Daily Surveillance Briefing: August 10, 2026

California fined Disney $2.75 million for opt-out controls that worked one device at a time while letting the rest of the data keep flowing. The FISA 702 reauthorization fight has come back to the front of the surveillance debate, this time with ICE's warrantless raids as the visible example of what 'domestic surveillance' looks like. South Dakota moved closer to an ISP consent law. TikTok's new US entity widened what it collects. The Army renewed a contract that turns scraped social-media photos into targeting data.

State of Surveillance Editorial Team

Today in Surveillance:

  • California fined Disney $2.75 million, the largest CCPA penalty in state history. The investigation found Disney's opt-out controls worked one device at a time while third-party trackers kept running, and Global Privacy Control signals stopped at the same device that sent them [1][2][3].
  • The FISA Section 702 reauthorization fight is back in view. Director of National Intelligence Tulsi Gabbard told her confirmation hearing warrants "should generally be required" before searching Americans' communications in the 702 database. The 2024 warrant amendment tied 212-212, one vote short [4][5][6].
  • South Dakota's Senate passed SB 110 by a 28-6 vote. The bill requires broadband ISPs to get customer consent before selling or sharing browsing data. It now heads to the House [7][8].
  • TikTok's USDS Joint Venture LLC pushed a mandatory privacy policy update on January 22. It now permits precise GPS tracking for opted-in users, off-platform ad targeting, and AI-interaction logging. The immigration-status language that went viral has been in the policy since August 2024 [9][10][11].
  • The US Army's 1st Special Forces Command renewed its Clearview AI contract. The "sole source" justification says DOD "cannot" analyze facial data at scale without access to Clearview's 50-plus-billion-image database. The base period runs through March 2027 with options to 2030 [12][13][14].

Disney's Opt-Out Button Existed. The Function Didn't.

California Attorney General Rob Bonta announced on February 11, 2026 that The Walt Disney Company would pay $2.75 million to settle a CCPA enforcement action. It is the largest CCPA penalty in California history, surpassing the $1.55 million Healthline Media fine in July 2025 [1][2].

California tested what the controls actually did. The opt-out toggle in Disney's apps stopped data selling only on the specific service and device where it was clicked. The online webform stopped sharing through Disney's own ad platform, but third-party ad-tech code kept collecting. Global Privacy Control was honored only on the device that sent it [1][2][3]. Disney told investigators it could not unify the opt-out because of "vendor and technical limitations." The same company told the same investigators it could unify identity across every screen for targeted advertising. Bonta's response: "A consumer's opt-out right applies wherever and however a business sells data. Businesses can't force people to go device-by-device or service-by-service" [1][3]. The settlement requires Disney to build a unified opt-out, honor GPC across the whole business, and submit to 60-day compliance check-ins. Read the Disney CCPA record fine vessel.

FISA 702 Reform Is Back on the Table. ICE Made It Concrete.

Section 702 of FISA expires April 19, 2026. Sen. Dick Durbin (D-Ill.) and Sen. Ron Wyden (D-Ore.) tied the warrant fight to ICE enforcement operations in Chicago and Minneapolis, with Wyden disclosing an internal ICE memo saying agents can break into homes without a judicial warrant [4]. The 2024 reauthorization, RISAA, added new collection avenues for immigration and drug trafficking cases [5].

Director of National Intelligence Tulsi Gabbard told her confirmation hearing that warrants "should generally be required" before an agency searches Section 702 data for an American's communications, except in emergencies [4][5]. That is a remarkable position for the person who oversees all 18 US intelligence agencies. Gabbard undercut that argument from the top of the food chain in one sentence.

The math has shifted. When the House voted on the warrant amendment in April 2024, it tied 212-212. Speaker Mike Johnson initially supported it and switched his vote to kill it [6]. In December 2024, Judge LaShann DeArcy Hall ruled backdoor searches of 702 data require a Fourth Amendment warrant [15]. The FBI's compliance numbers have improved: noncompliant queries dropped from 278,000 in 2022 to minimal levels [5]. The wild card is the administration's silence. No Trump-administration official has publicly stated whether they support reauthorization. The Government Surveillance Reform Act, backed by the ACLU, EFF, CDT, EPIC, Brennan Center, and more than 30 other groups, is the package that would add a warrant requirement [16]. The full FISA 702 vessel lays out the three possible outcomes.

