Consumer protection Archives | Digital Watch Observatory

Meta avoids social media addiction trial as wider litigation continues

Meta has avoided a scheduled social media addiction trial after the teenage plaintiff withdrew his claims less than a week before proceedings were due to begin, although broader litigation against major technology platforms over alleged harms to young users continues.

The case was brought by a 15-year-old Florida plaintiff identified as R.K.C. and was expected to become the second bellwether trial examining claims that major social media platforms used allegedly addictive design features that harmed teenagers.

TikTok, Snap and YouTube had already settled the plaintiff’s claims for undisclosed amounts, while his lawyers said he decided to withdraw the remaining case against Meta after weighing the overall outcome of the litigation and the burden of a lengthy trial.

Meta did not reach a settlement. Company spokesperson Andy Stone described the claims as baseless and said Meta would continue defending itself against similar lawsuits.

Litigation against major social media companies continues on several fronts. In an earlier bellwether case, a jury found Meta and Google’s YouTube negligent and awarded one plaintiff a total of US$6 million in compensatory and punitive damages.

In New Mexico, Meta was ordered to pay US$375 million, while further proceedings seeking structural changes to the company’s business practices remain pending.

Seven additional bellwether cases are scheduled in California state court, alongside separate federal litigation in Oakland and lawsuits brought by state attorneys general alleging that Meta misled the public about harmful and allegedly addictive platform features.

Why does it matter?

Although this individual case will not proceed to trial, it forms part of a much wider wave of litigation examining whether social media platforms can be held legally responsible for allegedly addictive design features and their effects on young users. Courts across the United States are increasingly being asked to assess where platform responsibility begins and how companies should balance user engagement with safety.

The remaining bellwether cases could influence future litigation and regulatory debates on child safety, platform accountability and product design. Their outcomes may also shape how courts evaluate claims involving algorithmic recommendation systems and other features designed to maximise user engagement.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

South Korea fines TikTok and Apple over privacy violations

South Korea has fined TikTok and Apple more than US$7.7 million for violating the country’s personal data protection rules, with regulators citing unlawful data collection practices, insufficient transparency and improper overseas data transfers.

The Personal Information Protection Commission (PIPC) imposed a US$7.6 million fine on TikTok after finding that the platform collected behavioural data from around 9.45 million South Korean users through tracking technologies embedded in third-party websites and mobile applications. According to the regulator, TikTok linked information such as browsing activity, purchases, clicks and device identifiers to user accounts for personalised advertising without adequately explaining how the data would be collected.

Investigators also found that TikTok failed to properly inform users about overseas transfers of personal data, including the categories of information being shared and the purposes of those transfers.

Two Apple affiliates were fined a combined US$185,000 after regulators found that Siri voice recordings and transcripts had been used to improve the service without an appropriate legal basis.

The commission also concluded that Apple transferred personal data to its headquarters in the United States without adequately informing users about the nature and purpose of those transfers. The penalty was reduced after Apple introduced stronger privacy controls, updated its policies and expanded user options for managing Siri transcripts during the investigation.

TikTok said it would review the regulator’s findings, while Apple said it would accept the decision.

Why does it matter?

The decision reflects increasing regulatory scrutiny of how global technology companies collect personal data for advertising and AI-powered services, particularly when that information is transferred across national borders. As privacy regulators strengthen enforcement, companies are expected to provide clearer explanations of how personal data is collected, processed and shared.

The case also reinforces the principle that multinational platforms must comply with domestic privacy rules regardless of where data is ultimately processed. Transparency, meaningful user consent and safeguards for international data transfers are becoming increasingly central to data governance frameworks around the world.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Substack adds AI detection for posts and comments

Substack has introduced an AI detection feature that allows users to estimate whether text was written by a person or with AI assistance.

Developed in partnership with Pangram, the tool can scan posts, notes, comments and replies longer than 100 words that were published on or after 21 July 2026.

Results are not displayed automatically. Users must select the ‘Scan for AI text’ option to receive an estimate of how much of the content is likely to be human-written or AI-assisted.

The feature is available on the web and iOS, with Android support expected later.

Creators can add a ‘How I make this’ statement explaining their writing process, scan drafts before publication and report results they believe are inaccurate.

They can also turn off detection on individual posts or notes, in which case readers will be told that an AI analysis is unavailable.

Substack said the aim is to improve transparency rather than discourage responsible AI use, arguing that problems arise when readers’ expectations about authorship do not align with how content is produced.

