this] legislation will have a meaningful impact on children’s online safety,” Timothy Powderly, Apple’s senior director of Government Affairs, said in a statement.

Nick Heer:

The App Store Accountability Act is based on model legislation written by the Digital Childhood Alliance. The lobbying group also publishes marketing pieces, including one (PDF) that calls Apple’s age verification frameworks “ineffective”. Specifically, it points to the lack of parental consent required “for kids to enter into complex contracts”, with “no way to verify that parental consent has been obtained”.

Maya Posch (via ednl):

Since the arrival of so-called ‘social media’ the central tenet of never giving out your personal information which was front and center during the 1990s and 2000s got quite literally flipped around. Suddenly we had massive corporations practically begging you to give every last scrap of your personal information, every intimate detail of your daily life and with it every last second of your attention span.

[…]

The upshot of this reversal is that instead of a mostly comfortable anonymous experience, suddenly every second that you’re awake has been turned into the equivalent of a schoolyard during recess, the watercooler banter at the office and similar social interactions.

[…]

This raises many questions, such as whether ‘social media’ and the FOMO it introduces is a legitimate addiction, and whether we shouldn’t make being online more anonymous rather than enforce a rather dystopian ‘real name’ policy onto the populace.

Joe Mullin (Hacker News):

Within the next week, Congress is preparing to vote on the KIDS Act, a sprawling package of legislation that seeks to control Americans’ web browsing and private messaging. The package includes a revised version of the Kids Online Safety Act, or KOSA, combined with a collection of other internet bills, study bills, reporting requirements, and new regulations. Instead of debating any of these proposals on their merits, lawmakers are attempting to move them all at once under an ultra-expedited process.

[…]

Buried inside the KIDS Act are provisions that will push online services to verify all users’ ages, require government-directed moderation policies for online speech, and even create new rules about private and encrypted communications. While supporters continue to claim this bill protects minors online, its requirements come at the expense of privacy, free expression, and the ability of people of all ages to use the internet without revealing sensitive data.

[…]

Several provisions of the bill create new rules around direct messages, disappearing or “ephemeral” messages, and AI chat services.

The bill includes language stating that certain KOSA requirements should not be construed to override strong encryption. But the protection is incomplete. The carve-out applies to certain features and messaging controls, but doesn’t apply to KOSA’s separate requirement that platforms “address” a list of harms to minors.

Previously:

UK Social Media Ban

30 June 2026 at 20:47

Tim Hardwick:

The British government will introduce a ban on social media access for all users under 16 years of age, set to take effect in 2027.

[…]

The plan goes further than a similar ban introduced in Australia. It will cover major platforms Snapchat, TikTok, YouTube, Instagram, Facebook, and X. An exhaustive list has not yet been released, but Starmer said the rules will apply to services “whose purpose is to enable social interaction and which allow users to post material.”

Messaging apps like WhatsApp and Signal are not covered by the ban, and most social media platforms already require children to be over 13 to create an account and use their services.

Max Goldbart (Hacker News):

So-called AI ‘romantic companion’ chatbots – designed to simulate sexual relationships or roleplay with users – will have to enforce a minimum age of 18 and the government will also be looking in more detail at overnight curfews and breaks in infinite scrolling for under-18s, with more detail coming in July.

[…]

The government said it will “learn the lessons” from Australia’s experience by introducing more highly effective age assurance measures to support compliance, making it far harder for children to bypass safeguards.

Ax Sharma (Hacker News):

In practice that means anyone opening a new account will likely have to prove they’re over 16 by uploading an ID or passing a facial age scan, the same checks that adult sites serving UK visitors have implemented since July 2025 under the Online Safety Act.

Long-standing accounts are largely exempt, but signing up fresh now triggers verification, effectively ending anonymous account creation in the UK.

James Rodger (Hacker News):

New VPN rules are set to be issued by the Labour Party government as part of the under-16 social media ban. The government has not revealed any plans to regulate them, but ministers have said details about action alongside the social media ban, including regarding VPN use, will come in July.

Paige Collings and Jillian C. York (Hacker News):

There remains no reliable, privacy-preserving method of verifying the age of every internet user and methods vary from one platform to the next.

Young people will not simply be protected from being contacted by adults or endlessly scrolling—they’ll also lose access to educational videos on YouTube, local events on Facebook, and potentially cut off from distant friends and family.

[…]

The provision also requires internet service providers to limit the time kids spend online, and has rules about who can contact them online. These extreme rules will take decisions about using technology away from families and put them in the hands of government regulators.

