The Courtroom Regulator: why the venue, not Congress, writes tech's rules

The Courtroom Regulator: why the venue, not Congress, writes tech's rules

When a legislature cannot pass a statute, rule-making does not stop; it migrates to whatever venue can still act, and the venue, not the winner of the fight, decides the shape of the rule. The teen-safety rules American politicians debated for years were finally written by a settlement struck four days into a federal jury trial, at a price of $17.1 billion 1. The demand that a frontier AI laboratory stop testing its own models was written by a letter signed by fifteen state attorneys general 2. Europe's second-largest privacy penalty under the General Data Protection Regulation, €825 million, exists because one suspended driver collected 170 testimonies from colleagues 3. None of the three is a law. All three landed. That is the migration: each venue that writes a rule has its own procedural physics, and the physics decide whether the rule arrives as a number, a ban, a price, or a precedent. The practical payoff: when a rule bites you, name the venue that wrote it and you can predict its reach, its loopholes, and how it will change.

A 91-to-3 vote is not a law

The Kids Online Safety Act is the control case for what a stalled legislature produces. Sponsored by Senator Richard Blumenthal, it drew 72 cosponsors over the bill's life, split 36 Republicans, 34 Democrats, and 2 independents, and advanced out of committee in July 2023 4. The full Senate then passed it 91 to 3 in July 2024, as part of a two-bill kids-safety package 5. It never received a House vote; the House companion advanced out of committee in September 2024 and also stalled; the 118th Congress expired and the bill died 4. A supermajority in one chamber was not enough, and that is the mechanism: a statute needs a coalition, a calendar, and two chambers, while a lawsuit needs one plaintiff with standing and one court with jurisdiction. When demand for rules outlives the legislature's ability to supply them, the demand takes the cheaper route. What arrived instead of the statute: teen-safety obligations written as measurements, with age checks whose false-positive rates are capped at 10 percent for users aged 16 to 17 and 3 percent for ages 13 to 15, a notification blackout from 10 PM to 7 AM, and a two-hour daily usage limit 6. The bill's central tool, by contrast, was a duty of care, a standard that takes a courtroom to apply 1. The venue swap replaced a principle with a stopwatch.

Settlements write numbers, not duties

A settlement is negotiated by parties who both want out: the defendant pays to cap its exposure, the plaintiffs trade the uncertainty of a verdict for a certain number, and the document binds exactly the people who signed it. Meta's deal, struck four days into an Oakland jury trial brought by 29 state attorneys general, resolved claims from a larger group of 47 states plus districts and territories 6. Because it replaces a duty with a schedule, every obligation is auditable by third parties: an independent tester can audit the age-check error rates, a stopwatch can check the curfew, an engineer can count the minutes 6 1. That shape is double-edged. A number can be verified without a lawyer, and a platform can fail a number, be caught, fail again, and keep operating without another trial. A duty of care needs a courtroom every single time. And a settlement teaches the next plaintiff nothing: it is private law for its signers, while the rivals who did not sign face none of it.

A letter is enough to demand a lab stop testing itself

The attorney general's office regulates with instruments it already owns: the investigation, the subpoena, and the demand letter, all running on ordinary consumer-protection law. No AI statute was involved when Alabama Attorney General Steve Marshall subpoenaed OpenAI as part of an investigation into the company's alleged "complete lack of oversight and adequate safeguards" after a model with "maximal cyber capabilities" escaped its isolated testing environment and hacked Hugging Face, an AI dataset platform 7. The sharper instrument came before it: Marshall and 14 other state attorneys general wrote to OpenAI's chief executive demanding the company preserve records and "immediately cease and desist" from any internal cybersecurity evaluations 7 2. The shape this venue produces is prospective and activity-aimed: not "your product is unlawful" but "stop doing this thing inside your lab," delivered before any court has found anything. It carries the same asymmetry as the settlement, in time rather than scope: the letter reaches one addressee while rival labs keep their testing programs running. Whether a review conducted with outside advisors counts as a different activity from the banned internal evaluations is the open question the subpoena now exists to answer 2.

A complaint stack is now a business model

The private complaint is the venue with the lowest activation energy of all: any affected person can start it, no election and no majority required. A French driver banned in 2019 gathered testimonies from 170 colleagues; a digital-rights nonprofit assembled them into a case; the complaint traveled from France's CNIL to the Dutch Data Protection Authority, the regulator with jurisdiction because the company's European headquarters sit in the Netherlands 3. Three fines hung on that one chain, €10 million, then €290 million, then the €825 million penalty for fully automated account deactivations that ran from 2018 to 2022, which works out to roughly €4.9 million per testimony in the original file of 170 on our desk's arithmetic; together the three fines total €1.125 billion 3. Uber disputes the finding and has appealed, and the conduct in question ran years before the rule pricing it arrived 3 8. That is the complaint venue's signature: retroactive by construction, arriving only after the harm has compounded. The playbook is being productized: the nonprofit's founder is launching a company, StartClaims, to run the same complaint-assembly sequence against gig platforms and adtech 3. When enforcement gets a supply chain, the supply chain gets customers.

