A quiet weekend in the trade press hid an unusually consequential set of filings. A German regional court decided that running an auction is not the same as running a warehouse. A trade association funded by litigation finance told a California court that the largest professional network in the world scans the browsers of its own members. Three streaming companies that between them carry most of the American football season opened a lobbying office. Two legislatures on opposite sides of the Atlantic moved privacy law in opposite directions. And six researchers put a number on what it costs a language model to be handed data with the names taken out.
Luis Rijo
The connective tissue is control. Who exercises it, who is answerable for it, and what it is worth when somebody tries to take it away.
Frankfurt decides that an ad auction is not neutral storage
The judgment came down on September 16, 2026, four days before most of the industry noticed it. The Frankfurt Regional Court, sitting as its 6th Civil Chamber in case 2-06 O 234/25, ruled against Meta Platforms Ireland Limited and in favour of Finflow GmbH, the Berlin company behind the financial education brand Finanzfluss, and its co-founder Thomas Kehl. Spirit Legal, a Leipzig firm, brought the case. The hearing was held on June 3, 2026; the pronouncement followed three and a half months later.
The underlying facts are grimly familiar to anyone who has reported a scam ad. Fraudsters built fake Facebook and Instagram accounts impersonating Finanzfluss and Kehl personally, using his photographs in paid advertisements that funnelled users into WhatsApp groups promoting fraudulent investments. The impersonating handles were not subtle variations. They included Finanzfluss, Finanz Fluss, finanzfluss54, finanzfluss488, Finanzfluss-A, finanzfluss3, Thomas Kehl, Thomas-Kell, kehl6930 and Thomas von Finanzfluss. Between July 29 and August 28, 2024, the plaintiffs logged roughly 256 separate violations.
The removal timings matter, because they formed the evidentiary spine of the case. A fake Thomas Kehl profile reported on May 30, 2025 was taken down twenty days later. A fake Finanz Fluss profile reported on June 5, 2025 came down after fourteen. A deepfake video advertisement ran from June 3 to June 15, 2025, reaching more than 5,000 users across thirteen days. The plaintiffs were not asking the court to imagine hypothetical harm. They were asking it to count days.
Meta's defence rested on its status as a hosting provider, which under Article 6 of the Digital Services Act shields an intermediary from liability for content it merely stores. The Frankfurt judges rejected it, and the reasoning is what makes the decision travel. They applied the Court of Justice of the European Union's analysis in Webgroup and Coyote, joined cases C-188/24 and C-190/24, and concluded that the operation of an advertising auction is itself an act of editorial control. The chamber wrote that merely by conducting such an auction according to criteria set by the defendant, the defendant exercises a control and decision-making function over the advertisements that is superior to that of the individual advertiser.
Read that sentence slowly, because every major advertising platform in the world satisfies it. Ranking by quality score, applying eligibility filters, deciding which of two bidders wins a given impression, determining who sees the winner: on the Frankfurt court's reading, each of those steps is a choice, and choices are not storage. The judgment extends the same logic to organic distribution, noting that Meta's feed algorithms steer the delivery of user content into other users' feeds according to rules Meta wrote.
Five orders followed. Meta must stop distributing third-party content that impersonates Finanzfluss or Kehl. It must stop distributing content using their likeness or identity. It must hand over URL-sorted data on the reach and the revenue generated by the fake content, which is the provision most likely to produce uncomfortable numbers. It was declared liable for the resulting harm, including the money users lost to the fraudulent investments. And it must pay 3,568.81 euros in pre-trial legal costs with interest running from July 26, 2026.
The headline figure is the enforcement mechanism rather than the damages: up to 250,000 euros for each future breach of the injunctions. Provisional enforceability requires security deposits between 10,000 and 100,000 euros depending on the claim.
Spirit Legal's assessment was that the ruling puts platform liability on a new footing, and that for the first time a German court has made clear that social networks such as Facebook are in principle directly and themselves liable for the unlawful content of their users. Kehl put it more bluntly on LinkedIn: anyone who decides by algorithm which advertisement is shown to whom, and earns money from it, is not neutral storage space but responsible.
Meta's rejected arguments are worth listing, because they are the arguments every platform makes. That it is neutral infrastructure. That detecting variations with the same meaning is technically impossible. That advertisers, not the platform, control targeting. That Finanzfluss is generic and descriptive and therefore weakly protected as a mark. None survived.