Cory Doctorow (Hacker News):

The problem is, there’s no such thing as “age verification” for the internet. What we call “age verification” is actually mass surveillance, so invasive and pervasive that it makes the ad-tech industry’s commercial surveillance look like some kind of cypherpunk darknet pirate utopia[…]

[…]

Any attempt to save kids from online harms should start with saving kids from online surveillance, but that’s the opposite of what we’re doing today. After decades of failing to pass and enforce privacy controls for the internet, those same governments are breaking all land-speed records to pass “age verification” laws that make privacy illegal[…]

Anonymous (Hacker News):

Lots of US states, European countries, and Australia have introduced “age verification” regulations. They present it as the classic “save the children” talking point, but it’s really just a precursor to attribution of speech, particularly attributing your words to your real identity.

Sean Hollister (via John Gruber):

Azdoufal is the security researcher who used Claude Code to help discover that every DJI Romo robot vacuum cleaner and a million baby monitors and security cameras were embarrassingly easy to hack. This time, he says he discovered over 985,000 photo IDs sitting on the public internet for any half-decent hacker to steal.

[…]

Traditionally, you’d need to provide a photo ID every time you wanted to get into a club. But with the verification system, the receptionist can pull up your stored identity documents and check if your face matches. There’s also an optional app called PuffPal that lets clubs scan a QR code for faster entry.

But when Azdoufal decompiled that PuffPal app, he explains in his report, he discovered that Nefos had no meaningful level of security.

Previously:

Update (2026-07-01): Craig Grannell:

I find it incredible that the UK government is about to create a cliff edge where teens will simultaneously be able to access social media and vote, having had no experience of the latter and with scant understanding of how algorithms work.

Update (2026-07-08): James Ball (via Nick Heer):

There are almost no truly public spaces on the internet. Everywhere we congregate is privately owned, even if it operates as a public space. But we seem somehow content to accept them as fiefdoms in their own right, beyond the reach of government. Instead of demanding that they function as safe and pleasant public spaces for all of us, we are asking our governments just to ban teenagers from them.

[…]

It is one thing to ban our children from one park when there are others nearby. It is quite another to ban them from every public space when there are no others on offer.

[…]

I am skeptical as to whether social media is as dangerous as some of its critics say. I am even more skeptical as to whether it is particularly dangerous to teens and young people. […] The central facet of my argument in this post is that wherever you land on the matters of the harms of social media, a ban for teenagers is the wrong response. If the harms are overstated, the policy is unnecessary. If they are not, it is an abdication.

Export Control for Fable and Mythos

29 June 2026 at 18:36

Anthropic (tweet, Hacker News):

The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees. The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.

David Sacks (recently departed AI czar, via Dare Obasanjo, Hacker News):

Fable is Mythos with guardrails. But if those guardrails fail, then you’ve exposed Mythos and its advanced cyber capabilities to people who shouldn’t have them. (Keep in mind that Anthropic itself widely promoted the idea that Mythos was a cyberweapon and needed to be regulated as such. They asked for government regulation of Mythos and championed the guardrails on Fable. If there is a vulnerability — big or small — it is Anthropic’s responsibility to patch.)

A highly credible trusted partner of both Anthropic and the USG who was testing Fable came forward with a jailbreak of those guardrails. The Admin asked Dario to fix the jailbreak or de-deploy the model. Dario refused.

Amrith Ramkumar and Robert McMillan (Hacker News):

The Trump administration’s decision to halt all foreign use of Anthropic’s most-capable AI models was prompted by conversations between Amazon.com Chief Executive Andy Jassy and U.S. officials including Treasury Secretary Scott Bessent, people familiar with the matter said.

Dare Obasanjo:

If Claude Mythos is as powerful and dangerous as Anthropic says it is then export controls are totally reasonable. After all, Biden put export controls on Nvidia GPUs for similar reasons.

That said, banning foreign worker Anthropic employees from Mythos reads more like retaliation than regulation.

Ben Thompson (via John Gruber):

Anthropic went on to make the case that non-universal jailbreaks were inevitable and also narrow, and that there was no evidence of a universal jailbreak; the jailbreak that was found, meanwhile, appears to have been reported by Amazon, which is notable given Amazon is both an investor in Anthropic and a major provider of inference to the company. As I write this, senior Anthropic staff are in Washington D.C. seeking to resolve what they insist is a misunderstanding, and which White House officials are suggesting is insouciance by the company’s leadership to legitimate national security concerns.

