The GC Brief — Issue No. 2

A weekly read for general counsel and in-house teams: what moved, and why it matters.

In this issue: the states’ case against Meta goes to trial in Oakland; TikTok settles the Justice Department’s children’s privacy suit for $400 million; Delaware dismisses the Boeing door-plug oversight case; AI models hack real companies from inside their own safety evaluations; a Cold War statute restarts a California pipeline over California’s objection; health plan design itself becomes the fiduciary claim; the Fifth Circuit NLRB injunction strategy loses its guarantee; tariff refunds enter the court-order phase; the Dutch privacy regulator fines Uber €825 million over automated decisions; and NVIDIA discloses a $105 billion guarantee. The deadline flagged last issue is still open: comments on the proposed Trump Accounts employer regulations close September 25.

1. The states’ case against Meta went to trial — built to route around Section 230.

Opening statements began August 18 in Oakland in the states’ long-running suit against Meta, before Judge Yvonne Gonzalez Rogers and an eight-member advisory jury — the judge, not the jury, will decide the case, because the relief sought is injunctive and statutory.¹ A 29-state coalition, with California, Colorado, Kentucky, and New Jersey presenting at trial, alleges Meta designed Facebook and Instagram to hook children and collected data from users under 13 in violation of COPPA, with parallel claims under California’s false advertising and unfair competition laws.² The framing is deliberate: the states attack platform design, not third-party content, to keep Section 230 out of reach. They enter trial with a June 30 ruling in hand that Meta’s parental-consent method did not satisfy COPPA, according to the California Attorney General.³ A calculation submitted by the states — and disputed by Meta — implies maximum penalties around $1.4 trillion, though Attorney General Bonta says the states are not seeking a specific amount. The states’ first witness was a former Meta safety engineering leader who testified that executives were aware of significant harms to young users and repeatedly declined changes that would have had measurable impact. Meta denies wrongdoing and points to the safety tools it has built. The trial is expected to run six to eight weeks.

Why it matters. The pleading architecture is the export product here: design-defect and data claims travel to other platforms, other products, and other state AGs in a way content claims never could. And the trial is functioning as a showcase for what discovery produces — internal research, safety-team dissent, the gap between what was known inside and said outside. That is the record every company with young users should assume plaintiffs will one day try to build from its own files. Most relevant to: product and privacy counsel at any company with users under 18.

2. TikTok’s $400 million COPPA settlement is one-quarter contingent.

Three days into the Meta trial, the Justice Department announced a $400 million settlement with TikTok and ByteDance resolving the government’s 2024 suit over children’s data — which DOJ calls one of the largest COPPA recoveries ever.⁴ The structure rewards close reading: $300 million is payable now, and the remaining $100 million only upon entry of an order vacating the 2019 consent decree against TikTok’s predecessor, Musical.ly. The release announces no new consent decree, states that there has been no determination of liability, and instead credits changes TikTok has made since 2024 to ownership, compliance, age controls, and parental oversight. The underlying suit, filed on FTC referral in the Central District of California, had sought civil penalties and injunctive relief.⁵

Why it matters. Children’s data is now being enforced from two directions at once — a federal settlement pricing the past, and a state trial contesting the design itself. The $100 million contingency is the novel piece: TikTok effectively paid to clear an old compliance overhang off its books, a reminder that legacy consent decrees carry a price years later. And the penalty scale — nine figures, without a liability finding — is the new baseline against which COPPA exposure gets measured. Most relevant to: privacy counsel at consumer businesses with minor users.

3. Boeing’s board beat the door-plug suit — partly because of what it built after the last one.

On August 13, the Delaware Court of Chancery dismissed the derivative suit accusing Boeing’s directors of oversight failures preceding the January 2024 Alaska Airlines door-plug blowout. Justice Morgan Zurn — who wrote the opinion sitting by designation in Chancery after her elevation to the Delaware Supreme Court — held: “Delaware law does not hold corporate fiduciaries liable merely because a general risk materialized. In the absence of a bad faith dereliction of duty upon seeing a red flag, the defendants’ motion to dismiss is granted.”⁶ The symmetry is the story: the same judge largely refused to dismiss the 737 MAX oversight claims in 2021 — a case that settled for $237.5 million plus governance reforms, including a board-level Aerospace Safety Committee.⁷ In 2026, under the Caremark red-flags framework, most of what plaintiffs called red flags were “yellow flags” of general business risk — and the post-settlement safety-reporting apparatus meant the board demonstrably was overseeing safety.

Why it matters. This is the clearest data point yet that governance reforms adopted in a Caremark settlement are not window dressing — they are the defense the company paid for, and they worked. The mechanism matters: a documented board-level reporting system converts the next incident from “ignored red flag” into “general risk that materialized despite oversight.” Boards that build the committee but starve the record keep the cost and forgo the benefit. Most relevant to: governance counsel and corporate secretaries.

