This Week in Internet Freedom — October 19th–23rd, 2026
Meta Ordered to Pay $25 Billion in New Mexico Privacy Case
A New Mexico court ordered Meta to pay $25 billion in penalties in a data privacy case stemming from the Cambridge Analytica scandal. A Santa Fe jury found in September that Meta misled state residents about how it safeguards and collects user data, with more than 43 million violations of the state's unfair practices act.
The filing showed the state was awarded $219.5 billion, reduced to $25 billion, with interest accruing at 15% a year until it's paid. Judge Francis Mathew wrote that "Facebook did not conduct the comprehensive investigation that it promised," calling its internal examination "willfully ineffective." The order is more than 30 times the $725 million Meta agreed to pay in 2022 to settle a class action over the same scandal. Meta hasn't commented on the order.
Meta's Updated Terms Would Let It Scrape Business Websites for AI Training
Meta's updated Terms of Service originally authorized the company to use web scrapers, bots, and crawlers to access and collect content from websites associated with businesses on its platforms, and to periodically pull updates for its training and research. After backlash from legal experts, Meta limited the clause to its ads and business products rather than general AI training.
A spokesperson said the change "does not give us new rights that supersede" robots.txt preferences, but the provisions letting Meta collect data from business websites for ad targeting remain. The only real opt-out is closing your Meta account, which isn't realistic for many small businesses. The consent is real in a legal sense and coerced in a practical one.
Critical PHP Flaws Took Sites Offline Worldwide
According to the BBC, cybersecurity agencies in the UK, EU, Australia, and the US urged organizations to apply a fix for two critical flaws in PHP, and to consider taking systems offline where they couldn't. Finland temporarily shut down its government's public web services, the Netherlands' cybersecurity agency took its own site offline, and the Wikimedia Foundation took down systems, leaving some users unable to reach parts of Wikipedia.
Researchers at Calif and Wiz found the flaws using OpenAI's models and say they'd gone undetected for more than a decade, and Cloudflare's CTO says early attacks are already emerging. The advice to operators was reasonable, but it protects servers rather than access. No agency is keeping a copy of the page you depend on, so save what you can't afford to lose and know your second source.
Australia Plans to Sue Five Platforms Over Under-16 Ban
According to Bloomberg, as reported by Reclaim The Net, Communications Minister Anika Wells said on October 20 that Australia is preparing to take Facebook, Instagram, TikTok, Snapchat, and YouTube to the Federal Court over compliance with the under-16 social media ban. No lawsuit has been filed. The eSafety Commissioner gained new powers to demand documents and summon people to give evidence on oath, and the maximum penalty now exceeds A$100 million.
Independent measures point to widespread non-compliance: a parent survey found around 7 in 10 children still have accounts, a University of Chicago working paper found about 73% of covered 14- and 15-year-olds still use banned platforms, and a BMJ study described "substantial circumvention." A High Court challenge by Reddit and the Digital Freedom Project is due to be heard in November.
A Policy Institute Published What We've Been Saying About Age Verification
Cato Institute policy scholars Jennifer Huddleston and David Inserra published "Online Age Verification Has Guaranteed Costs and Uncertain Benefits," identifying six costs that should be weighed against the claimed benefits: false positives with disparate impact on minority groups, compliance and opportunity costs, data breaches and privacy risks, restricted access to lawful information, loss of anonymous and pseudonymous speech, and a weakened role for parents.
Citing early evidence from Australia and the UK, they conclude the benefits are "at best, uncertain" and that restrictive policy-based approaches are "typically ineffective." We've made versions of this argument in nearly every age verification story we've covered. If you've been skeptical of a newsletter covering internet freedom making it, here are two policy scholars making it in a paper aimed at Washington.
French Presidential Candidate Calls for Social Media Blackouts
According to Politico, Gabriel Attal, leader of Emmanuel Macron's political party and a presidential hopeful, reiterated his call for the government to have power to temporarily block social media in the area where riots are taking place, after widespread unrest across France. He argued that young people who see friends looting on social media are encouraged to join.
French courts have already pushed back on similar measures: France's highest administrative court ruled that the 2024 TikTok block in New Caledonia was "a disproportionate infringement of rights and freedoms," and the Constitutional Council blocked a bill to ban social media for under-15s this summer on proportionality grounds. Whether Attal's proposal would survive judicial review is unclear. That a serious candidate in a Western European democracy is openly calling for protest-era social media shutdowns is the part worth noting.
India's Supreme Court Said Internet Access Is a Fundamental Right
A Supreme Court bench reaffirmed that internet access and use fall within the fundamental rights under Articles 21 and 19(1)(a) of India's Constitution, and that children, like adults, are entitled to them. The observations came during proceedings on removing child sexual abuse material from online platforms, and the court stressed that protecting children from online harm shouldn't come at the cost of denying them fundamental freedoms.
It stopped short of ruling that internet access is an independent fundamental right. They came a week after Delhi authorities suspended mobile internet in central Delhi and at eight temporary detention centres during protests that led to thousands of detentions, and after the government told the court the shutdown "was necessary." Constitutional recognition doesn't change an architecture where legal challenges arrive after a shutdown has already happened.
Internet Shutdowns With No End Are Rising, Say Experts
Access Now published a report on internet shutdowns with no announced end date, saying the number of prolonged shutdowns "has steadily risen each year." Its examples include Myanmar, where repeated shutdowns amid deadly violence have created an "internet dead zone," and Tigray, Ethiopia, where new shutdowns raise fears that a population cut off for over two years during a civil war will be disconnected again.
Even when authorities claim a shutdown has ended, connectivity often doesn't meaningfully return. The report draws on anonymized testimonies from 2024 to 2026 from places including Annobón, Gaza, Myanmar, and Sudan. It calls for stronger norms, alternative connectivity, attention to the digital side of ceasefires, and enforcement of court rulings against shutdowns.
An Officer Gave Her ICE Husband Access to the Flock System
Former Savannah Police Department officer Amber Harpe was fired after sharing her Flock Safety license plate reader login with her husband, an ICE agent who had no authorized access to the system. She was one of six employees fired following an audit, and four others were arrested by the Georgia Bureau of Investigation in August for using Flock for non-law-enforcement purposes.
Flock cameras record where your vehicle appears, when, and how often, and that data is queryable by any authorized user. The department's policy says an outside agency's investigative purpose doesn't authorize access, but the policy is enforced by an audit log, not by access controls. Data collected for one purpose by one agency can reach other hands through a shared password, and accountability only arrives after the fact.
Information Access Is Not Distributed Equally
Tomorrow, October 24th, is World Development Information Day. The same restriction costs different amounts depending on what else is available: where there's no offline alternative, a block isn't friction; it's the end of access. Shutdowns remove the only channel in places where services moved online faster than offline alternatives could keep up, from health information to agricultural guidance to remote schooling.
Filtering catches research, health, and educational material it wasn't aimed at, and identity walls exclude people without current documents. Policy gets written by people who always have a workaround, about people who often don't.
Be part of the resistance, quietly.
Gintarė is a cybersecurity writer at Mysterium VPN, where she explores online privacy, VPN technology, and the latest digital threats in editorial pieces. With hands-on experience researching and writing about data protection and digital freedom, Gintarė makes complex security topics accessible and actionable.
Related Articles