I don’t actually have much to add to the current conflict given how many facts are in dispute; what I am not surprised about is the fact that the conflict is happening: I already explained in Anthropic and Alignment why conflict between the U.S. government and Anthropic was inevitable. To that end, people who are arguing that Mythos isn’t powerful enough to warrant the government’s drastic action are missing the point: if it’s not powerful enough now, the next one will be, or the one after that, particularly now that models are increasingly useful in creating their successors.

[…]

The broader takeaway from that previous episode, however, is that Anthropic believes that they are the ones who should have final say over how Anthropic is used; given that they think only they should be developing leading edge AI, they by extension think that only they should have final say over AI generally. When you further combine this realization with the company’s pronouncements about AI’s ability to conduct all economic activity, you realize that Anthropic’s leadership effectively wants to have power over everything and everyone.

Bruce Schneier:

The government’s actions won’t help. The problem isn’t any one particular model; it’s the general trend of increasing AI capabilities. And any real solution requires the sort of collective action that just isn’t possible right now.

[…]

The broader community had only a few days with Fable, but that time we learned some about its capabilities. Its difference is less the new model’s raw analytical and problem solving capabilities, and more that the model doesn’t need that sophisticated harness.

[…]

Human systems rely on so many norms that we scarcely recognize the existence of until they are broken. AIs naturally think outside the box, because they don’t have any real conception of what the box is or why it’s there in the first place.

There is no foolproof way to prevent people from using AI models to complete harmful tasks. There is no way to prevent the models from incidentally causing harm while completing benign tasks. AI models are no longer isolated from the real world. They browse the internet and answer emails.

Hayden Field:

Anthropic declined to comment multiple times this week about the state of the talks, saying there was no news to share. But the lack of news is the story here. After 14 days of high-intensity negotiations, nobody knows when or if Anthropic’s most powerful AI models will come back, let alone whether President Trump could expand his order to more companies with similar tech.

[…]

It’s not clear exactly why Anthropic and the administration remain at an impasse. One problem may be that there’s no clear framework for applying export controls to AI systems. Most companies making dual-use products — civilian systems with potential defense or military uses — can evaluate them using what’s essentially a checklist during the manufacturing and production process. Anthropic, however, is facing a complicated bureaucracy figuring out how to apply its rules from first principles.

[…]

Katie Moussouris, the founder and CEO of Luta Security, viewed a report about the Fable 5 vulnerability at Anthropic’s request. She thinks it’s significantly overblown. In a blog post, Moussouris detailed how researchers jailbroke guardrails that prevent Fable 5 from finding exploitable security holes, one of the unfettered Mythos 5’s scariest capabilities. […] In Moussouris’ eyes, however, this shouldn’t have triggered such a severe governmental action and is in fact an essential tool for AI coding.

Jared Perlo (Hacker News):

The U.S. government is allowing Anthropic to deploy its Mythos 5 model to a select group of customers and partners, according to a letter from Commerce Secretary Howard Lutnick to Anthropic that was seen by NBC News.

In the letter, Lutnick wrote that the government was confident in the guardrails Anthropic had put in place to allow trusted users to access the powerful AI system.

Julie Bort (Reddit):

It is now allowing Anthropic to make Mythos 5 available to more than 100 specific U.S. government agencies and companies, including allowing the non-American employees at those organizations to access to the model, both Semafor and Reuters report. This list also includes Anthropic’s own non-American employees, who were included in the original ban that forbade non-Americans from accessing the models.

[…]

Apparently, the administration did not address the release of Fable 5 in this directive.

It’s unclear what technical changes Anthropic may have made or what else they may have done to change Lutnick’s mind.

Kate Park (Hacker News):

On Wednesday, Chinese cybersecurity firm 360 reportedly unveiled Tulongfeng, an AI tool it says can go head-to-head with Anthropic’s Mythos.

Dare Obasanjo:

It seems inevitable that OpenAI and Anthropic will lobby the U.S. government to ban Chinese models in much the same way car companies effectively got Biden to ban Chinese EVs with 100% tariffs.

This puts them on a collision course with the hyperscalers like Microsoft who’ll happily host GLM & Kimi.

Previously:

Update (2026-07-01): Anthropic (tweet, Hacker News):

As of today, June 30, the export controls on Fable 5 and Mythos 5 have been lifted.

[…]

We have also restored access to Mythos 5 for a set of US organizations, following the US government’s approval on June 26. We continue to coordinate with the government to expand access to the broader set of domestic and international partners in the Glasswing program.

[…]

Importantly, the reported technique did not expose any unique Mythos-level cyber capabilities. The behavior reflected a borderline case for Fable 5’s safeguards—as we will explain below, there are some tasks that are unlikely to be dangerous but are nonetheless blocked by the safeguards out of an abundance of caution. The reported technique allowed access to one such behavior, but it only involved routine defensive cybersecurity work.