Scale supplies the context. The Finanzfluss YouTube channel has about 1.5 million subscribers, the Instagram account more than 600,000 followers, the Facebook page roughly 29,000. Kehl co-authored a book that reached number one on the Spiegel list and ran to twenty editions, and hosts the Marktgefluester podcast past its 149th episode. This is a recognisable brand with the resources to litigate for two years. Most impersonation victims are not.
On the other side of the ledger, Reuters reported in November 2025 that Meta had internally projected roughly 16 billion euros of revenue from scam and banned-goods advertising, about a tenth of its 2024 total. Meta says it removed 134 million scam advertisements during 2025 and banned 3.5 billion fake accounts in the same year, figures that appeared in a VAB analysis in July 2026. Both sets of numbers can be true at once, and the third order in the Frankfurt judgment is designed to find out which one describes the Finanzfluss case.
The ruling is not final. Meta may appeal to the Frankfurt Higher Regional Court, and the question of whether Webgroup and Coyote reaches algorithmic social feeds may eventually be referred to Luxembourg. If the reasoning survives, the hosting exemption narrows to services that order content chronologically and sell nothing against it, which in practice means a handful of federated networks. Google Ads, Amazon Ads, TikTok and Microsoft Advertising all run the kind of ranked auction the chamber described.
A trade association tells a California court that LinkedIn scans 6,236 browser extensions
Three days before the Frankfurt judgment, a complaint was signed in Santa Monica. Fairlinked e.V. and others versus LinkedIn Corporation, number 5:26-cv-10330, was filed in the United States District Court for the Northern District of California, San Jose Division, on September 14, 2026, and became public on September 17.
The plaintiffs are an unusual group. Fairlinked e.V. is a trade association claiming more than one hundred technology company and founder members across roughly fifteen countries. Jaxx Technologies, Inc. built Teamfluence, a browser product it stopped selling around November 2025. Vengreso, Inc. sells FlyMSG, a writing assistant and text-expansion extension. Mario Martinez is a California resident who bought Sales Navigator directly. J.R. Howell of the Law Office of J.R. Howell represents all of them, and also filed Ganan v. LinkedIn Corporation, case 5:26-cv-02968, in April 2026 over the same technical conduct framed as a privacy problem rather than a competition one.
The commercial grievance is narrow and specific. On February 1, 2025, LinkedIn moved embedded profiles and display integrations from the Advanced tier of Sales Navigator to Advanced Plus. Customers who had been using the feature were told that continuing would require an Advanced Plus subscription. Advanced Plus, according to the complaint, carries a minimum commitment of ten licences, a term that appeared in the published offering in April 2024. A three-person sales team that wanted to keep seeing LinkedIn profile data inside its CRM therefore had to buy ten seats.
Published pricing as of August 2026 sets Core at 119.99 dollars a month or 1,079.88 dollars a year per licence, and Advanced at 159.99 dollars a month or 1,799.88 dollars a year. Advanced Plus carries no public price at all; it requires a custom quote. For historical comparison, the Enterprise Edition launched on March 21, 2017 at 1,600 dollars per seat per year before volume discounts.
The more striking allegations concern enforcement. LinkedIn maintains a detection list that identifies browser extensions running on members' machines, and the complaint traces its growth: 38 scanned extensions in 2017, about 461 by 2024, roughly a thousand by May 2025, 5,459 in December 2025 and 6,167 by February 2026. Independent testing by BleepingComputer found a JavaScript routine checking for 6,236 extensions and collecting browser and device information alongside. Among the products on the list are Apollo, Seamless.AI, Evaboot, La Growth Machine, Artisan AI, HeyReach, Surfe, Kleo, Taplio, Lusha and ZoomInfo, which is a fair census of the sales intelligence category.
Vengreso describes the operational effect. Its engineers observed the detection code issuing thousands of requests to members' browsers and reported slowdowns while the probing ran. Each time the company reengineered its product, LinkedIn updated its detection. One prospective customer walked away from an 18,000 dollar annual contract because it feared enforcement. Jaxx had its account and developer status revoked and stopped selling Teamfluence altogether.
