New Mexico Attorney General Raúl Torrez won a historic sum of $375 million in a landmark child safety case against Meta earlier this year. But the next stage of the fight could be even more consequential for Meta and the social media industry at large.

Beginning Monday, attorneys for Meta and New Mexico will return to a Santa Fe courthouse for a three-week public nuisance trial, where they’ll argue over the changes the AG wants the judge to order Meta make to Facebook, Instagram, and WhatsApp. Those changes include adding age verification for New Mexico users, prohibiting end-to-end encryption for users under 18 and capping their use to 90 hours per month, limiting engagement-boosting features like infinite scroll and autoplay, and requiring Meta to detect 99 percent of new child sexual abuse material (CSAM).

“From the outset, our goal was to try and change the way the company’s doing business,” Torrez told The Verge on a recent visit to Washington, DC, to advocate for new kids safety legislation. “I recognize that even at $375 million for a company this big and this profitable, it’s not enough in and of itself to change the way they’re doing business. In fact, there’s probably some folks in that company who think of it as the cost of doing business.”

While any changes ordered by the judge would only apply to Meta and its operations in New Mexico, the company could apply the changes in other states for the sake of simplicity. Or, as it’s threatened to do, it could simply go dark in the state. A court order could send a message to other tech companies that courts may be willing to alter their businesses if they’re found liable.

During the trial, New Mexico will argue Meta has become a public nuisance by creating a public health hazard in the state. The AG’s office expects to call on about 15 witnesses, including experts who will testify to the feasibility of their proposed remedies, and fact witnesses who will testify about Meta’s alleged harms. After Meta makes its defense, Judge Bryan Biedscheid will evaluate which proposals are relevant and feasible — a process that could take some time, compared to the speedy turnaround of the jury verdict in March. 

A sweeping win for New Mexico could energize Torrez and thousands of other plaintiffs currently pursuing cases against tech companies. Conversely, a limited order could be a significant blow. The outcome won’t directly impact other cases, but it will almost certainly color negotiations over potential settlements.

Several of Torrez’s requests are hot-button tech policy issues. Age verification would almost certainly require Meta or a third-party provider to collect more personal information on adults and minors alike, which privacy advocates have consistently warned can make users less safe. Don McGowan, who previously served on the board of the National Center for Missing and Exploited Children (NCMEC), said that barring encrypted communications on platforms like Facebook “is a great way to make sure that nobody uses Facebook Messenger anymore and just moves their activity to other platforms that aren’t touched by this lawsuit.”

The mandate may do little to change the reality of certain parts of the business — Meta recently announced it was getting rid of end-to-end encrypted messaging on Instagram that it said “very few people” actually used.

Peter Chapman, associate director of the Knight-Georgetown Institute, which works to connect policymakers and others with independent tech policy research, said there could be “significant tradeoffs” to a prohibition on encryption, and other changes may be more effective. For example, evidence presented by the state showed that Meta’s own profile recommendations were connecting adults and minors, a feature that poses a clearer danger of harm without much benefit, and which Torrez is also asking the court to stop. “There’s an opportunity to intervene at that level and try to prevent more of these harmful interactions from taking place without having to tackle encryption,” said Chapman.

No single feature change is likely to solve the entire child and teen safety problem, said Chapman, which is why it’s notable that Torrez plans to ask for several layers of changes. Still, the overall effectiveness of any given remedy will also depend on how it’s implemented and monitored. For instance, what would be the methodology Meta uses to report a 99 percent detection rate of new CSAM? How does it count or surmise what it hasn’t caught? The same goes for the accuracy and reliability of any mandated age verification.

Meta points to this potential issue in its argument against Torrez’s proposed remedies. “Regardless of where the accuracy threshold is set, Meta would never be able to prove that the system met that standard, because doing the calculation would require that Meta detect 100% of CSAM to use as the denominator,” the company wrote in a legal filing. Torrez’s chief deputy, James Grayson, said on a press call that the court and an appointed independent monitor would have some discretion over tracking; the office hasn’t yet identified who this monitor would be.

Meta and other groups that oppose the AG’s approach say the outcomes he’s seeking are counterproductive. “The demands that are being made in New Mexico are ill-informed and provide massive additional exposure for other kinds of exploitation,” said Maureen Flatley, president of Stop Child Predators, a group that advocates for more funding for enforcement of criminal laws against child predators, and has received funding from Meta-backed trade group NetChoice. “This notion that the platforms have to be responsible for pushing all these people out would be like saying to the US Bankers Association, ‘By the way, you are responsible for all the bank robberies from now on,’ which is ludicrous.”

“The New Mexico Attorney General’s focus on a single platform is a misguided strategy that ignores the hundreds of other apps teens use daily,” Meta spokesperson Chris Sgro said in a statement. “The state’s proposed mandates infringe on parental rights and stifle free expression for all New Mexicans. Regardless, we remain committed to providing safe, age-appropriate experiences and have already launched many of the protections the state seeks, including 13 safety measures this past year.”