South Dakota Told ISPs to Ask Before They Sell Your Browsing Data

The South Dakota Senate passed SB 110 on February 20, 2026 by a 28-6 margin. The bill requires broadband ISPs to get customer consent before selling or sharing data. Senator Michael Rohl (R-Aberdeen) sponsored the bill. Rohl's summary: "whether it's given or whether it's sold, the consumer has to approve it" [7][8].

Telecom lobbyists pushed back. Justin Smith of Midco called the bill "a huge new regulatory hurdle." Brett Koenecke of CenturyLink warned it could hamper emergency services [8]. The bill failed 5-3 in committee, was revived, and an amendment to strip the small-ISP exemption passed 20-14 before the final 28-6 floor vote. SB 110 now heads to the House [7][8].

The federal backdrop is nine years old. In April 2017, Congress used the Congressional Review Act to kill FCC broadband privacy rules [17]. Maine passed a broad ISP privacy law in 2019. California covers ISPs under CCPA. South Dakota would join a patchwork that turns privacy into a function of which state you live in. The SB 110 vessel covers the House prospects.

TikTok's New Privacy Policy Went Live in January. The Scary Part Was Already There.

TikTok USDS Joint Venture LLC pushed a mandatory privacy policy update on January 22, 2026. Roughly 170 million Americans got a pop-up they could not skip. Most tapped "Agree" without reading [9][10].

Three parts are actually new. Previously TikTok was barred from precise GPS collection from American users. The updated policy states the platform "may also collect precise location data, depending on your settings" [10]. TikTok says precise collection is opt-in. Off-platform ad targeting and AI-interaction tracking are now also enabled [10].

The citizenship and immigration status language that went viral is not new. TechCrunch reported it has been in the policy since approximately August 2024, when TikTok updated it to comply with California AB-947 [9]. The power structure to exploit that language has changed: Oracle, Silver Lake, and MGX now own the US operations, with ByteDance still holding 19.9 percent [10]. Read the full TikTok policy vessel for the mitigation checklist.

Green Berets Use Clearview AI. The Army Says It 'Cannot' Do the Job Without It.

The US Army's Mission and Installation Contracting Command at Fort Bragg issued Solicitation W9124726QA005 in late February 2026. The base period runs March 20, 2026 through March 19, 2027, with annual options to March 2030. Five Clearview AI software seats go to 1st Special Forces Command (Airborne). The previous contract was $75,000 [12][13].

The Army executed this as a "brand name procurement" because, per the justification memo, "Clearview AI is sole source facial recognition software... Without Clearview AI, the Department of Defense cannot rapidly analyze vast amounts of facial data" [12][13].

The contract requires access to approximately 50 billion images, minimum 98 percent accuracy, SOC 2 Type II certification, and annual penetration testing [12]. Clearview AI built that database by scraping Facebook, Instagram, LinkedIn, Twitter, Venmo, and dating apps. Every major social-media platform banned Clearview from scraping. Dutch regulators fined Clearview €30.5 million in September 2024 for building an illegal facial recognition database. The company has not paid [19].

The pattern is wider. ICE, CBP, and DHS have all signed Clearview contracts or built adjacent face-matching systems, per the CBP tactical-targeting vessel and the DHS face database vessel. There is no federal law restricting military use of commercial facial recognition built on scraped civilian data. The full Clearview Army vessel traces the procurement history. The ICE Out of Our Faces Act would ban ICE and CBP from using facial recognition. It will not pass, and it would not touch Army contracts.

What to Watch

South Dakota's House vote on SB 110. The Senate passed the broadband-consent bill 28-6. Watch whether the House version keeps the small-ISP exemption stripped, and whether Governor Noem signals a position before a final vote [7][8].

Disney's 60-day compliance check-ins. The first check-in is the test of whether the unified opt-out and the cross-device GPC honoring actually exist [1][3].

FISA 702 reauthorization text. Watch whether the warrant amendment gets a clean vote or whether the reauthorization is tucked into must-pass legislation with no reform debate. Gabbard's confirmation-hearing answer is the strongest argument reformers have had since 2024 [4][5][6].

TikTok's data-collection telemetry. The interesting signals will come from users who opt in to precise GPS and from any disclosure of how many accounts have triggered the AI-interaction logging [9][10].