LinkedIn's position is not hidden. Section 8.2 of the user agreement prohibits software that overlays or otherwise modifies the services or their appearance, and published policy states that crawlers, bots, browser plug-ins and extensions that scrape, modify the appearance of or automate activity on the site are not permitted, with account restriction or closure as the stated consequence.
The partner route is equally constrained. The Sales Navigator Application Platform launched in February 2018 with more than two dozen partners; LinkedIn now states it is not currently accepting new partners for Sales Navigator API access. Integration users must hold active licences for both the partner application and Sales Navigator. Partners may not charge additional fees, directly or indirectly, for access to the integration data. Approval is required before development, before release and before any material modification, and the policy says plainly that LinkedIn does not promise any timeframe for such a response. The plaintiffs further allege that private API access was conditioned on a promise not to compete with LinkedIn using the supplied data. The self-serve alternative caps applications at 100,000 lifetime users and requires that the application not rely on the APIs as a fundamental aspect of the business.
Seven counts follow: monopoly maintenance in data access and CRM interoperability, attempted monopolisation of compatible prospecting and writing software, unlawful restraint through customer and partner agreements, tying, a Cartwright Act claim for California purchases, and two Unfair Competition Law claims. The plaintiffs want class certification, injunctions against the ten-licence minimum and the enforcement regime, and treble damages. The aggregate amount in controversy is stated as more than five million dollars.
LinkedIn reports more than a billion members. The complaint alleges it holds more than ninety percent of United States professional social networking users and revenue, counts over 1.5 million Sales Navigator sellers, and passed a billion dollars of annual Sales Solutions revenue by January 2022. The European Commission designated it a Digital Markets Act gatekeeper in September 2023. No response had been filed as of the docket date, and the company retains the usual options of an answer or a motion to dismiss.
Fairlinked has disclosed that it secured outside litigation financing without naming the funder, the amount or the terms, saying only that the case has the financial backing required for a sustained legal challenge and that LinkedIn should expect the claims to be pursued through discovery, motion practice and trial. One board member, Steven Morell, is chief executive of the Estonian company Teamfluence Signal Systems OU and sits on the Fairlinked board as a private individual, a connection the filing does not obscure.
Set the two cases side by side and the symmetry is hard to miss. In Frankfurt, a court held that a platform's control over what appears is precisely what strips it of the defence that it is merely a conduit. In San Jose, plaintiffs argue that a platform's control over what may touch its surface is precisely what constitutes the market being monopolised. Control is the asset in both filings. The dispute is only over which body of law gets to price it.
Netflix, Amazon and YouTube open a Washington office before the rules arrive
On September 14, 2026, the three largest streaming distributors of American live sport announced the Streaming Access and Choice Alliance, a Washington lobbying vehicle operated by TechNet, a technology trade group with 106 members. Mike Ward, TechNet's senior vice president of federal policy and government relations, runs it, and issued an identical line to every outlet that asked: Americans want more content choices and flexibility in how and where they watch their favourite programming, including sports and other live events.
The four-point agenda is written in the register of an organisation that would prefer not to be regulated. It asks for forward-looking, competition-focused policy, technology-neutral frameworks that let innovation drive access, conditions under which streaming platforms can keep investing in live sport, and an environment in which leagues remain free to choose their distribution partners. Translated, the last point is the load-bearing one.
Three pressures explain the timing. Senator Tammy Baldwin of Wisconsin has introduced legislation that would require free, single-location access to local teams' games, supported by her calculation that a Wisconsin fan needs to spend more than 1,500 dollars a year to watch every Packers, Brewers and Bucks fixture across the services that carry them. The House Judiciary Committee held hearings in June 2026 on the Sports Broadcasting Act of 1961, describing the statute that permits leagues to sell media rights collectively as a special-interest antitrust exemption gone awry. And the Federal Communications Commission's Media Bureau opened proceedings under MB Docket No. 26-45 on February 25, 2026 to examine sports broadcasting practices and the proliferation of subscription services, with comments due March 27 and replies by April 13.
The alliance's own overview offers a set of figures without attaching a source to any of them: that 99 percent of United States households hold at least one streaming subscription, that the average household holds three, that more than 90 percent have broadband, that 36 percent still subscribe to traditional pay television, that roughly 15 percent rely on digital antennas alone, and that sports content on major subscription services has grown 52 percent since January 2024. The absence of citations on the last figure is conspicuous, since it is the number doing the most rhetorical work.
