The GC Brief — Issue No. 3

A weekly read for general counsel and in-house teams: what moved, and why it matters.

In this issue: Meta settles the trial this brief opened with two weeks ago, on terms that tighten if its competitors sign on; Workday’s AI bias-testing data is privileged because its lawyers curated it; Spirit’s bankruptcy sells 175,000 employee records to Google while the customer data stays home; New York’s content-moderation disclosure law survives the First Amendment; the Third Circuit holds that litigating into discovery did not waive arbitration; California opens excess insurers to claims before exhaustion; the NAIC’s AI examination supplement heads for adoption; and the federal environmental-review channel narrows for infrastructure just as the Texas grid channel opens. Two deadlines are close: comments on Colorado’s proposed aerial-imagery bulletin close September 1, and comments on the proposed Trump Accounts employer regulations close September 25.

1. Meta settled the case this brief opened with — and the terms tighten if its competitors sign on.

Eight days into trial, Meta and a bipartisan coalition of 51 attorneys general filed a consent judgment; Judge Yvonne Gonzalez Rogers approved it hours after it was filed.¹ The money is where the structure shows. Meta describes the agreement as a payment of approximately $18 billion over ten years; roughly 70 percent of that is guaranteed, and the remaining share is released only if Snap, TikTok, and YouTube become bound by equivalent rules — by settlement, legislation, or audited voluntary compliance. The states describe the deal as worth up to $17 billion, and reported totals vary accordingly.² The design terms are the substance: a default two-hour daily limit for users under 18 and a block between midnight and 6 a.m., each liftable only by a parent; notification blocks overnight and during school hours; no like counts on minors’ posts; no cosmetic-surgery filters for minors; and an option for a non-personalized feed. Meta must retain an independent auditor with “expansive access to information and resources” and a right to communicate with the attorneys general, and is enjoined from further false or misleading statements about its safety features. The same contingency runs through the design terms: if the three platforms the settlement designates as Core Industry Members — Snap, TikTok, and YouTube — take on equivalent obligations, the daily default drops to one hour per app and the nighttime block widens. Meta’s chief legal officer said the framework’s “success depends on all other social media platforms following Meta’s lead.”³

Why it matters. A settling defendant has drafted its competitors’ compliance terms and tied its own payment to their choices. That is not a conventional consent judgment; it is an industry standard-setting exercise backed by money that moves depending on who else signs. For any company in a concentrated industry facing multistate attorney general litigation, the first mover can set the baseline everyone else is measured against, and the terms a competitor accepts can become the terms a regulator expects. Worth noting how little trial it took: eight days, a former safety engineer, and a product head cross-examined on a feature’s actual uptake. Most relevant to: general counsel and product counsel in concentrated consumer industries.

2. Workday’s AI bias-testing data is privileged — because its lawyers curated it.

In the AI hiring discrimination case against Workday, the magistrate judge denied the plaintiffs’ motion to compel Workday’s bias-testing data, holding it privileged because “Workday’s attorneys curated the underlying data and used the results in providing legal advice.”⁴ Workday had “shown more than mere direction by its attorneys”: counsel curated the data, the testing’s purpose was legal advice rather than business use, and the results had not gone to a regulator. Nor was privilege waived — “Workday’s invoking the mere existence of its bias testing outside of litigation is not enough to waive privilege.” The same order compelled Workday’s EEO-1 and OFCCP documents as relevant to its knowledge of demographic disparities. A second thread has also gone Workday’s way, though on burden rather than merits: after the district judge vacated part of the discovery order and remanded, the courts again found that plaintiffs “have not met their burden of showing that Workday has actual possession of its customers’ data where it resides on segregated, password-protected customer tenants that Workday is contractually prohibited from freely accessing.”⁵ In July the district judge extended the certification schedule, noting Workday had “recently produced three bias evaluation reports” after asserting privilege over bias-audit data and instructing a data scientist not to answer questions about it.⁶ The Rule 23 motion is due September 14.

