Voiceprint and Facial Recognition Laws – Coming to a City Near You

The Settlement That Arrived Before the Statute On August 26, 2026, Meta agreed to pay up to $17.1 billion to settle claims brought by forty-seven state attorneys general, the District of Columbia, and U.S. territories alleging that its platforms harmed children. The consent judgment requires Meta to limit teen usage to two hours per day, restrict overnight access, and bar users under thirteen from Instagram and Facebook. It is the largest technology-sector settlement in American history. The settlement arrived while Congress was still debating whether to require age verification. The Kids Online Safety Act, first introduced in 2022, had been the subject of more than twenty-seven congressional hearings . The Senate passed it 91–3 in July 2024 . The House never voted. The bill died when the 118th Congress ended. It was reintroduced. Both chambers have now passed versions, but they differ on the bill’s most consequential provision, and reconciliation has stalled. Even if some version reaches the President’s desk, it will arrive years after the courts produced the accountability Congress spent four years debating. The courts did not wait for Congress. They did not need to. What Congress Couldn’t Do The legislative failure on social media was not accidental. It was structural. The tech industry deployed substantial lobbying resources to delay, weaken, or block the bill at every stage. The House version that eventually passed stripped the duty-of-care provision , which was the most consequential protection the bill offered. Senator Blackburn, one of the bill’s original sponsors, publicly opposed the weakened version . Meanwhile, the federal courts moved. In re Social Media Adolescent Addiction/Personal Injury Products Liability Litigation , MDL No. 3047, consolidated 3,137 lawsuits in the Northern District of California. In March 2026, a California jury found Meta and YouTube liable for negligent platform design, after the court rejected both Section 230 and First Amendment defenses. Five months later, the $17.1 billion settlement followed. A Los Angeles jury awarded $6 million to an individual plaintiff who developed severe anxiety and body dysmorphia from platform use. Four years of hearings produced no law. In the same period, the courts produced a jury verdict and the largest technology-sector settlement in American history. The Pattern Is Not New Social media is the most recent example, but the pattern is decades old. In every major mass tort of the modern era, the same sequence plays out. An industry causes widespread harm. The legislative process stalls because the industry that would bear the cost of regulation has the political resources to prevent it. The courts reach the information and the accountability that the legislative process cannot. Per- and polyfluoroalkyl substances were introduced industrially in the 1950s. Manufacturers possessed internal research suggesting health risks for decades before that information became public. The EPA did not set enforceable drinking water limits for the most common PFAS compounds until 2024. That is roughly seventy years after their widespread industrial introduction. Congress failed to pass broad PFAS legislation. Private litigation, brought by communities near manufacturing facilities and military bases, produced more actionable information about PFAS health effects than decades of administrative process. Discovery surfaced internal documents, epidemiological data, and risk assessments that were never voluntarily disclosed. The FDA approved OxyContin in 1995 based on clinical data that did not capture the addiction potential of mass-market prescribing. Post-market surveillance was chronically underfunded . State medical boards did not flag prescribing patterns shaped by industry-funded campaigns redefining pain management standards. By the time the regulatory apparatus mobilized a meaningful response, hundreds of thousands of Americans had died. The tens of billions of dollars in settlements that followed came through litigation. State attorneys general, municipalities, and private plaintiffs coordinated in MDL proceedings that forced production of internal documents demonstrating what manufacturers and distributors knew and when they knew it. Individual smokers sued the tobacco industry for decades. The industry won every case. Then state attorneys general coordinated. The 1998 Master Settlement Agreement extracted $246 billion from the four largest tobacco manufacturers. It remains the largest civil litigation settlement in American history. Congress was asked to legislate a global resolution in 1997 and failed to act. The FDA did not gain statutory authority to regulate tobacco until 2009 , forty-five years after the Surgeon General’s 1964 report linking smoking to cancer. The pattern is the same in every case. In every case, the industry that stood to lose from regulation had the political resources