Independent measurement of the same problem is less flattering. Gracenote research published on September 1, 2026 found that 26 percent of sports fans often cannot identify which channel carries a specific game, rising to 35.6 percent among 18 to 34 year olds, and that 68.3 percent of respondents pay for at least one subscription because of sport. Watching every NFL game last season required six television networks, three streaming services and YouTube Sunday Ticket.
The commercial stakes are visible in the advertising numbers. Nielsen's 2026 upfront guide put streaming at 66.7 percent of ad-supported television time among adults 18 to 49. YouTube accounted for 13.8 percent of all United States television viewing in July 2026 against cable's 20.4 percent. Amazon's advertising chief said in May that Prime Video and live sports now operate as one business, crediting the NFL partnership with 80 net new advertisers and the NBA deal with 30 in its first year, against a global ad-supported Prime Video audience averaging 315 million viewers in the fourth quarter of 2025. Thursday Night Football opened its 2026 season on Prime Video on September 17. Netflix's 2026 NFL slate takes in September 10, Thanksgiving Eve, two Christmas Day games and Week 18. YouTube streamed its first free global NFL game on September 5, 2025.
The membership list is as informative as the agenda. Disney, Paramount, Warner Bros. Discovery and Peacock all hold significant sports rights and none joined. Netflix belongs to the earlier Streaming Innovation Alliance, formed in 2023 with Disney, Paramount, Warner Bros. Discovery, Peacock, the Motion Picture Association and TelevisaUnivision; Amazon and YouTube do not. Fifteen niche services including Crunchyroll, Tubi and The Roku Channel formed their own group, Beyond Mainstream, on November 4, 2025, seeking proportionate treatment for smaller platforms. The sector now has at least three lobbying blocs with divergent interests.
Consolidation runs underneath all of it. The Paramount and Warner Bros. Discovery merger became formal on February 27, 2026, producing a combined Paramount+ and HBO Max subscriber base of roughly 200 million, cleared by the European Commission on July 22, 2026 subject to theatrical distribution conditions in nineteen countries. Fox Corporation agreed on June 15, 2026 to acquire Roku for about 22 billion dollars.
Abroad, the argument has already been settled in the other direction. The United Kingdom's listed events regime will pull streaming platforms that buy listed sports into its free-to-air coverage from January 2027, which is the precise opposite of technology-neutral distribution freedom. What SACA will actually do remains unstated: it has published no budget, no legislative agenda, no position on the Baldwin bill, and no indication of whether it intends to file in the FCC docket or testify.
Two parliaments move privacy law in opposite directions
Reform UK published a twenty-page document in August 2026 titled Contract with Small Business, signed by Nigel Farage, Richard Tice and Robert Jenrick. Its privacy plank proposes replacing the United Kingdom's retained GDPR with a principles-based framework modelled on the New Zealand Privacy Act 2020, abandoning what the document calls the GDPR-style requirement to fit every act of processing into one of a prescribed set of lawful bases in favour of thirteen broad privacy principles under which businesses may collect the personal information they need provided they collect it fairly and keep it secure.
The economic case rests on three citations. Research by Jian Jia and co-authors is invoked for the claim that GDPR reduced venture investment in European technology firms by 25 percent relative to American competitors. Work by Rebecca Janssen and colleagues is cited for the claim that the regulation halved the number of new European apps added to the Google Play Store. The Department for Business and Trade's 2024 Business Perceptions Survey supplies the finding that more than half of Britain's innovative small businesses struggle with compliance. The document sets those against a domestic picture of 5.7 million small and medium enterprises employing 16.9 million people, with fewer than one in five expecting growth over the following twelve months, a figure it describes as a record low.
The obvious exposure is adequacy. Reform UK acknowledges that the European Commission could challenge the United Kingdom's status, and argues pre-emptively that the Commission already recognises fifteen countries as adequate without GDPR-equivalent law. For advertisers and their vendors, the practical question is what happens to transatlantic and cross-Channel data flows in the interim, and the document is silent on implementation timelines. It is also silent on the separate ePrivacy regime that governs cookies and direct marketing, which is the instrument that actually constrains most marketing technology in Britain, and on territorial scope.