Why it matters. Bias testing is where AI governance advice meets discovery, and this record shows they are the same decision, made once, early. Testing run by the business, used for business purposes, or filed with a regulator is evidence; testing counsel scopes and uses to advise was, here, privileged. The trade runs both ways — privilege bought is transparency forgone, and reports were produced anyway once the schedule moved. The narrower holding is as useful: a contractual inability to reach a customer’s tenant defeated a possession-and-control argument, so vendor architecture allocates discovery burden long before anyone is in a dispute. Most relevant to: employment counsel and AI governance leads, with the vendor contract in hand.

3. Spirit’s bankruptcy is selling 175,000 employee records to Google. The customer data stays home.

Auction results filed in Spirit’s Chapter 11 name Google as the successful bidder at $10 million for a data package built from the airline’s internal systems.⁷ The schedule lists 175,658 employee records reaching back to 1986, 3.4 million payroll records, 1.09 million time cards, 100 million emails across 80,000 accounts, training and applicant-tracking records, and employment contracts and NDAs — plus Spirit’s source code. Customer-facing categories are almost uniformly excluded: 97.5 million passenger profiles, 50.2 million loyalty members, 30.9 million call recordings. The flight attendants’ union objected, putting the structural point directly: “The privacy architecture of this transaction is consumer-facing; its payload is disproportionately employee-facing.”⁸ The Bankruptcy Code’s protection for personally identifiable information is keyed to a definition covering what an individual gives a debtor to obtain a product or service — customers. The union does not argue that provision is triggered; its point is that “the statutory scheme the parties borrowed from was built for customers, and no comparable screen has been applied to the employment record that this transaction actually conveys.” Deidentification falls to an agent designated and paid by the buyer, certified to the buyer’s satisfaction, while “preserving referential integrity across the data set.” No consumer privacy ombudsman has been appointed. The sale hearing, adjourned from August 19, is September 9.

Why it matters. Employee data is an asset on the balance sheet, and in a liquidation the statutory protections that attach to it were written for consumers. The objection’s sharpest observation travels well beyond bankruptcy: deidentification addresses identifiability, not confidentiality. A disciplinary file or an accommodation request stays sensitive after the name comes off. Employers that tell their workforce personnel records are handled confidentially are making a promise a section 363 sale does not obviously keep — and the mechanics here, where the buyer designates the deidentifier and certifies its own satisfaction, surface only when someone reads the bill of sale. Most relevant to: employment and privacy counsel, and anyone diligencing a distressed acquisition.

4. New York’s content-moderation disclosure law survives.

A federal judge in Manhattan dismissed X Corp.’s challenge to New York’s Stop Hiding Hate Act, upholding provisions that require large social media companies to report semiannually on whether and how they moderate categories including hate speech, extremism, harassment, and disinformation.⁹ The court applied Zauderer review — which it described, quoting the Second Circuit, as “more relaxed than ordinary intermediate or strict scrutiny” — on the ground that the disclosures are commercial speech connected to the terms of the platform-user transaction and compel “purely factual and uncontroversial information.” Opinions about, or reasons for, those policies would be a different matter. The First Amendment and Section 230 preemption claims were dismissed with prejudice; a state constitutional claim was dismissed without prejudice as barred by the Eleventh Amendment. X had argued the Ninth Circuit’s treatment of California’s analogous statute settled the question. The court disagreed: “the plain text of New York’s Content Category Report Provisions cannot be reconciled with the construction the Ninth Circuit gave the California equivalent.” The Act reaches companies with $100 million or more in gross revenue, carries penalties up to $15,000 per violation per day, and provides a 30-day cure period.¹⁰

Why it matters. Disclosure mandates are proving to be the durable form of platform regulation. Substantive moderation rules keep failing on First Amendment grounds; reporting obligations keep surviving, because Zauderer asks so much less of the state. Two drafting choices did the work: the law asks what a company’s policy is rather than what it ought to be, and it asks for facts rather than justifications. That is a template other legislatures can copy, and the beginning of a real disagreement between the Ninth and Second Circuits for anyone operating under both. The 30-day cure period is the provision most coverage omits and the one compliance teams will use. Most relevant to: platform and regulatory counsel, and compliance teams facing state reporting mandates.