But Torrez has taken aim at the broader tech industry, too. He recently visited Washington, DC, to advocate for new protections for kids online and an overhaul of Section 230, the law that protects tech platforms from being held liable for their users’ posts. “While we were able to prevail in our district court in Santa Fe, I still think the law as it currently exists creates a lot of ambiguity,” he told The Verge on that visit. “If Section 230 were not something that these companies could hide behind, then it increases the chances that they’re going to have to actually make their case to a jury.”

But Chapman said regulation through lawsuits isn’t an “uncommon sort of story” in the US. “Whether that’s tobacco, opioids, e-cigarettes, there is precedent for legal action moving a broader policy conversation.”

Congress is once again attempting to pass a national data privacy law. But while it would introduce new protections in some states, it would weaken privacy rights in others — and it’s missing several elements that privacy advocates deem necessary.

The SECURE Data Act is the product of a Republican data privacy working group led by Rep. John Joyce (R-PA), who introduced the bill alongside House Energy and Commerce Committee Chair Brett Guthrie (R-KY). The proposal would require companies to collect only the user data they really need to perform the tasks they promise, let users see what information websites have on them and request its deletion, and require explicit opt in for collecting sensitive data like location or sexual orientation.

The Federal Trade Commission and state attorneys general would be able to bring legal action against companies accused of violating the law. A separate bill, the GUARD Financial Data Act, deals specifically with consumer financial data. 

This is the latest attempt in a years-long effort to pass federal privacy protections for digital consumers, after several prior iterations failed to get key congressional leaders on board. In 2024, a planned meeting to discuss the last major bipartisan privacy proposal was abruptly cancelled as the bill reportedly faced opposition from House Republican leadership. In a joint statement, Guthrie and Joyce said the working group aimed to “reset the discussion on comprehensive data privacy.”

The SECURE Data Act would provide some new protections for many Americans. Only about 20 states so far have comprehensive data privacy laws, and many of these have received poor grades from outside advocates.The SECURE Data Act would also create additional protections for data on teens aged 13 to 15, requiring parents’ consent to process their information.

But the bill does not let individuals sue over alleged privacy violations. It doesn’t require sites to recognize universal opt-out mechanisms, so users would need to proactively and continually limit collection. It also exempts pseudonymous data from certain protections, which some groups warn would create a loophole for targeted ads.

Moreover, the bill seeks to preempt state laws that already offer equal or stronger protections — like California’s, which created a new privacy agency and lets consumers take legal action against companies for certain data breaches, or Maryland’s, which bans the sale of sensitive data and serving targeted ads to teens under 18. The Future of Privacy Forum (FPF), whose members include tech platforms but says its work is independent of individual stakeholders, writes that the bill “selects particular narrow approaches used by only a handful of states.”

FPF (which neither supports nor opposes the bill) says while the proposal goes beyond some of the narrowest state laws, it’s “consistently narrower and less prescriptive” than California’s privacy requirements. Some definitions in the bill are also more limited than in many state laws, the group writes, such as that for “biometric data,” which doesn’t include data from audio or video recordings. 

Oregon, Delaware, Maryland, and Minnesota let consumers request the identity of third-party recipients of their personal information, according to FPF, and in Minnesota and Connecticut, users can “contest certain adverse profiling decisions” — all of which would also likely be preempted.

The Electronic Privacy Information Center (EPIC), which closely watches privacy law, has opposed the plan. “This bill would wipe out a huge range of privacy, security, online safety, and civil rights laws without providing any meaningful protections for Americans,” EPIC deputy director and policy director Caitriona Fitzgerald says in a statement. “A weak federal standard is worse than no standard at all.” 

R.J. Cross, director of the Public Interest Research Group (PIRG) Our Online Life Program, calls it “basically a green light for the tech industry to keep collecting whatever data they want from you and doing whatever they want with it. Then it makes sure that no pesky state that may want to, you know, actually regulate what companies are doing can get in the way.” Eric Null, director of the Center for Democracy and Technology’s privacy and data project, warns it “would cement the harmful online data practices that Americans need and want a privacy law to fix, resulting in more data breaches, more intrusive data collection, more creepy advertising practices, and more business for data brokers.” (The group receives funding from several large tech platforms but says its supporters don’t have influence over its priorities.)

Conversely, business groups have lauded the law, including its preemption element. “The cost and complexity of tracking and complying with more than 20 state privacy laws are crippling small businesses, and some states’ radical data restrictions are jeopardizing the digital tools that power small business growth,” said Rob Retzlaff, executive director of the Connected Commerce Council, which advocates for small businesses but has also received funding from large tech platforms like Amazon and Google. Several major industry groups including the US Chamber of Commerce, the National Retail Federation, and NetChoice, voiced their support. “The bill would end a confusing patchwork that harms consumers and small businesses,” they said in a joint statement. 

Democrats have historically opposed broad preemption of state privacy laws and supported a private right of action, and none are currently on board with the measure. Its sponsors are hoping to recruit them later, after the plan has passed out of the committee on a party line vote, according to CNBC. FPF says that many things left out of the bill “are likely intended to create a margin for negotiations” at that point.