The Army's other Clearview units. Five seats is a small number. The next contract that doubles the seat count, or the first disclosure of an operational use, is the moment this stops being an analyst tool and starts being a field tool [12][13].

Sources

  1. California Attorney General: "California Won't Let It Go": AG Bonta Announces $2.75 Million Settlement with Disney (February 11, 2026). https://oag.ca.gov/news/press-releases/california-wont-let-it-go-attorney-general-bonta-announces-275-million
  2. IAPP: California's Attorney General Issues Largest CCPA Fine to Date (February 2026). https://iapp.org/news/a/california-s-attorney-general-issues-largest-ccpa-fine-to-date
  3. Frankfurt Kurnit Klein & Selz: Takeaways from the Disney CCPA $2.75 Million Settlement (February 2026). https://technologylaw.fkks.com/post/102mi7b/takeaways-from-the-disney-ccpa-2-75-million-settlement
  4. Nextgov/FCW: Domestic Surveillance Fears Loom Over Congress Debate to Renew Spying Power (February 2026). https://www.nextgov.com/cybersecurity/2026/02/domestic-surveillance-fears-loom-over-congress-debate-renew-spying-power/411214/
  5. Lawfare: Mum's the Word on FISA Section 702 Reauthorization (November 2025). https://www.lawfaremedia.org/article/mum-s-the-word-on-fisa-section-702-reauthorization
  6. Lawfare: FISA Section 702 Reauthorized for Two Years (April 2024). https://www.lawfaremedia.org/article/fisa-section-702-reauthorized-for-two-years
  7. Hub City Radio: South Dakota Senate Passes SB110 (February 20, 2026). https://hubcityradio.com/south-dakota-senate-passes-sb110/
  8. KOTA-TV: Committee Splits on Two Data Protection Bills (February 12, 2026). https://www.kotatv.com/2026/02/12/committee-splits-two-data-protection-bills/
  9. TechCrunch: TikTok users freak out over app's 'immigration status' collection, here's what it means (January 23, 2026). https://techcrunch.com/2026/01/23/tiktok-users-freak-out-over-apps-immigration-status-collection-heres-what-it-means/
  10. WebProNews: TikTok's U.S. Pivot: Precise Location, Immigration Data Spark Privacy Firestorm (January 2026). https://www.webpronews.com/tiktoks-u-s-pivot-precise-location-immigration-data-spark-privacy-firestorm/
  11. IBTimes: New US TikTok Entity Triggers Privacy Alarm Over Citizenship and Sexual Orientation Data (January 2026). https://www.ibtimes.co.uk/new-us-tiktok-entity-triggers-privacy-alarm-over-citizenship-sexual-orientation-data-1773471
  12. Biometric Update: US Army renews Clearview AI facial recognition contract for special operations (February 2026). https://www.biometricupdate.com/202602/us-army-renews-clearview-ai-facial-recognition-contract-for-special-operations
  13. Jack Poulson: Green Berets are now using Clearview AI's facial recognition (2026). https://jackpoulson.substack.com/p/green-berets-are-now-using-clearview
  14. FedScoop: Clearview AI CEO says company focused on winning federal agency contracts (2024). https://fedscoop.com/clearview-ai-hoan-ton-that-federal-contracts/
  15. ACLU: Court Rules Warrantless Section 702 Searches Violated the Fourth Amendment (December 2024). https://www.aclu.org/press-releases/court-rules-warrantless-section-702-searches-violated-the-fourth-amendment
  16. EPIC: FISA Section 702: Reform or Sunset Campaign. https://epic.org/campaigns/fisa-section-702-reform-or-sunset/
  17. Harvard Journal of Law & Technology: Congress Rolls Back FCC Broadband ISP Privacy Rules (2017). https://jolt.law.harvard.edu/digest/congress-rolls-back-fcc-broadband-isp-privacy-rules
  18. Clearview AI: National Security & Defense. https://www.clearview.ai/national-security-and-defense
  19. The Hacker News: Clearview AI Faces €30.5M Fine for Building Illegal Facial Recognition Database (September 2024). https://thehackernews.com/2024/09/clearview-ai-faces-305m-fine-for.html
  20. State of Surveillance: DHS Maintains a Database of 1.2 Billion Faces (2026). https://stateofsurveillance.org/news/dhs-1-2-billion-face-database-nec-mobile-fortify-2026