5. Litigating into discovery did not waive the right to arbitrate.

In a precedential opinion, the Third Circuit held that Budget and its parent, Avis Budget Group, did not impliedly waive arbitration by litigating for about nineteen months before moving to compel.¹¹ The plaintiffs, two UK citizens who rented cars in Massachusetts and Florida between 2016 and 2019, allege they paid for supplemental liability insurance Budget never actually purchased, intending instead to self-indemnify; neither had an accident or a denied claim. Waiver, the court reiterated, means the “intentional relinquishment or abandonment of a known right,” and under circuit precedent the defense here “required factual development with respect to each customer’s knowledge at the time of signing,” because the rental jacket carrying the clause was handed over after the rental form was signed. Where asserting the right depends on developing a factual record, the court reasoned, the absence of a motion to compel before that record exists is not evidence of an intention to relinquish or abandon the right. The defendants reserved the right three times, deposed the plaintiffs, and moved to compel about two months later. The court vacated and remanded for further consideration; it did not order arbitration, and two other defenses were never reached below.

Why it matters. Morgan v. Sundance stripped the prejudice requirement out of arbitration waiver and left courts applying ordinary waiver principles, which made delay genuinely risky. This opinion supplies the counterweight: delay attributable to building the record the motion itself requires is not abandonment, provided the right is reserved on the record and asserted promptly once the record exists. The specifics are the instruction — three reservations, in the answer, the discovery plan, and the initial disclosures, and roughly two months between the depositions that supplied the facts and the motion that used them. Most relevant to: litigation counsel managing consumer arbitration programs.

6. California opens excess insurers to claims before exhaustion.

A unanimous California Supreme Court held that an insured need not plead exhaustion of all underlying coverage to state claims against excess insurers for declaratory relief or for tortious breach of the implied covenant.¹² “The absence of exhaustion,” the court wrote, “is not fatal to these claims.” The pleading standard is two-track, and the summary now circulating is too simple. Where the amount of allegedly covered losses is already known before filing, the insured “may reasonably be expected to plead this amount and what the covered losses consist of,” measured against the excess policy’s attachment point; if known losses fall short, a demurrer is properly sustained. Only where it is unknown whether losses will reach the excess layer does a reasonable-likelihood standard apply — it must be “practically or reasonably likely that the insured’s potential liability will reach into the excess coverage,” with no “precise formula or line of demarcation.” On bad faith, the insured must allege facts showing coverage “will attach — or that it would attach, if not for the excess insurer’s bad-faith conduct — and that the insurer’s misconduct has impaired the insured’s recovery of benefits owed to it under the policy.” The court left for remand whether these plaintiffs satisfied either standard.

Why it matters. The practical effect is to shorten the wait before an insured can put an excess carrier to its position, in a state where towers run deep and exhaustion takes years. The clause likely to do the most work is the counterfactual one — coverage that would attach but for the excess insurer’s own bad-faith conduct — because it closes off the argument that a carrier can defeat a bad-faith claim by contributing to the delay that prevents exhaustion. For carriers writing excess in California, reserving and communication decisions made years before a layer is reached are now likelier to be examined in a live pleading. Most relevant to: risk and coverage counsel with layered programs, and insurers writing excess.

7. The NAIC’s AI examination supplement is a step from adoption.

The instrument formerly called the AI Systems Evaluation Tool is now the AI Risk Evaluation Supplement, and it is close to finished.¹³ The NAIC describes it as a guide for regulators — in market conduct, financial analysis, or financial examination settings — to gather information about the extent and use of AI in an insurer’s operations, its governance and risk-mitigation practices, potentially high-risk AI models, and the types of data used as inputs. Twelve states have been piloting it since March, running through September, across a mix of market conduct exams, financial exams, financial analyses, and more general regulatory inquiries. The working group’s chair reported that a revised version would be exposed for public comment in early September, with two exposure periods planned this fall and adoption targeted for the Fall National Meeting, November 14–17.¹⁴ Separately, 24 states and the District of Columbia have adopted the NAIC model bulletin on insurer use of AI as of the association’s August 6 adoption map, with California, Colorado, New York, and Texas regulating through their own instruments instead.¹⁵

Why it matters. This is the step from principles to examination. A model bulletin tells insurers to govern their AI; an examination supplement tells examiners what to ask for and what documentation to expect, which is where a governance program stops being described and starts being graded. Carriers using AI in underwriting, rating, claims, fraud detection, or marketing have a narrow window — two comment periods this fall — to influence what examiners are handed, and a shorter one to confirm that the model inventory, documentation, and risk-management records the supplement asks about exist in retrievable form. Most relevant to: insurance regulatory counsel and AI governance committees at carriers.