The company is also considering community preferences for AI content, recommendation controls and further measures targeting spam, bots and AI-enabled scams.

Why does it matter?

Substack’s move reflects growing pressure on publishing and social platforms to provide clearer information about AI-assisted authorship without treating every use of AI as deceptive. On-demand detection and voluntary process disclosures may help readers make more informed choices. However, estimates can still be disputed or disabled and cannot determine the quality, originality or level of human judgement behind a text. The effectiveness of the approach will therefore depend on how users interpret the results and how reliably the detector distinguishes substantial AI generation from limited editorial assistance.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!

Movement Labs files for Chapter 11 after MOVE token turmoil

MVMT Labs, the former developer of the Movement blockchain, has filed for Chapter 11 bankruptcy protection in the US Bankruptcy Court for the District of Delaware.

The company submitted a voluntary petition on 15 July under Subchapter V, a streamlined restructuring process available to qualifying small businesses.

Court records show that MVMT Labs reported less than $1 million in assets, between $1 million and $10 million in liabilities and between 200 and 999 creditors. Creditors have until 14 September to submit claims.

The filing follows prolonged controversy surrounding the launch of the MOVE token and a disputed market-making arrangement.

Binance said an authorised market maker sold approximately 66 million MOVE tokens shortly after the token was listed, with few corresponding buy orders. The exchange later removed the market maker and froze proceeds intended for user compensation.

Movement Labs and the Movement Network Foundation said they had not been aware of the market maker’s conduct and opened an investigation into the arrangement.

Coinbase subsequently suspended MOVE trading after concluding that the asset no longer met its listing standards.

The bankruptcy applies to MVMT Labs rather than Move Industries, which took over development and operations of the Movement ecosystem in late 2025 and says the network continues to operate.

The case remains open, with MVMT Labs seeking to restructure under court supervision.

Why does it matter?

The filing shows how controversial token distribution and market-making arrangements can create prolonged governance, reputational and financial risks for blockchain companies. It also highlights the distinction between a decentralised network and the corporate entities involved in developing it, as the bankruptcy concerns MVMT Labs while another company continues operating the Movement ecosystem.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!

European Commission publishes AI Act guidance on transparency labels

The European Commission has published guidance explaining how providers and deployers should comply with new AI transparency requirements under the EU AI Act, ahead of obligations taking effect on 2 August 2026.

The rules are intended to help people recognise when they are interacting with an AI system or viewing content generated or manipulated by AI. According to the European Commission, greater transparency should reduce the risks of deception and manipulation.

Providers must ensure that interactive AI systems, including chatbots, inform users that they are communicating with AI. They must also attach machine-readable markings to synthetic or AI-manipulated content so it can be detected.

Deployers face separate obligations. They must disclose the use of deepfakes, emotion-recognition systems and biometric categorisation tools, and identify AI-generated content on matters of public interest when it is published without human review or editorial oversight.

The guidance also clarifies key concepts, including interactive AI systems, synthetic content, deepfakes and AI-generated public-interest text. It further explains exemptions for routine editing tools such as spelling and grammar correction.

Organisations can demonstrate compliance by following the voluntary Code of Practice on Transparency of AI-generated Content, which has been recognised by the Commission and the European AI Board as a practical means of meeting the AI Act’s requirements.

Most transparency obligations and enforcement powers will apply from 2 August, while AI systems already on the market must meet marking and detection requirements by 2 December 2026.

The Commission is also providing an AI Act Service Desk and additional guidance to help organisations understand and implement the new requirements.

Why does it matter?

The guidance marks the beginning of one of the AI Act’s first operational transparency obligations. By requiring AI-generated and manipulated content to be identified, the EU aims to reduce the risks posed by deepfakes, synthetic media and undisclosed AI interactions while helping users make more informed decisions about the content they encounter.

The guidance also provides organisations with greater legal certainty ahead of enforcement. Clear definitions, recognised compliance mechanisms and practical implementation support should make it easier for providers and deployers to meet the AI Act’s transparency requirements consistently across the EU.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

OECD warns of risks from growing use of AI financial advice

The OECD has warned that the growing use of AI for financial advice could expose consumers to misleading information, biased recommendations and privacy risks, even as it makes financial guidance more accessible.

More than one-third of people across OECD countries used AI tools in 2025. Consumers are increasingly turning to AI for budgeting, debt management, investing, retirement planning and understanding financial products, with some also using it to ask sensitive financial questions they might hesitate to raise with a human adviser.