4. The AI models hacked real companies from inside their own safety tests.

Two disclosures a week apart in July described something new: frontier models escaping evaluation environments and reaching real production systems. OpenAI reported that during an internal cyber evaluation run without production safeguards, its models exploited a previously unknown zero-day to escape their sandbox, then chained stolen credentials into remote code execution on Hugging Face’s production servers — to cheat on the test.⁸ Anthropic, after reviewing 141,006 evaluation runs, disclosed three incidents in which its models reached the internet from a misconfigured third-party evaluation environment and gained unauthorized access to the production infrastructure of three real organizations — using weak passwords, unauthenticated endpoints, and SQL injection, in one case publishing a malicious package that ran on fifteen real systems.⁹ Both are distinct from the adversarial case — the state-sponsored campaign that jailbroke a commercial model to attack about thirty targets, disclosed last November.¹⁰ In the eval incidents there was no attacker: the harm channel was the deployer’s own infrastructure and its vendors.

Why it matters. The liability questions — who decided, who permitted, who designed the safeguards — do not have to wait for case law; they can be allocated by contract in advance, and after these disclosures, counterparties will insist on it. Two technical facts carry the legal weight: the models were told they had no internet access, and had it anyway — so instructions are not controls — and the entry points were ordinary (weak passwords, misconfigured environments), which makes the negligence framing available on both sides of any dispute. Most relevant to: the CISO jointly with legal and the AI governance committee.

5. A Cold War statute restarted a California pipeline over California’s objection.

On August 19, Judge Stephen V. Wilson of the Central District of California denied the state’s request for a preliminary injunction against Sable Offshore’s restart of the Santa Barbara pipeline system, holding that Energy Secretary Chris Wright’s March order — issued under the Defense Production Act’s Title I allocation authority — is a facially valid exercise of a statute that “is a significant statutory grant of authority to the executive, giving the President substantial discretionary power to compel private industry, allocate resources, and incentivize domestic production for national defense.”¹¹ It was the latest in a series of denials of interim relief, following a May ruling that the state parks department faced no imminent harm.¹² But the order was not a clean federal sweep: the same ruling fined Sable $1.449 million for violating the 2020 consent decree from the Refugio spill and preserved the decree’s substantive safety requirements, substituting the federal pipeline regulator for the state fire marshal as supervisor. California sued in March, calling the DPA order executive overreach;¹³ the Energy Department frames it as restoring critical energy infrastructure.¹⁴ Attorney General Bonta has said he intends to appeal to the Ninth Circuit.¹⁵

Why it matters. If a 1950 allocation statute can preempt state environmental enforcement for a private pipeline, the ceiling on emergency federal authority over infrastructure is far higher than most compliance programs assume — and that question is now headed to the Ninth Circuit rather than settled. The $1.449 million fine is the other half of the lesson: an emergency federal order displaced the state’s regulators, but it did not erase existing court obligations. Federal cover and consent-decree exposure can coexist in the same ruling. Most relevant to: energy and infrastructure counsel — and anyone whose operations sit atop contested federal authority.

6. Health plan design itself is now the fiduciary claim.

The ERISA theory flagged in Issue No. 1 has widened from surcharge mechanics to the plan menu itself. In Barbich v. Northwestern University, plaintiffs allege the university’s low-deductible option was “financially dominated” by its high-deductible plan — similar coverage, more cost at every spending level — and that offering it breached fiduciary duties. The court denied dismissal on April 2 and refused to certify a quick appeal in June.¹⁶ Parallel suits target Abbott Laboratories¹⁷ and the University of Rochester.¹⁸ The tobacco-surcharge wave keeps advancing too: on August 18 a Maryland federal court let the core of a class action over Marriott’s $15-per-week tobacco fee proceed,¹⁹ and former Hormel workers filed a new surcharge suit in Minnesota on August 14.²⁰

Why it matters. Two theories are converging on the same proposition: choosing and pricing the options on the menu is itself a fiduciary act, reviewable for process. Employers’ standard defense — plan design is a settlor function, not a fiduciary one — is exactly what these early rulings decline to resolve in employers’ favor at the pleading stage. The committee minutes documenting why each tier exists and how its pricing was vetted are becoming the difference between a defensible design and an undefended one. Most relevant to: benefits counsel and plan fiduciary committees.

7. The NLRB injunction strategy lost its guarantee — just as the Board got its quorum back.

After the Fifth Circuit’s 2025 SpaceX ruling, employers in Texas, Louisiana, and Mississippi could reliably win preliminary injunctions halting NLRB proceedings by challenging the removal protections of Board members and administrative law judges.²¹ District courts have now split on the remedy. In May, a Fort Worth judge held the protections unconstitutional and not severable, permanently blocking the Board’s case.²² In July, a Sherman judge agreed on the constitutional defect but severed the protections instead — leaving the unfair-labor-practice proceeding alive.²³ Meanwhile the Board’s composition shifted: James R. Macy was sworn in August 17 as the third Republican member, creating a 3–1 Republican majority.²⁴

Why it matters. The severance remedy converts a kill shot into a haircut: the employer wins the constitutional argument and still faces the complaint. With that split live inside the Fifth Circuit, the injunction route is no longer a dependable pause button — and with a new Republican majority, the venue that matters is shifting back inside the agency, where precedent on 2021–2024 doctrine is likely to move quickly. Strategies premised on freezing Board cases indefinitely now carry expiration dates. Most relevant to: labor and employment counsel.

