Adam: Anonymous browsing just lost a significant legal defense.
Adam: Not metaphorically. The Supreme Court — six to three — ruled that Texas can require every visitor to adult content websites to submit government ID, or its equivalent, before they can access legal material. Free Speech Coalition v. Paxton. That's the decision. That's what it says.
Adam: The Internet Society's argument against this is worth actually sitting with — because it's not about the content. It's about the record. Every verification creates one. A persistent identity record of what someone browsed, when, and where. Government ID collection at that scale IS surveillance infrastructure. The child-protection framing is the cover… not the mechanism.
Adam: The majority didn't dispute that. They just said states can do it anyway.
Adam: Now pull back slightly — because this ruling didn't arrive alone.
Adam: Same week: Sweden's IMY issued its ruling — June 16th — against Securitas Sverige AB. AI driver-monitoring cameras in cabs. The road-safety defense, rejected — because Securitas never produced a documented proportionality assessment. GDPR requires one. They didn't have it.
Adam: June 3rd, Irish High Court. TikTok Technology Limited loses most of its appeal against the Irish DPC's April 2025 finding — GDPR international-transfer violations. The decision largely stands.
Adam: U.S., Sweden, Ireland. One window. The same underlying argument running through all of it — that surveillance wrapped in a legitimate purpose is still surveillance, and the documentation burden is real.
Adam: Here's what actually changed this week — not the rulings themselves, but the architecture underneath them.
Adam: The Supreme Court agreed to hear Salazar v. Paramount Global. First-ever SCOTUS case under the Video Privacy Protection Act — a law written in 1988 for physical video-rental stores. The question: does a free newsletter subscriber qualify as a protected consumer under that statute? Paramount Global is accused of taking those subscriber records and passing them to Facebook.
Adam: You signed up for a newsletter. Free. You didn't rent a tape. And yet.
Adam: Then June 17th — Google notifies EU advertisers: starting August 3, 2026, it will repurpose EU users' IP addresses for ad targeting and device identification. New GDPR consent obligations triggered. Not a policy discussion. A date. A switch flipped.
Adam: And then the Delhi High Court upholds India's temporary Telegram block under Section 69A of the IT Act — ruling that 'information' under the statute covers an entire platform, not specific content. That's the precedent. Temporary, with no temporal ceiling written into the ruling.
Adam: No end date. Temporary… indefinitely.
Adam: Canada's Parliament passes Bill C-22 through third reading — midnight committee session, limited amendments — encryption and metadata retention concerns left sitting on the floor, unresolved.
Adam: Four jurisdictions. The same logic running through all of them — that announcement substitutes for consent, that framing substitutes for documentation, that 'temporary' means something until it doesn't. The GDPR proportionality requirement under Article 6 exists precisely because a safety rationale, stated plainly, is not enough. You document it. You justify it. Securitas didn't. Google is betting its August 3rd notification does. Think about whether those are the same thing.
Adam: Two live tripwires. That's what's left.
Adam: Salazar v. Paramount Global is not decided. The Supreme Court agreed to hear it — that is ALL. The Video Privacy Protection Act was written in 1988 for physical rental stores. The question sitting before the Court now is whether a free newsletter subscriber qualifies as a protected consumer under that statute. Paramount Global allegedly took those subscriber records and handed them to Facebook. No rental. No transaction. A free signup.
Adam: And here's the honest read — the VPPA text may actually support Paramount Global's position. 'Consumer' was written for paying customers. The statute did not anticipate ad-supported digital platforms. That ambiguity is real, not manufactured.
Adam: Which makes what the Court does with it consequential in both directions. A narrow ruling guts the law. A broad one rewrites what counts as protected browsing behavior across every free platform you use. Think about the surface area of that second outcome.
Adam: Then there's August 3, 2026. Google's date. IP addresses repurposed for ad targeting and device identification across EU users — GDPR consent obligations triggered, not resolved. The IMY ruling on Securitas left the proportionality line genuinely contested. Where legitimate safety use ends and unlawful surveillance begins is unsettled among EU data protection authorities. Google is betting a notification clears the bar. That question is still open.
Adam: The child-safety rationale behind Free Speech Coalition v. Paxton is not legally frivolous. The SCOTUS majority held it plainly — states may impose age-verification on adult content to protect minors without violating the First Amendment. That's a real state interest. The Irish DPC's TikTok finding is upheld, enforcement still pending. The Delhi High Court's Section 69A logic has no time limit written in. All of it is still moving. August 3rd is the next hard date. Salazar is the next hard question. Neither is resolved.
Adam: The question that used to matter was whether a given surveillance program was necessary — proportionate, documented, justified against a specific harm. That was the operative legal test. What this week replaced it with, quietly, across four jurisdictions, is a different question entirely. Was it announced? Did someone, somewhere, post a notification? Google sets a date. Texas posts a law. India issues a block order. The framing shifts from necessity to disclosure — and disclosure, it turns out, is a bar almost anyone can clear.
Adam: Which means the only live question now is who controls the announcement.