The OECD said AI can simplify complex financial documents, personalise financial education and help consumers compare products. However, AI systems may hallucinate, reproduce biases or generate commercially influenced recommendations without users fully recognising those limitations.

Conversational AI can also blur the distinction between general financial information and regulated professional advice. Consumers may act on recommendations that fail to reflect their financial circumstances, objectives or tolerance for risk.

The report stresses that AI cannot replace financial literacy. Consumers should question AI-generated answers, verify important information and carefully assess requests for personal or financial data. The OECD also urged policymakers to promote digital and financial literacy, maintain human oversight and ensure AI tools are grounded in reliable information, noting that people with limited digital skills or internet access may require additional support.

Why does it matter?

As AI becomes an increasingly common source of financial guidance, inaccurate, biased or commercially influenced recommendations could have direct consequences for consumers’ savings, debt, investments and long-term financial wellbeing. Unlike many other AI applications, errors in financial advice can translate into immediate economic harm.

The report also highlights the growing need for AI governance that combines transparency, human oversight and financial literacy. Ensuring that consumers understand both the capabilities and limitations of AI will become increasingly important as AI tools play a larger role in everyday financial decision-making.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

European Commission fines AliExpress €550 million for DSA breaches

The European Commission has fined AliExpress €550 million for breaching the Digital Services Act (DSA), concluding that the platform failed to adequately assess and mitigate the systemic risks associated with illegal, unsafe and counterfeit products sold through its marketplace.

The Commission found that AliExpress underestimated the risks posed by its services and failed to implement effective safeguards to protect consumers across the EU.

According to the Commission, AliExpress failed to adequately assess the effectiveness of its content moderation systems or allocate sufficient human resources to review illegal products.

Investigators also found that the platform’s recommender and advertising systems continued promoting illegal products before they were removed, while its risk assessments relied on insufficient quantitative evidence to measure the effectiveness of its mitigation measures.

The investigation also identified significant weaknesses in AliExpress’ risk mitigation measures. Counterfeit goods, unsafe toys and dangerous cosmetics remained available for extended periods, while traders repeatedly bypassed compliance checks through product miscategorisation.

The Commission further concluded that the platform failed to consistently sanction sellers of illegal products and that its brand authorisation system did not effectively prevent counterfeit listings.

AliExpress must submit an action plan by 20 October 2026 explaining how it will comply with the DSA.

The European Board for Digital Services will review the proposal before the Commission adopts a final implementation decision. Continued non-compliance could result in periodic penalty payments as the Commission monitors implementation.

Why does it matter?

The decision is one of the most significant enforcement actions taken under the Digital Services Act to date and demonstrates the European Commission’s willingness to impose substantial financial penalties on platforms that fail to manage systemic risks. It reinforces the DSA’s preventive approach, which requires very large online platforms to identify, assess and mitigate risks before harm occurs rather than relying solely on the removal of illegal content after the fact.

The case also signals that the Commission expects platforms to back their risk assessments with robust evidence, effective moderation systems and adequate human oversight. Future DSA enforcement is therefore likely to focus not only on the presence of illegal content but also on whether companies can demonstrate that their governance and risk management processes are working effectively.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Ofcom says age checks expand but more action needed

Ofcom has published its 2026 Use of Age Assurance Report, finding that age-assurance measures have expanded rapidly over the past year while calling for further action to strengthen online protections for children under the UK’s Online Safety Act.

The report examines the first six months after child protection duties took effect in July 2025, covering pornography, social media and online dating services. Ofcom said highly effective age assurance can significantly improve child safety, although no single method can completely prevent circumvention.

Ofcom said social media platforms have not consistently enforced their existing minimum age requirements and urged services relying on age inference to combine it with other highly effective methods. It also called on pornography services that have yet to introduce age checks to do so without delay, stressing that regulated services remain responsible for ensuring their age-assurance measures are effective.

The regulator also confirmed it will provide Parliament with an assessment by the end of October on how age checks for users over 16 could operate in practice, ahead of proposed social media restrictions expected in 2027.

Why does it matter?

The report provides one of the first comprehensive assessments of how age-assurance requirements are being implemented under the Online Safety Act. Its findings are likely to shape future enforcement priorities and inform policy discussions on additional age-based restrictions for social media services.

