Internet Freedom Weekly: News Recap, May 4–8, 2026
Effective control rarely admits what it is. This week, several governments dropped the pretense. Russia scheduled a mobile internet blackout in a dated press release. Utah passed a law targeting VPNs that every technologist explained cannot work. The EU watched its anti-SLAPP deadline expire with twenty member states doing nothing. Press Freedom Day arrived with RSF's worst global score in twenty-five years. Iran's blackout hit sixty-six days, with smugglers as the only infrastructure. And that's just some of it.
This recap covers fourteen articles published between May 4 and May 8, 2026.
Utah's Anti-VPN Law, Which Kicks In This Week, Might Break the Web for Everyone
Utah's Senate Bill 73 took effect May 6, making Utah the first US state to hold websites liable for visitors physically in Utah but using a VPN. The law also bans covered sites from explaining how VPNs work, which the EFF flagged as a likely First Amendment violation.
Websites cannot reliably determine a VPN user's true location, leaving three options: ban all known VPN IPs globally, age-verify every visitor worldwide, or accept legal exposure. It's a "solution" that solves nothing, and the damage falls hardest on journalists, abuse survivors, and privacy-reliant users.
Iran's Blackout Has Hit 66 Days and Smugglers Are the Last Line of Resistance
Iran's internet has sat at roughly two percent of normal levels since February 28, the longest state-imposed national blackout on record, with a clandestine network smuggling Starlink terminals across borders to compensate. Possession of a terminal carries up to two years under Iranian law.
At least one hundred people have been arrested, with authorities using signal-detection trucks to trace active terminals. Smugglers now advise recipients to pair with VPNs to reduce detection risk, knowing arrest is a matter of when, not if.
World Press Freedom Day 2026: Celebrating a Value That Is Losing Ground Fast
UNESCO's World Press Freedom Day conference ran May 4 and 5 in Lusaka, Zambia, co-located with RightsCon the following week. RSF's 2026 index hit its worst global score in twenty-five years, and CPJ counted a record 129 journalists killed in 2025.
The Lusaka convergence brought together press freedom, platform governance, and surveillance accountability practitioners at a moment when the numbers gave every session urgency. World Press Freedom Day has never been a celebration in the strict sense, but 2026 had fewer ambiguities than most.
New Mexico Pushes to Rewire Meta Platforms for Minors
Following the March 2026 jury verdict finding Meta liable for lying about child safety, New Mexico AG Raúl Torrez is asking a court to order Meta to overhaul its recommendation algorithms, eliminate infinite scroll for minors, and pay $3.7 billion in damages. Meta called the demands impossible and warned it may withdraw from the state.
A court order requiring a global platform to redesign its architecture for one state's users would be unprecedented, setting a template for every other active state AG suit. Meta's threat to exit rather than comply is its own confirmation of what is being asked.
Beaten Into Testifying: How Senegal Convicted Journalist René Capain Bassène
CPJ's new six-part podcast presents firsthand accounts from co-defendants who say they were beaten and electrocuted until they signed statements implicating René Capain Bassène in the 2018 Bayottes forest massacre. César Atoute Badiate, the rebel leader the prosecution claimed Bassène commanded, has publicly stated Bassène was never a member of his movement and gave no orders.
Senegal's Supreme Court upheld the life sentence in 2025 despite CPJ's prior investigation documenting altered transcripts and disputed evidence. Bassène has been imprisoned since January 2018, and CPJ is calling on President Faye for a pardon by May 27, 2026.
Motorola Weaponized Indian Defamation Law Against Platforms, and Speech Will Pay the Price
Motorola India filed a lawsuit in a Bengaluru court naming Google, Meta, X, YouTube, Instagram, Facebook, and Threads as co-defendants alongside individual creators over more than 360 posts claiming its devices are unsafe. Rather than filing standard takedown requests, Motorola made platforms directly legally liable, which digital rights experts say will push them to remove content preemptively rather than risk litigation.
A "John Doe" provision extends the chilling effect to unidentified future creators, signaling legal exposure before anyone has posted anything. An Indian court sided with Motorola in April, with videos already unavailable in India, and the June hearing will not change the fact that the template has already been proven to work.
US Revokes Visas for Five La Nación Directors Over Their Editorial Line
Five of seven board members at La Nación, one of Costa Rica's leading independent newspapers, had US tourist visas revoked with no explanation from the State Department. The paper attributed the revocations to its editorial stance against President Chaves, days after Secretary Rubio praised Chaves at a joint press event.
The move extends the Trump administration's pattern of using visa revocations to punish speech, this time reaching an entire foreign editorial board with no legal basis stated. CPJ's request for comment went unanswered.
