US social media surveillance lawsuit moves forward; EU operators should note the courts are starting to hold governments accountable for AI-powered monitoring.
elcome to issue twenty-three. This week the courts did something useful: a US federal judge let a lawsuit against government social media surveillance move forward, and a different court blocked a state law that tried to make VPNs technically illegal. Both stories are about the limits of what governments can demand AI and digital tools do to people, and both have direct echoes in how the EU AI Act draws lines around biometric and remote surveillance systems. We also dig into Apple's iOS 27 AI data practices and what they should prompt you to ask any AI vendor you use.
Let’s go.
yours, Flux
Flux Weekly is a 6-minute briefing for people who have to actually make AI work in Europe. Sole traders to enterprise, one issue every Friday morning.
- New We added a vendor questionnaire template to the Flux compliance toolkit this week, specifically covering social media monitoring AI tools and the data disclosure questions you should be asking suppliers right now.
- Updated Our high-risk AI system classification guide has been updated to clarify where drone-based surveillance and automated licence plate readers sit under the EU AI Act's Annex III categories.
- ICYMI Last week's piece on DraftKings and recommendation system liability is still the most-forwarded thing we have published in October, so if you missed it, the archive link is in the footer.
A Federal Judge Rules Government Social Media Surveillance of Labour Unions Can Face Trial, Setting a Precedent Every EU Operator Needs to Understand
The lawsuit lives. On 1 October 2026, Judge Alvin K. Hellerstein of the US District Court ruled that a case brought by three labour unions against the Departments of State and Homeland Security can move forward. The unions allege that the government conducted viewpoint-based surveillance and suppression of protected online expression. The judge refused to dismiss the case, meaning the government must now defend its social media monitoring practices in court.
Why this connects to the EU AI Act. The EU AI Act explicitly restricts real-time remote biometric identification and places AI systems used for social media monitoring of individuals in sensitive categories. This US ruling shows that courts, when given the chance, are willing to scrutinise whether surveillance tools are being used in a viewpoint-discriminatory way. EU operators deploying or procuring social media monitoring tools should treat this as a signal that judicial appetite for accountability is growing on both sides of the Atlantic.
Does your AI inform a decision that affects a person's job, credit, education, or essential service?
- ✓EU AI Act's restrictions on real-time remote biometric surveillance remain the sharpest in the world, with no comparable federal US law in sight.
- ✓Apple's iOS 27 AI feature rollout raises fresh questions about whether on-device AI processing counts as adequate data minimisation under GDPR and the AI Act's transparency requirements.
- ✓EU operators deploying drone-based monitoring systems should note that even US cities are finding their drone policies inadequate, a gap the EU Act's high-risk classification of remote surveillance systems is designed to close.
- ~A US federal judge blocked Utah's SB 73, which tried to effectively outlaw VPNs, ruling the law demands a technical impossibility.
- 1EFF's Surveillance Self-DefenceEducation
A free, practical guide from the Electronic Frontier Foundation covering how surveillance tools work and how to limit exposure.
Why we like it. Understanding how surveillance tech actually functions is the foundation for assessing whether a vendor's AI system falls under the EU Act's restricted categories.
- 2EU AI Act Explorer (Future of Life Institute)Reference
A searchable, plain-English breakdown of every article, recital, and annex in the EU AI Act.
Why we like it. When you need to check whether a social media monitoring or ALPR-style tool counts as high-risk, this is faster than reading the official text cold.
- 3GDPR Enforcement Tracker (CMS Law)
Courts Are Doing What Legislation Has Not. That Should Make You Nervous.
By John Ferguson
This week's big story is a US lawsuit about government social media surveillance being allowed to proceed. On the surface, that is a US civil liberties story. But I keep coming back to what it tells us about the state of AI accountability globally: we are still largely relying on courts to draw lines that legislators have not.
The EU AI Act is the exception. It actually draws those lines in advance. Surveillance tools used to monitor viewpoints, social media behaviour, or physical movement are not a grey area under the Act. They are classified, restricted, or outright prohibited. That specificity is uncomfortable to work with, but it is vastly preferable to finding out where the line is in a courtroom three years from now.
What I notice in conversations with operators this week is that most people think of the AI Act as a burden. I think that framing is wrong. The US organisations dealing with this lawsuit, or with California's ALPR data breach fallout, would probably prefer to have had a clear legal framework to point to. Ambiguity is not freedom. It is just deferred liability.
My practical note for this week: if you use any tool that monitors individuals, whether that is customers, employees, or the public, this is the moment to get in writing exactly what it collects, who it shares data with, and whether it makes any automated inferences. Not because a regulator is knocking on your door today. Because the courts are starting to, elsewhere.
John Ferguson · Founder, Agentic Fluxus
Short answer.It depends on whether the tool links mentions to identified natural persons and whether it infers characteristics about them. If it is building profiles on individuals rather than just aggregating keyword volume, you are likely in AI Act territory for transparency and possibly high-risk classification. Ask your vendor for a data processing record and check whether the system makes any automated decisions or recommendations based on individual profiles.
Does your organisation have a written policy covering what AI-powered monitoring tools are permitted to collect about individuals?
Marin County Sheriff's Office shared automated licence plate reader data from Flock Safety with out-of-state and federal agencies, directly violating California law. EFF and the ACLU of Northern California are demanding answers, noting the breach puts every driver in the county at risk.
A federal judge issued a preliminary injunction blocking Utah's SB 73, a law that would have effectively required VPN providers to make their privacy protections technically impossible to maintain. The court agreed with EFF that the law demands something that cannot exist.