Even so, we moved quickly to address the reported bypass. Working closely with the government, we trained an improved safety classifier that targets and blocks the behavior described in the report. Users will be notified if a request to Fable 5 is blocked, and the request will instead be sent to Opus 4.8.

Apple sends legal preservation letters to dozens of former employees now at OpenAI

17 July 2026 at 14:00

Apple logo

Apple has intensified its high-stakes legal fight against OpenAI by sending formal preservation letters to approximately 40 former employees who now work at the AI company, according to reports from the Financial Times and corroborated by tech outlets.

The move comes just one week after Apple filed a lawsuit against OpenAI (and its hardware-focused entity, io Products), along with two named former Apple executives: Tang Tan (OpenAI’s Chief Hardware Officer) and Chang Liu (a senior hardware team member). In the complaint, Apple accuses OpenAI of orchestrating a coordinated effort to poach talent and misappropriate confidential information related to hardware engineering, product development, manufacturing processes, and other proprietary designs.

Preservation Letters: What They Mean

These letters are not lawsuits themselves, but formal legal notices requiring recipients to preserve all potentially relevant documents, communications, emails, files, and other evidence. They serve as an early step in litigation to prevent the destruction or alteration of materials that could be critical to the case. Apple appears to believe the alleged misconduct extends beyond the individuals explicitly named in the original filing, viewing the evidence uncovered so far as potentially just the “tip of the iceberg.”

Apple’s lawsuit highlights that more than 400 former Apple employees have joined OpenAI. While hiring talent from competitors is common in Silicon Valley (especially in California, where non-compete agreements are limited), Apple alleges specific breaches involving the theft of trade secrets, violation of employment contracts, and improper use of proprietary information to accelerate OpenAI’s hardware ambitions, particularly its reported AI device development.

Background on the Dispute

• Key Defendants: OpenAI, io Products, Tang Tan (24-year Apple veteran who led product design), and Chang Liu (former senior system electrical engineer).

• Apple’s Demands: An injunction to stop OpenAI from using any Apple-derived information, plus monetary damages.

• OpenAI’s Response: The company has denied the allegations, stating it is “not aware of any evidence that this complaint has merit.”

The escalation underscores growing tensions between the two tech giants. Apple, a leader in consumer hardware, is protective of its tightly controlled supply chain and engineering secrets, while OpenAI is pushing aggressively into hardware to leverage its chatbot.

This development is likely to fuel further scrutiny of talent poaching in the AI sector, where companies compete fiercely for top engineers. Legal experts note that preservation letters are standard in complex intellectual property cases and signal Apple’s intention to build a broader case through discovery.

As the lawsuit progresses, both sides will be watching closely, especially as OpenAI continues its hardware timeline reportedly unchanged despite the legal pressure. The case could set important precedents regarding employee mobility, trade secret protection, and the blurry lines between accumulated expertise and stolen proprietary information in the fast-moving tech industry.

MacDailyNews Take: OpenAI, the company behind ChatGPT, the AI for newbies who don’t know better alternatives exist, seems to be filled with traitors.


‎
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!

Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.

The post Apple sends legal preservation letters to dozens of former employees now at OpenAI appeared first on MacDailyNews.

Em meio a processo, Apple envia advertências a funcionários da OpenAI

17 July 2026 at 17:06

Em meio à polêmica envolvendo a abertura de um processo contra a OpenAI, a Apple enviou cartas — mais precisamente advertências legais individuais — para dezenas de funcionários da empresa de inteligência artificial.

Segundo o Financial Times, cerca de 40 ex-funcionários da Apple que hoje trabalham na OpenAI receberam as cartas. Nela, a Maçã solicita reuniões com seus advogados, exigindo a preservação de documentos e comunicações.

A empresa, vale recordar, acusa alguns dos seus ex-funcionários de roubar planos secretos de hardware e entregá-los à OpenAI — que trabalha atualmente com o ex-chefão de design da Apple, Jony Ive, para desenvolver seus próprios dispositivos.

O envio desse tipo de documento é descrito pelo FT como uma prática agressiva. Nos documentos judiciais, a Maçã argumenta que as evidências que possui representam apenas a “ponta do iceberg” em relação à conduta da OpenAI.

Tendo denunciado diretamente a empresa e dois de seus ex-funcionários, a Apple afirma que todo o negócio de hardware da OpenAI estaria comprometido pelo uso de seus segredos comerciais de forma ilegal.

Procuradas pelo jornal, tanto a Apple quanto a OpenAI recusaram-se a comentar a reportagem.

❌