8. The federal review channel narrows for infrastructure. The Texas grid channel opens.

Two things are happening at once to large projects. On the federal side, the Council on Environmental Quality’s rescission of all its NEPA implementing regulations became final in January, adopting without change an interim rule that removed 40 C.F.R. Parts 1500 through 1508.¹⁶ Agencies have replaced them with their own procedures, and both Interior and Energy moved the bulk of theirs out of the Code of Federal Regulations entirely, into handbooks and guidance.¹⁷ Overlaying that, the Supreme Court held last year that courts owe agencies “substantial deference” in NEPA cases, that an agency need not analyze the effects of projects “separate in time or place” from the one before it, and that a deficient impact statement “may not necessarily require a court to vacate the agency’s ultimate approval of a project” — in an opinion whose list of what NEPA litigation has made scarcer expressly includes data centers.¹⁸ What remains is statutory, and it runs one way: the Fiscal Responsibility Act’s NEPA amendments still set document triggers, page limits, and deadlines, and give a project sponsor a petition when an agency misses one — with no corresponding cause of action for opponents.¹⁹ The provisions that would go furthest, including a 150-day limitations period and remand without vacatur as the only remedy, sit in a bill that passed the House in December and has not moved in the Senate. They are not law.²⁰ Meanwhile, in Texas: on August 3 the governor directed the Public Utility Commission and ERCOT to audit every data center advancing through the interconnection queue before any project proceeds, requiring disclosure of public financial assistance, on-site generation and projected consumption, water use and cooling technology, community-impact mitigation, and ownership — and stating that projects failing to comply “must be denied connection to the Texas grid.” ERCOT is processing roughly 474 gigawatts of interconnection requests, about 90 percent of them data centers.²¹

Why it matters. The accurate description is not that the courthouse doors have closed but that the channel has moved. Federal environmental review is narrower in scope, more deferential on review, and less likely to end in vacatur — while the state utility-regulatory channel, where interconnection, cost allocation, and now a gubernatorial audit sit, has become the place a project actually stops. That changes who the adversary is: not an environmental petitioner with standing problems, but a commission with a queue and a governor instructing it to say no. It also changes what diligence looks like, because a grid regulator asking about ownership structure and water sourcing is asking questions no environmental impact statement would surface. Most relevant to: energy and infrastructure counsel, and in-house teams siting large-load facilities.

Key dates

September 1, 2026 — Comments close on Colorado’s proposed revised bulletin on property and casualty insurers’ use of aerial imagery in underwriting and claims decisions. The revision would remove rating, extend the imagery window to eighteen months, and allow customer-provided photos as additional verification — an automated-decisioning question that arrives without the AI label.²²

September 9, 2026 — Bankruptcy court hearing on the Spirit data sale to Google (item 3), adjourned from August 19 after the flight attendants’ union objected.

September 14, 2026 — Rule 23 class certification motion due in the Workday AI hiring case (item 2). Opposition and Workday’s decertification motion are due November 10, with the certification hearing set for March 9, 2027.

September 22, 2026 — Comments close on the NAIC’s revised draft of its insurance information privacy model act, Model #672, exposed July 24 for sixty days.²³

September 25, 2026 — Written comments close on the proposed Trump Accounts employer-contribution regulations, REG-101355-26 — the deadline this brief has carried since Issue No. 1. The same date is the deadline to request to speak at the October 15 public hearing.²⁴

November 14–17, 2026 — NAIC Fall National Meeting, where the AI Risk Evaluation Supplement (item 7) is targeted for adoption after two fall exposure periods.

Pending, no date set — The Federal Circuit’s decision in the consolidated IEEPA tariff appeal, briefed since August 10 and still awaiting decision.