to delay or block legislative action. In every case, the courts forced the information into the open that the legislative process could not obtain. This is not to say the settlements were spent wisely. States diverted most of the tobacco settlement money away from smoking prevention. Opioid settlement funds are already following a similar pattern . But the litigation’s primary contribution was never the check. It was the discovery process that forced internal documents into the public record, the findings of fact that established what the industry knew, and the behavioral changes that consent decrees imposed. Those results do not depend on how legislatures allocate the proceeds. By Design, Not by Accident Most people treat this pattern as a workaround. The legislature fails, so the courts step in as a second-best alternative. That framing gets the institutional design backwards. Sean Farhang’s The Litigation State (Princeton, 2010) demonstrates that Congress has deliberately built private enforcement into the statutory framework for over a century. Farhang shows that when divided government makes bureaucratic enforcement unreliable, Congress responds by creating private rights of action that allow individuals and groups to enforce federal law through the courts. The number of pro-plaintiff statutory provisions soared after 1969, precisely when divided government became the norm. In Farhang’s analysis, private enforcement is a form of insurance against executive-branch failure to carry out Congress’s own statutes. A Congressional Research Service report published in October 2026 frames the point directly: Congress creates private rights of action when it views private parties as better situated than government actors to vindicate public interests. Farhang’s later work with Stephen Burbank, Rights and Retrenchment (2017), documents the counter-movement: a sustained campaign to restrict private enforcement through mandatory arbitration clauses, class-action waivers, and procedural barriers. That campaign is itself evidence of the thesis. Industries do not spend decades trying to close the courthouse door unless the courthouse is producing results. But the point extends beyond statutory design. The common-law tort system predates the administrative state by centuries. The right to sue for harm caused by another’s negligence or fraud is not a modern invention or a procedural workaround. It is the original enforcement mechanism. And it has structural advantages that legislation does not. Adversarial discovery reaches information that no other institutional process can compel from an uncooperative party. Juries assess community standards. Remedies are calibrated to actual harm rather than political compromise. And the process does not require legislative permission to begin. A plaintiff who has been injured can walk into a courthouse without waiting for a committee vote, a floor debate, or a conference report. These features are the reason the system works when legislation does not. The industries that can stall a bill in committee for years cannot stall a lawsuit. Discovery does not stop because a trade association spent heavily on the last election cycle. A jury does not defer to a lobbying campaign. The structural independence of the courts from the political process is precisely what makes them effective when the political process has been captured. That independence is not absolute. Judicial elections and the same corporate money that floods legislative races now flows into state supreme court campaigns . But the adversarial process creates a structural check that committee markups do not. A lobbying dollar can keep a bill from reaching the floor. It cannot keep a plaintiff’s lawyer from deposing a corporate officer under oath. What the Stall Tells You When I evaluate a mass tort where the legislative path has stalled, the stall itself is part of the thesis. A regulated industry that has successfully blocked legislation for years is an industry that has externalized costs onto the public without consequence. That gap between the harm and the accountability is what the litigation is designed to close. The Meta settlement did not require Congress to define what “harmful to minors” means. It required Meta to answer for what its own internal research showed it already knew. The opioid settlements did not require a new statute. They required manufacturers and distributors to account for distribution patterns their own data flagged. The PFAS litigation did not wait for the EPA to finish a seventy-year rulemaking process. It reached the internal documents that regulators had never obtained. In each case, the litigation moved because the facts were strong enough to support it. That is the market signal that capital responds to. The question for a funder is not whether Congress should have acted. It is whether the evidentiary record supports the claim that the defendant caused harm it knew about and failed to prevent. When the