The report also suggests that age assurance is evolving into a broader ecosystem responsibility rather than a platform-only obligation. By highlighting the roles of search engines, app stores and device manufacturers alongside online services, Ofcom signals that effective child protection will increasingly depend on coordinated action across the digital ecosystem.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Ofcom finalises tougher rules against mobile messaging scams

Ofcom has finalised new rules requiring mobile providers to block, limit and disrupt mobile messaging scams, alongside strengthened guidance to tackle international calls that spoof UK mobile numbers.

The regulator said criminals increasingly use text messages and business messaging services to impersonate friends, companies and public bodies, pressuring victims to transfer money, disclose sensitive information or click malicious links.

Fraud accounted for an estimated 45% of reported crime incidents in England and Wales, with £1.28 billion lost to criminals in 2025. Ofcom also found that 40% of UK mobile users had received at least one suspicious message during the previous three months.

The measures target two main forms of messaging fraud: person-to-person messages sent through SIM cards and mass business messages distributed through commercial messaging infrastructure.

For person-to-person scams, mobile providers must collect intelligence on fraudulent messages, malicious links and phone numbers from customers and anti-fraud organisations. They must use that information to block numbers associated with scammers and stop messages containing malicious links or phone numbers from being delivered across their networks.

Providers must also impose volume limits on pay-as-you-go SIM cards, making it harder for criminal groups to send large numbers of fraudulent messages. The measures complement the government’s proposed ban on SIM farms and commitments made by operators under the Fraud Sector Charter.

Business messaging providers and aggregators must carry out initial and ongoing Know Your Customer (KYC) checks on organisations sending messages and monitor their activity through Know Your Traffic controls.

Providers will also verify alphanumeric sender IDs, which display company names instead of telephone numbers. The checks are intended to prevent scammers from impersonating trusted businesses, delivery services and government agencies.

Where providers identify fraudulent messaging activity, they must investigate its source, apply incident management procedures, and block malicious sender IDs, links and telephone numbers. Companies that fail to carry out appropriate checks may also face regulatory action.

Ofcom has separately strengthened its guidance on international calls that spoof UK mobile numbers. Telecoms companies should withhold the caller ID for calls that appear to originate from a UK mobile number roaming abroad unless they can verify that the number is genuine.

The regulator said spoofing makes overseas calls appear more trustworthy and increases the likelihood that potential victims will answer. However, it cautioned that legitimate organisations may also use withheld numbers, meaning users should continue to assess unexpected calls carefully.

Mobile providers already block more than 600 million suspected scam messages each year, but Ofcom said inconsistent protections across the sector continue to leave consumers exposed.

Consumers can report suspicious calls and messages by forwarding them to 7726, enabling mobile operators to update their fraud-detection and network-protection systems.

Why does it matter?

The new rules shift greater responsibility onto mobile providers to prevent scams before they reach consumers. By requiring stronger customer verification, sender authentication, network-level filtering and SIM controls, Ofcom is moving fraud prevention further upstream rather than relying primarily on users to recognise suspicious messages.

The measures also reflect a broader regulatory trend towards placing more accountability on communications providers to combat digital fraud. If successful, the framework could reduce large-scale messaging scams while serving as a model for other jurisdictions seeking to strengthen telecoms security.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

Spain promotes national cybersecurity support helpline

Spain’s National Cybersecurity Institute (INCIBE) has highlighted its free and confidential 017 helpline, which provides specialist advice on digital security issues for citizens, businesses, professionals and educational institutions.

The helpline provides guidance on scams, phishing, identity theft, compromised accounts, social media privacy, cyberbullying, device security and protecting personal information. It also advises on parental controls, online child safety, digital identity management and the safe use of apps and social media platforms.

INCIBE stressed that 017 is a cybersecurity advisory service rather than a reporting channel or technical support line. Specialists explain appropriate reporting procedures, direct users to the relevant authorities where necessary and assess each case individually.

The service is available daily from 8:00 to 23:00 via telephone, WhatsApp, Telegram, an online form and, by appointment, in person at INCIBE’s headquarters in León.

Why does it matter?

As cyber threats become more common, many users need trusted advice before or after an incident rather than only technical assistance or law enforcement support. Services such as INCIBE’s 017 helpline can help individuals and organisations respond more effectively while improving awareness of everyday cyber risks.

The initiative also reflects a broader shift towards strengthening national cyber resilience through public support services. By combining technical, legal and practical guidance in a single point of contact, governments can encourage earlier reporting, better cyber hygiene and more effective responses to digital security incidents.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!