Canada is travelling the other way. Bill C-36, which would enact the Protecting Privacy and Consumer Data Act, received first reading on June 15, 2026 and returns to a Parliament that reconvenes on September 21. Section 114 sets maximum administrative penalties at the greater of 10 million Canadian dollars or 3 percent of an organisation's gross global revenue in the financial year preceding the penalty, which is a deliberate echo of the GDPR structure Reform UK proposes to discard.
The institutional change is larger than the fines. The bill would create a Digital Safety and Data Protection Commission of Canada in place of the Office of the Privacy Commissioner, with one member serving as Privacy and Consumer Data Commissioner and holding the power to issue binding penalty notices. The current office cannot do that, and the gap has been visible: on September 10, 2024 the Federal Court of Appeal ruled that Facebook had breached PIPEDA over third-party app data, and in May 2026 four Canadian privacy regulators concluded a joint investigation finding that ChatGPT's practices breached the same statute, without a penalty mechanism attached to either outcome.
The consent architecture keeps PIPEDA's foundation while adding exceptions for defined business activities where a reasonable expectation exists, a legitimate interest basis conditioned on documented privacy impact assessments, research and development with de-identification, fraud prevention, debt collection and public interest disclosures. Section 63(4) requires organisations to explain predictions or recommendations produced by automated systems, identifying the categories of personal information used, their sources and the principal factors driving the outcome, which reaches directly into algorithmic targeting and scoring. Section 57 requires a privacy impact assessment before any transfer of data outside Canada. And the bill introduces a private right of action, which PIPEDA lacks entirely.
The history counsels caution about all of it. PIPEDA came into force in 2001. Bill C-11 proposed comparable reform in 2020 and died. Bill C-27 proposed comparable reform in 2022 and died when Parliament was prorogued in January 2025. C-36 has completed first reading only, and needs second reading, committee, third reading, Senate passage, royal assent and implementing regulations before any of it binds anyone.
Six researchers measure what stripping the names costs
The fifth filing of the week was not a filing at all. On September 15, 2026, version two of arXiv submission 2609.11335was posted under the title On the Impact of Anonymization on the Performance of Large Language Models. The corresponding author is Tobias Deusser, working across the University of Bonn, Fraunhofer IAIS in Sankt Augustin and the Lamarr Institute; his co-authors are Max Hahnbuck, Lorenz Sparrenberg, Tobias Uelwer of Microsoft Germany in Cologne, Christian Bauckhage and Rafet Sifa. Funding came from the German Federal Ministry of Education and Research and from North Rhine-Westphalia through Lamarr.
The design is straightforward. Five models were run against eleven benchmarks twice, once on original inputs and once after an anonymisation tool replaced entities with placeholders. The models were GPT-4o mini, accessed on May 27, 2025, Teuken-7B, Llama-3.1-8B, Gemma-2-27B and Qwen2.5-72B. The benchmarks covered science, reasoning, emotional intelligence, commonsense, instruction following, medical knowledge, academic knowledge, multi-step reasoning, retrieval-augmented generation, truthfulness and English-to-German translation. The sample was 6,210 unique items drawn from 38,967 across 55 subtasks, most subtasks capped at 500 items and two at 1,000, with an average input length of 417.62 tokens. The anonymiser itself scored above 88 percent on F1 and above 91 percent on recall, missing roughly one entity in eleven.
Most benchmarks degraded mildly. Science, commonsense and instruction-following losses stayed under five percentage points. MMLU-PRO fell from 0.71 to 0.61 for Qwen2.5-72B and from 0.63 to 0.55 for GPT-4o mini. MedQA dropped from 0.94 to 0.87 for Gemma-2-27B. Multi-step reasoning barely moved: GPT-4o mini held 0.70 in both conditions. Averaged across everything, Qwen2.5-72B lost 6.9 percentage points and Teuken-7B lost 2.3.