UK Age Verification Is Being Outsmarted by Eyebrow Pencils and Fake Birthdays
A new Internet Matters report found that thirty-two percent of UK children bypassed age checks in the past two months using fake birthdays, borrowed logins, and drawn facial hair that fooled estimation tools, with one twelve-year-old verified as fifteen. Only seven percent used a VPN.
The government's response has focused almost entirely on VPNs, with the House of Lords voting to ban VPN provision to under-18s and the Commons substituting a broad ministerial power to restrict children's VPN use. The seven percent figure was available to every peer and MP before the vote.
Nineteen Organizations Tell UK Policymakers to Fix Big Tech, Not Users
The EFF and eighteen other organizations published a joint statement on May 5 warning that the UK's age verification direction will erode privacy for all users without addressing what drives online harm. The scope under consultation includes social media, video games, VPNs, and static websites, with all users required to verify age.
The coalition's argument is that harm originates in platform business models built on data extraction, and that existing laws provide tools to hold platforms accountable. Estonia made the same argument to the EU. The political willingness to act has yet to materialize on either side of the Channel.
Russia Plans to Kill 92% of VPN Access by 2030, With Billions Already Allocated
Roskomnadzor has set a formal target of ninety-two percent of VPN apps blocked by 2030, backed by roughly twenty billion rubles per year in the federal budget. Since April 15, more than twenty major platforms, including Gosuslugi, Sberbank, and all Yandex services, must block VPN-enabled users or lose government accreditation.
A foreign traffic tax and a ban on Russian hosting providers supplying capacity to VPN services are both pending. Over four hundred services have been banned, and VPN use is now recognized as an aggravating circumstance in Russian criminal proceedings.
MFRR Partners Warn Georgia Is Dismantling Its Press, One Law at a Time
On World Press Freedom Day, ARTICLE 19 and five MFRR partners called Georgia's press freedom collapse "one of the most rapid and serious" ever seen in an EU candidate country. RSF ranks Georgia 135th, down from 77th in 2022, and journalist Mzia Amaglobeli has been imprisoned for fifteen months, with parole denied on grounds that she "does not repent," a standard Georgian law does not contain.
Georgia's 2026 legislative package introduced criminal sanctions for working with international donors and an "extremism" provision carrying up to three years for "systematically" questioning government legitimacy. MFRR partners are calling for targeted EU sanctions, and with Hungary's new government removing the previous veto, that path is now open.
Four Years After the Spying, Barcelona Reopened the Òmnium Pegasus Case
Barcelona's Provincial Court Fifth Section reversed a February 2026 dismissal and ordered reinstatement of the Pegasus surveillance investigation involving three Òmnium Cultural members. The court found indications of unauthorized intervention on their devices and noted expert evidence does not clear Spain's National Intelligence Centre as a potential author, ordering CNI document declassification and a rogatory commission to Israel for NSO Group records.
And yet Irídia documented in March 2026 that Spanish courts repeatedly failed to execute European Investigation Orders to Luxembourg, with Luxembourg closing them after up to six unanswered requests. A court ordering declassification from a government practiced at ignoring such requests is a request, not a compulsion.
Moscow Goes Dark for Victory Day and Russia Isn't Even Hiding It Anymore
Russia's Digital Development Ministry announced on May 7 that mobile internet in Moscow will be restricted on May 9, covering general mobile access, whitelisted sites, and SMS, issued as a scheduled press release. A May 5 outage had already hit Moscow and St. Petersburg, with roughly half of Russia's regions warning of cuts ahead.
Kremlin spokesman Peskov confirmed no plans to compensate businesses, calling support measures "not under consideration." Paper map sales rose fifty-five percent year over year as residents adapted. The country that schedules blackouts in press releases is building a system to block ninety-two percent of VPN access by 2030, and these are not separate projects.
Most EU Countries Missed a Deadline to Stop Lawsuits That Silence Journalists
May 7, 2026 was the deadline for EU member states to transpose the Anti-SLAPP Directive, giving journalists and civil society access to early dismissal and cost-shifting provisions against abusive litigation. Only six of twenty-six applicable states made it: France, Latvia, Lithuania, Malta, Slovenia, and Sweden, while Hungary has taken no action.
Without transposition, targets in non-compliant states fall back on national law with nothing purpose-built for SLAPP defense. Article 19 documented the cost: journalists who stopped publishing, activists who withdrew, NGOs that folded under litigation costs. The Commission can now open infringement proceedings, and whether it does is the test.
Be part of the resistance, quietly.
Get Mysterium VPN
Dominykas is a technical writer with a mission to bring you information that will help you in keeping your digital privacy and security protected at all times. If there's knowledge that can help keep you safe online, Dominykas will be there to cover it.
Related Articles
.png)
.png){kind=small}
