Let's dive right back in here with the legal and tech news I've been keeping an eye on in order to keep up to date with all things Privacy, Security, and AI. Reminder: knowing the law is only half the battle; we have to understand the technology and business leverage and the economics of the internet in order to understand what's really happening holistically.

  • AdExchanger: Apple Publishes Its Plan To Wipe Out Web Tracking - Privacy is running smack into both antitrust, the closed v open web, and the economics of the internet as Apple has decided to pull the trigger on blocking third party trackers and cookies on its mobile devices and web browsers, drawing a fairly substantial line in the sand that, of course, benefits it financially even as it uproots the adtech industry and the series of convoluted device fingerprinting and tracking tools it uses to fuel the programmatic advertising machine. Which is a long sentence with a lot of words to say "Shots fired!" Apple has long leveraged the privacy of its brand and platform to also benefit itself, so that can't be forgotten here, even as the behemoth cracks down on adtech companies that fuel much of the internet economy. It's a reminder that as important as regulators and class actions are, we play in the sandboxes controlled by Big Tech and what they do matters as much as anything.
  • CNET: Last Week’s Critical PHP Warning Was the Tip of the Web Vulnerability Iceberg - The week before last was an absolute nightmare for our cybersecurity colleagues who dealt with not just the PHP CVE but also the eMudhra certificate debacle and another baker's dozen incidents. Pour one out for our infosec homies. The big takeaway here is that we're entering an era where AI Agents (swarms!) can be pointed at systems and discover at speed and scale vulnerabilities at a volume we're not prepared to handle and, even worse, move from vulnerability to exploit before you can scramble the jets and patch. Anthropic Deputy CISO Jason Clinton posted on X, "As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better." It's budget season, so infosec and legal teams should be looking hard at cybersecurity, AI, and privacy budgets and roadmaps for 2027 because the foreseeable future looks rough. Leaning into data minimization and reviewing retention policies and cleaning up legacy data is something every company can do now for relatively low cost.
  • Cohere: Concerning behavior from a popular open-weight AI model - Canadian AI firm Cohere appears to have caught Chinese open source AI model Qwen 3.8 attempting to exfiltrate data from its sandbox and send it back to Chinese servers. This doesn't appear to be deliberate by Qwen's developer but merely the artifact of complicated programs acting outside of their instructions, which highlights a couple of ongoing issues: (1) AI is probably the most complicated tech stack I have ever seen and even the developers don't understand how it's working before and after they release it on the markets; (2) sandboxes are great! do not deploy untested code in production environments; and (3) open source and open weight has a place to play but a lot of companies aren't going to have the resources to do the diligence, testing, and safe deployment and maintenance of these models. Managed AI is going to be a big deal for mid-sized and even some large legacy companies because expertise is still rare.
  • TechCrunch: AI law firm Crosby bids on disintegrating, famed firm Weil Gotshal - BigLaw giant Weil unexpectedly collapsed this week and AI neofirm (is that what we're calling them these days?) has made a bid to procure Weil's trademarks, brand assets, and "some unspecified data." This marks at least the third time in the last year that I am aware of where AI companies have made major moves to procure data from bankrupt companies. The practice of procuring customer lists has long been part of the bankruptcy and restructuring landscape, but what is new is the acquiring companies and presumed use cases - training AI models - as well as the explosion of new laws around personal data. What data is involved? Is personal data de-identified? Are individuals being notified and given an opportunity to (withdraw) consent? What do the agreements look like for these deals? What liabilities follow the data from bankrupt company to new buyer? And is it time we think about addressing privacy in the bankruptcy code?
  • Reuters: Ambani, Adani outlets among Indian publishers contesting Modi’s privacy law - India has been working toward the deployment and implementation of its landmark Digital Personal Data Protection Act ("DPDP") since 2023 and established rules operationalizing the DPDP last year that have subsequently drawn the ire of various media companies and their allies. 21 media companies filed a lawsuit against the government on October 3, arguing the law infringed on press freedoms and prevented them from investigative work without the prior consent of the targets of their work. "The law also lets people withdraw consent at any time and demand that their data be erased, without any public-interest ​safeguard, which DNPA says could force its members to unpublish or heavily redact a factual news report." Expect some amendments to the DPDP prior to going into effect next year as result of this litigation.

If you need any help navigating these or any other privacy, security, or AI laws, reach out to us at Brandi@BennettTechLaw.com for help.