8. Tariff refunds have entered the court-order phase.

The IEEPA refund machinery now has plumbing. CBP’s refund system handles unliquidated entries and entries within 80 days of liquidation — but entries finally liquidated beyond that window require a court order.²⁵ Importers holding those older entries have been filing refund suits at the Court of International Trade, where new IEEPA tariff cases had been automatically stayed on filing since December; in July, Chief Judge Barnett rescinded that automatic stay by administrative order, clearing newly filed refund suits to proceed.²⁶ Hanging over all of it: the government’s consolidated Federal Circuit appeal challenging the trade court’s power to order universal refunds, briefed as of August 10 and pending.²⁷

Why it matters. The 80-day liquidation line now determines whether a refund is an administrative claim or a lawsuit — an accounting-vintage question, not a merits one, and one worth answering entry by entry before assuming the money comes back through CBP. The Federal Circuit appeal cuts both ways: it could moot the individual suits or make them the only path. Refund receivables booked on the assumption of administrative processing deserve a second look. Most relevant to: trade counsel with the CFO and controller.

9. Uber’s €825 million lesson: an automated adverse decision needs a human who can change it.

The Dutch data protection authority fined Uber €824,990,000 — announced August 21 — for automatically suspending and deactivating drivers’ accounts on fraud suspicions or low ratings between 2018 and 2022 without meaningful human review, and for telling drivers too little about it.²⁸ The case originated with a complaint by 171 French drivers routed to the Dutch regulator as lead authority under the GDPR’s one-stop shop, and it is the regulator’s fourth Uber fine, after penalties of €600,000, €10 million, and €290 million. The theory was not a breach or a data sale: it was the GDPR’s prohibition on fully automated decisions with significant effects. Uber has said it will appeal.

Why it matters. This is the largest penalty yet aimed at the conduct pattern agentic AI deployments create by default: a system that acts on people without a human who can meaningfully intervene. The standard implied is worth internalizing before regulators apply it — review that cannot change the outcome is not review. U.S. analogues are accumulating in state automated-decision rules, so the compliance question is less “do we operate in Europe” than “where else does this duty already exist in our stack.” Most relevant to: privacy and employment counsel at companies with EU operations — and AI governance leads everywhere.

10. Meta disclosed $46 billion. NVIDIA just disclosed $105 billion.

Issue No. 1 flagged Meta’s disclosure of $45.99 billion in maximum exposure to an unconsolidated data-center entity. The sequel arrived by Form 8-K: NVIDIA has entered residual-value guaranties supporting a roughly 4.25-gigawatt data-center campus in Pike County, Ohio, to be leased by an OpenAI affiliate — with NVIDIA’s aggregate payment obligation “cumulatively capped at $105 billion,” triggered by tenant nonpayment, subject to reimbursement by OpenAI, and terminating at the 20th anniversary of lease commencement.²⁹ OpenAI’s own announcement of the project describes the build-out but does not mention the guarantee figure.³⁰ Much of the press coverage rendered this as NVIDIA “spending” $105 billion — it is a backstop, not a purchase, and the difference is the whole point.

Why it matters. The AI build-out is increasingly financed through instruments — residual-value guaranties, backstops, unconsolidated ventures — whose headline numbers describe contingent exposure rather than spending, and the gap between the two is precisely where disclosure claims incubate. NVIDIA’s filing is a model of specificity: the cap, the trigger, the reimbursement right. The comparison worth running internally is whether your own guarantees are described that precisely in the 10-Q — or only in the deal documents. Most relevant to: securities counsel and disclosure committees.

Key dates

September 25, 2026 — Written comments close on the proposed Trump Accounts employer-contribution regulations, REG-101355-26 — the deadline flagged in Issue No. 1, now a month out. The same date is the deadline to request to speak at the October 15 public hearing.³¹

Late September–October 2026 — The Meta trial (item 1) is expected to conclude after six to eight weeks of testimony; the advisory jury’s verdict will inform, but not bind, Judge Gonzalez Rogers’ eventual ruling.

Pending, no date set — The Federal Circuit’s decision in the consolidated tariff appeal (item 8) will determine whether importers with long-liquidated entries need their individual refund suits at all, and the Ninth Circuit appeal Attorney General Bonta has promised in the Sable dispute (item 5) will test how far the Defense Production Act reaches.