answer is yes, the legislative gap is not an obstacle to the investment. It is the context that explains why the litigation exists. What Litigation Cannot Do Litigation is not a perfect substitute for legislation. A statute sets prospective rules that apply to an entire industry. A lawsuit resolves a dispute between specific parties. Statutes can create agencies with ongoing enforcement authority, and they can reach conduct before it causes harm. Lawsuits end when the case settles or the judgment is paid, and they arrive, by definition, after the harm has occurred. These are real limitations. Litigation is slower than a statute. It is more expensive per unit of compliance. It depends entirely on the quality of the cases brought, and not every lawsuit that invokes public harm actually serves the public interest. As I noted in the previous article in this series, the system’s filtering mechanisms exist for a reason. The next article, The Case Against Mass Torts (And What It Gets Right), will engage those critiques directly. But the question is not whether litigation is perfect. It is whether, given what the legislative process actually produces when faced with well-resourced opposition, the tort system delivers accountability that would not otherwise exist. The record across tobacco, opioids, PFAS, and social media answers that question. In each case, decades of legislative inaction preceded litigation that forced information into the open and extracted consequences from the entities responsible. The courts did not replace the legislature. They did the work the legislature had declined to do. The Design Choice As this series has argued from the systemic case for aggregation through the regulatory complement and the evidentiary record MDLs produce, private enforcement is a defining feature of American institutional design, not an accident of it. What the social media litigation adds to that argument is a timing claim. The courts do not merely supplement the legislative process. When the legislative process is captured by the industries it is supposed to regulate, the courts get there first. Meta’s $17.1 billion settlement was the system working as designed, through the channel that the opposing industry could not block. Private enforcement is the mechanism the system provides when legislative failure is predictable. The common-law system does not require legislative permission to hold a wrongdoer accountable. That design choice becomes harder to dismiss as accidental every time Congress declines to act. W. Tyler Perry is the Director of Mass Tort Strategy at Certum Group, a litigation finance advisory firm. He writes about the institutional architecture of the American civil justice system. The views expressed here are his own.

On November 3, 2026, the Second Circuit reversed the dismissal of a Defend Trade Secrets Act claim in SS&C Technologies Holdings, Inc. v. Arcesium LLC, No. 25-2049 (2d Cir. Nov. 3, 2026) (Sack, J., joined by Livingston and Carney, JJ.). It is a very plaintiff-friendly DTSA decision; anyone who underwrites or litigates trade secret cases in this Circuit should read it. The facts are familiar. SS&C owns Geneva, a portfolio accounting platform built over decades. Arcesium licensed Geneva under a reseller agreement that barred it from using Geneva to build a competing product. While it had access, Arcesium built its own platform, Trinity, in under three years (Geneva took decades!), pitched Geneva customers on Trinity having “the same” functionality, and built a second tool, Nautilus, to keep connecting to Geneva after the license expired. Internal emails showed employees acknowledging the “IP constraints” and being told not to describe Trinity’s requirements by reference to “what Geneva does.” The Southern District of New York found that SS&C had pleaded trade secrets but not misappropriation, and dismissed. The Second Circuit reversed. The Crux: Courts Shouldn’t Pick Between Competing Readings on a 12(b)(6) Motion The most important part of the opinion is its rebuke of how the district court used certain documents attached to the complaint. Prior to filing an amended complaint, the district court had ordered Arcesium to produce 23 documents that SS&C identified as integral to its case. SS&C quoted those documents in its complaint. Arcesium then attached the same emails, plus a declaration from its Head of Technology, to its motion to dismiss and offered its own innocent explanation of what they meant. The district court accepted that explanation. The Second Circuit identified two errors: Self-serving defendant documents shouldn’t be taken as true. Citing Pearson v. Gesner, the court said that when a plaintiff incorporates a defendant’s “unilateral writing,” the court must ask why the plaintiff relied on it, not accept “every word” as true. Arcesium’s internal emails were exactly that kind of document. No fact-finding on a motion to dismiss. The “more fundamental error” was that the court weighed Arcesium’s