If the bill passes, FPF says that states would likely fight for their statutes to remain, arguing that their standards don’t directly “relate to” the federal standard and should stand alone. California’s privacy law, for example, “may be more difficult to fully preempt because it covers employee data, B2B data, and applicant data—categories the federal bill exempts,” FPF says.

With midterm elections looming, the bill faces a tricky path forward. On paper, a federal privacy law is a significant and necessary step — but many fear this bill won’t go the distance.

Several US federal agencies are taking up Anthropic’s new cybersecurity model to find vulnerabilities, but one is reportedly not getting in on the action: the nation’s central cybersecurity coordinator. 

On Tuesday, Axios reported that the Cybersecurity and Infrastructure Security Agency (CISA) didn’t have access to Mythos Preview, which Anthropic has touted as a powerful tool for finding and patching security vulnerabilities. Meanwhile, other agencies like Commerce Department and National Security Agency (NSA) are reportedly using the model, and President Donald Trump’s administration has been negotiating broader access, Axios wrote last week. In a blog post, Anthropic said it’s “been in ongoing discussions with US government officials about Claude Mythos Preview and its offensive and defensive cyber capabilities,” and an unnamed Anthropic official told Axios that CISA was among the agencies briefed. Anthropic declined to comment and CISA did not immediately respond to a request for comment. 

Combined with other actions to limit CISA’s workforce and funding, the report signals that CISA’s operations still haven’t been prioritized by the administration, possibly putting digital security at risk. The agency, which is part of the Department of Homeland Security, is meant to serve as the central coordinating body for cybersecurity information, helping state and local officials that run elections and public utilities stay apprised of vulnerabilities and respond to attacks when they occur. But the Trump administration and congressional Republicans have launched political attacks on it, particularly after it declared the 2020 election that President Donald Trump lost to Joe Biden the “most secure in American history.” Trump later fired the official who led that agency in his first administration.

Since returning to office last year, the Trump administration has made a series of decisions that further limit the agency’s remit. Like other federal agencies, CISA lost talent during the Department of Government Efficiency’s cost-cutting efforts, and some staff was also reassigned to work on immigration priorities under DHS. Its acting director told Congress that its resources to detect hacks were limited amid the current DHS shutdown, yet the Trump administration is seeking to trim hundreds of millions more from the agency’s budget.

CISA’s reported lack of access to Anthropic’s Mythos Preview raises further questions about why an agency tasked with protecting critical infrastructure from cyberattacks isn’t able to test a tool that’s found security issues “in every major operating system and web browser,” according to Anthropic. Anthropic is giving restricted access to the tool to give key institutions a “head start” on cyber defenses, Anthropic’s frontier red team cyber lead Newton Cheng told The Verge. But it seems that at least for now, CISA won’t be getting that opportunity.

Though Tim Cook is shedding his CEO title for the role of Apple’s executive chairman, it appears he’ll keep one of his most important duties: that of the company’s Trump whisperer.

“As executive chairman, Cook will assist with certain aspects of the company, including engaging with policymakers around the world,” Apple writes in a press release. Translation: he’s sticking around to deal with thorny political relationships — in particular the one with President Donald Trump.

Throughout his tenure, Cook has navigated Apple through tricky political terrain. He’s had to balance the company’s massive business interest in China with US policymakers’ concerns, and he’s worked to appease Trump for favorable regulatory decisions, without alienating too many Apple employees and customers in the process.

The task of wooing Trump has repeatedly placed Cook in embarrassing situations: Cook showed the president around a factory in Texas in 2019, where Trump wrongly boasted that because of his policies, Apple was building a new manufacturing plant in the US. Last year, he presented Trump with a symbolic gift of “Made in the USA” glass from Apple supplier Corning set in 24-karat gold.

Recently, Cook took criticism from Trump critics for attending a movie night at the White House, for a screening of the documentary Melania, the same day that Alex Pretti was killed by federal agents on the streets of Minneapolis during a protest against Immigration and Customs Enforcement. Cook later vaguely referred to the “events in Minneapolis,” and referenced a “good conversation with the president.”

For Apple, these moves have largely worked out. Cook’s maneuvering reportedly helped win an exclusion to Trump’s tariffs for the iPhone in the president’s first term, and smartphones dodged some new tariffs in his second term, too. Sure, Trump hasn’t always gotten Cook’s name right, but it hasn’t stopped the president from heaping on praise or inviting Cook to his inauguration.

Cook’s charms over policymakers have been less effective at times. Under the Biden administration, the Justice Department filed a massive anti-monopoly suit against Apple, which the Trump administration has so far kept going, accusing it of illegally dominating the smartphone markets. It also fought — and mostly won — an antitrust case against Epic Games, but was later excoriated by the judge who accused Apple of willfully violating a court order and wrested away key control over the App Store. And Apple hasn’t been spared entirely from the recent mess of tariffs, which could cost it as much as $1 billion in a single quarter.

As Apple’s senior vice president of hardware engineering John Ternus takes over as CEO, the company will need to overcome significant policy challenges, including global efforts to regulate AI, and a push for app stores to verify user ages. Lucky for Ternus, Cook will still be there to take on that job.