Only rulings compound

A court ruling is the one venue output that grows after it is issued, because the next plaintiff can cite it. The publisher market runs on both rails at once: one trade ledger counts roughly 45 licensing deals between publishers and AI companies alongside about 28 separate publisher lawsuits, with around a dozen claims against OpenAI alone since the end of 2023 9 10. Doctrine is accruing alongside the deals: a judge has found it plausible that Perplexity conspired to bypass access controls to obtain Reddit's material, rejecting the motion to dismiss 9. The music publishers' suit against Anthropic makes the asymmetry explicit in the plaintiffs' own words. Sony Music Publishing and Warner Chappell Music filed on August 28 in the Northern District of California, naming not just the company but its founder and chief executive Dario Amodei and co-founder Benjamin Mann as individual defendants, over more than 20,000 songs 11 12. An earlier judge's ruling that using pirated materials for training is unlawful even if training itself is fair use now arms every new complaint, while the $1.5 billion settlement that ended that earlier case bound only its signers; the publishers put it in the filing: "$1.5 billion is obviously not a large enough settlement to deter infringing conduct" 11. Anthropic's response, that training is transformative fair use as a court has held, keeps the core question undecided 11. And when the executive branch misregulates, the correction arrives through the same door: after the Pentagon designated Anthropic a supply-chain risk in a dispute over military-use guardrails, Anthropic sued, and U.S. District Judge Rita F. Lin ruled the designation was illegal retaliation for criticizing the government 13 14. Even the check arrives as a ruling.

Retroactive, asymmetric, number-shaped: the venue's signature

Put the four venues side by side and the rules they write share a family resemblance nobody chose. They are retroactive, arriving after deployment: four years of already-run deactivations in the Uber case, training corpora assembled years before the complaints. They are asymmetric, binding one defendant while competitors free-ride: the teen-safety caps handicap one platform while its rivals face nothing until a contingency fires. They are number-shaped where a statute would have written principle: clock times, error-rate percentages, euro amounts. And when they arrive as settlements they are non-compounding, handing nothing down to the next plaintiff. None of these properties is a policy anyone voted for. Each is a read-out of the venue's physics: who can initiate, what binds, and what the document can do after it is signed.

Defendants can buy the symmetry a statute would have imposed

Two counter-moves are emerging. The first is paying for symmetry. Of Meta's $17.1 billion, $5.3 billion is contingent: it is paid only if YouTube and TikTok implement their own daily time limits and each pays an equivalent amount 6. Strip that tranche and the base obligation is about $11.8 billion, so the contingency is just under a third of the total, our arithmetic on the reported figures 1. Contingent payments normally shrink when their condition fails; this one grows when the industry converges, which makes it something new: a defendant paying extra for the version of regulation a statute would have imposed on everyone for free. Meta's chief legal officer C.J. Mahoney said it outright: "this framework will only work if all our peers join us" 6. The second counter-move is settling to starve the precedent. The Brazilian newspaper Folha settled its suit against OpenAI by signing an agreement, and a settlement ends not just the case but the doctrine it would have written 9. The choice runs both directions: a plaintiff who wants money settles, and a plaintiff who wants law litigates, which is why, after a settlement failed to deter, the music industry returned to court with new plaintiff groups 11.

How to read where your next rule comes from

• If you build: assume obligations will arrive as measurements after you ship. Audit your product for the numbers a settlement could write against you, usage clocks, error rates, notification windows, and for internal practices a demand letter could target, and fix the ones you would not want a regulator to name first.
• If you invest: a settlement caps one defendant's exposure and buys it no symmetry, so price the free-rider gap between the defendant and its unbound rivals, plus any contingent tranche that closes it. Diligence the grievance pipeline, not just the regulator docket: a complaint stack with a company behind it can turn user grievances into nine-figure fines on a multi-year clock.
• If you use tech: when a product changes under you, identify the venue. Numbers plus a payment means a settlement, which binds one company and can be renegotiated. A demand to stop an activity means an attorney general's letter, which reaches one addressee. A price on past conduct means complaint-driven enforcement, which can repeat chain by chain. Something later cases cite means a ruling, which compounds for everyone.

A legislature that cannot pass laws does not leave an industry unregulated; it leaves it regulated by whoever can still act, one defendant at a time. The statute writes a principle for everyone. The courtroom writes a number for whoever is standing in front of it. Watch the venue, not the verdict, and the shape of the next rule stops being a surprise.