explanation against SS&C’s allegations and decided Arcesium had “the better interpretation.” That is fact-finding. The district court relied on the rule that when an incorporated document contradicts the complaint, the document controls. The Second Circuit answered: “Perhaps.” But the documents did not contradict SS&C. The parties simply read them differently, which “is, of course, to be expected in any litigation.” Courts may look at incorporated documents, but they may not “take on the role of the jury when doing so.” This matters well beyond software. In trade secret cases, the plaintiff’s best early evidence is often the defendant’s own emails, obtained through pre-suit discovery, a related case, or a whistleblower. Defendants routinely attach those emails to a motion to dismiss and argue an innocent reading. SS&C shuts that down at the pleading stage. Sharing With Customers Under NDA Is Permissible Arcesium argued that Geneva could not be a trade secret because every licensed user had access to the executable software, the integration layer, and the data model. The Second Circuit rejected that argument because it would create “a near-blanket rule that any information shared with a third party cannot be a trade secret.” Adopting the Ninth Circuit’s view, the court held that giving trade secrets to third parties “does not undermine a trade-secret claim, so long as the information was provided on an understanding of confidentiality.” SS&C alleged that Geneva could be accessed only by licensed customers bound by strict non-disclosure and confidentiality provisions. That was enough. For any business that licenses its secret sauce, whether software, data, or processes, this is the right answer and it is now settled in the Second Circuit. Specificity: Enough to Give Notice and No More Arcesium also made the usual argument that SS&C described only “extraordinarily general categories of information.” The court declined to adopt a “general specificity rule.” Following the Third Circuit in Oakwood Laboratories v. Thanoo, it held that a plaintiff “need not spell out the details of the trade secret to avoid dismissal.” The complaint only needs to identify the secret with enough specificity to “place a defendant on notice of the bases for the claim” and let it “ascertain at least the boundaries within which the secret lies.” SS&C met that standard by doing more than listing categories. It described what each component does (for example, the database that stores portfolio, price, and transaction data) and how it is used (for example, the integration layer that lets developers run Geneva functions and move data in and out). The court contrasted that with a complaint that claimed only a “core brand and marketing plan strategy.” The lesson is to describe what the secret does and why it matters, not to disclose the secret itself in a public pleading. “Use” Is Very Broad The Second Circuit had never defined “use” under the DTSA. It now has, and the definition is expansive: “any exploitation of the trade secret that is likely to result in injury to the trade secret owner or enrichment to the defendant.” That includes marketing goods that embody the secret, relying on it to speed up research and development, and soliciting customers with it. Trade secrets “need not be exactly copied,” a product that is merely “similar” can be enough, and the court cited with approval district court cases finding use where a defendant studied the information to “increase his knowledge base.” SS&C’s allegations fit easily: Trinity was built in under three years against Geneva’s decades, Arcesium went live eight months after its CEO said a transition would take at least twelve, and it sold Trinity to Geneva customers as able to mimic Geneva’s functionality. Taken together and against the license restrictions, that stated a claim. Why It Matters The court was careful to say it was not ruling on the merits or on the right reading of the emails, and SS&C still has to prove its case. But at the pleading stage, SS&C v. Arcesium tilts the field toward DTSA plaintiffs in four ways: confidentiality agreements with customers are reasonable measures; specificity means notice, not a blueprint; “use” reaches nearly any exploitation of the secret; and courts may not credit a defendant’s spin on its own documents to end a case early. From a funder’s perspective, that matters. Early dismissal risk is one of the biggest variables in pricing a trade secret case, and this decision meaningfully reduces it for well-pleaded claims in the Second Circuit. Read the Second Circuit’s full opinion HERE . For a deeper look at how we evaluate these cases, see Certum’s Trade Secret Playbook . If you are evaluating a live dispute—or simply want to pressure-test what a matter is worth and how it might be funded—get in touch. A confidential conversation with Certum is free and carries no obligation, whether or not you ultimately seek funding. Reach us at certumgroup.com/contact-us .