Retrieval collapsed. On the RGB benchmark, which measures retrieval-augmented generation, GPT-4o mini fell from 0.80 to 0.32, a relative loss of 60 percent. Qwen2.5-72B went from 0.82 to 0.38, Llama-3.1-8B from 0.69 to 0.34, Teuken-7B from 0.53 to 0.31 and Gemma-2-27B from 0.63 to 0.39. The explanation is density: RGB inputs carried an average of 79.49 entity mentions, 35.26 of them unique, inside roughly a thousand tokens. When a passage is mostly named things and every named thing becomes a numbered placeholder, the passage stops being about anything.
Method choice changes the damage considerably. On RGB, pseudonymisation preserving a one-to-one mapping scored 0.34 and consistent random strings scored 0.37, against 0.26 for partial masking, 0.12 for redaction and 0.09 for generalisation to broad category labels. On MedQA the ordering nearly inverted: masking scored highest at 0.87, above the 0.83 achieved by both pseudonymisation and redaction. Reversibility, not severity, turns out to predict retrieval performance.
Telling the model what had been done did not help. Prefix warnings explaining that the prompt was anonymised and that context might be missing left MedQA at 0.82 against 0.80 without, MUSR at 0.70 against 0.71, and RGB at 0.29 against 0.32, which is to say slightly worse.
The failure cases are instructive. In a solar eclipse question, replacing Earth and Sun with two location placeholders flipped a correct answer to an incorrect one. In a question about Nobel laureates, the model that had answered United Kingdom fabricated a placeholder-shaped country name once Europe was masked. In a currency question, a model that had correctly deduced euro appreciation from 1.36 to 1.40 dollars reached the opposite conclusion when both values became monetary placeholders.
One benchmark improved. On TruthfulQA, four of five models scored better anonymised: Llama-3.1-8B rose from 0.70 to 0.78, Qwen2.5-72B from 0.69 to 0.74, Teuken-7B from 0.45 to 0.51 and Gemma-2-27B from 0.67 to 0.68, with GPT-4o mini alone slipping 0.02. Stripping the names appears to strip the associations that produce confident falsehoods along with them.
The authors' conclusion is narrower than the headline number suggests: anonymisation is not a one-size-fits-all solution and must be co-designed with the model and task in mind to balance privacy and utility effectively. Data minimisation as a legal principle settles that identifiers should be stripped; it says nothing about which stripping method to choose. For anyone assembling a retrieval system over customer records under a legitimate interest basis, section 63(4) of a Canadian bill or thirteen New Zealand-style principles, the paper supplies the missing variable. The regulatory debate in Westminster and Ottawa is about whether identifiers may be processed. This is a measurement of what happens to the machine when they are not.
Five documents, five jurisdictions, one recurring question. Frankfurt priced a platform's control over what it distributes. San Jose is being asked to price a platform's control over what may touch it. Washington acquired a lobbying budget to shape control before Congress defines it. Westminster and Ottawa are moving the boundary of control in opposite directions at the same time. And a German research institute measured what is lost when control is exercised properly. The Frankfurt number is 250,000 euros per breach. The Bonn number is sixty percent.
Also noted
- September 19 - Amazon set Prime Big Deal Days for October 6-7 across 22 countries, replacing the single midnight deal release with three daily drops at midnight, 8 a.m. and 1 p.m. PDT for six scheduled releases across the 48-hour window; the announcement landed six days after the seller submission window closed on September 8. PPC Land
- September 19 - An IPA and Brand Finance survey of roughly 200 US and UK analysts and investors, analysed by former City equities analyst Ian Whittaker, found 79 percent ranking brand top among factors assessing company positioning while 52 percent treated a reduction in marketing spend as a positive signal and 36 percent saw long-term damage in it. PPC Land
- September 18 - Google published a help document describing commerce audience sharing, which lets retailers and marketplaces share first-party segments with advertising partners running self-service campaigns, on condition that any campaign using a shared audience sends traffic only back to the commerce partner's own site. Search Engine Roundtable
- September 18 - Google extended its aggregator and supplier search units to local business queries, adding the phrase to both documentation pages and pointing developers to the Local Point of Interest Feed specification. Search Engine Roundtable
- September 18 - Converse apologised for two Chuck 70 X advertisements, one posted September 3 featuring aespa's Karina in a star-shaped spotlight and one released September 14 with Danish brand Palmes, saying it understood why the image was deeply upsetting, that it got this wrong, and that it was working to remove the creative everywhere it appeared. Adweek
Discussion