Tech Policy & Regulation Weekly — Jul 06, 2026

Two decisions this week rewired the machinery of regulation itself. The Supreme Court handed the president direct control over every independent agency in Washington — the FTC, SEC, FCC, and dozens more — by overturning a 90-year-old precedent, and quietly cast doubt on the FTC's power to write rules at all. Meanwhile, Europe's top court permanently upheld Google's €4.1 billion Android fine, converting a decade of litigation into a legally binding blueprint that rivals can now use to sue. If you built any compliance strategy around the idea that regulators act independently — or that a hard-fought antitrust win stops at the fine — this week moved the ground under you.

• UpDoc SaMD (UpDoc Inc.): On June 25, UpDoc announced FDA clearance for what it describes as the first Software as a Medical Device using a patient-facing large language model. In plain terms — an AI that talks directly to patients about their health, cleared by the FDA as a regulated medical product.
• Mills Review (UK Financial Conduct Authority): Published July 6, the FCA's commissioned review into AI in retail financial services — the regulator's first full blueprint for robo-advisers, AI lending, and automated claims handling.
• 2026 Regulatory Plan (White House OIRA): Released July 3, the Office of Information and Regulatory Affairs published its regulatory plan including an updated SEC rulemaking agenda, signaling which financial rules the administration intends to advance or shelve.

The FTC, SEC, and FCC were never truly independent. This week, the Supreme Court made that official.

On June 29, the Court ruled 6-3, along ideological lines, that President Trump had the authority to fire FTC Commissioner Rebecca Slaughter. According to CNBC, the Court held that the FTC's for-cause removal protections were unconstitutional — a subordinate who exercises the president's executive power is subject to removal by him — and in doing so overruled Humphrey's Executor, the 1935 case that had been the legal foundation for independent agencies for nine decades. FTC commissioners are now, effectively, at-will employees. NPR notes the ruling also guts Congress's requirement that the agency stay bipartisan.

The blast radius is what matters. Per Ogletree's analysis, the decision reaches directly to former NLRB member Gwynne Wilcox and former MSPB member Cathy Harris, both removed by Trump in early 2025 under similar protections. In dissent, Justice Sotomayor warned that "dozens of independent commissions are now likely to become purely executive agencies," naming FERC, the Consumer Product Safety Commission, and the Nuclear Regulatory Commission. Chief Justice Roberts pointedly carved out a possible shield for the Federal Reserve — a signal the Court is drawing lines, not detonating everything.

What changes: every agency that sets antitrust posture, clears mergers, polices markets, and licenses spectrum is now a direct instrument of the sitting president. The signal to watch: whether lower courts apply Slaughter to Wilcox and Harris — if they do, agency independence is effectively over across labor and federal-employee protection.

Eight years of litigation ended on July 2. The interesting part isn't the check Google has to write.

The Court of Justice of the European Union dismissed Google's final appeal, confirming the €4.1 billion penalty for the Android agreements that forced handset makers to pre-install Google Search, Chrome, and the Play Store while blocking rival systems. Per the Insurance Journal, the Commission's original €4.34 billion fine was trimmed to €4.1 billion by a lower tribunal in 2022. There is now no further appeal.

Here's the leverage. According to TechTimes, the final ruling activates the EU Antitrust Damages Directive — meaning the Commission's infringement finding becomes binding proof in follow-on civil suits across 13 EEA nations, with no ceiling on aggregate damages. Any competitor that lost business to Android bundling now has the hardest part of a damages case done for them. The Early Signals draft flags a second clock: the Digital Markets Act requires the Commission to issue binding Google compliance orders — including one on equal access for rival AI services in search — with findings due, and TechTimes reports a separate DMA fine described as the largest ever expected before August.

What changes: platform bundling is now a legally cemented template that regulators from London to Washington can copy against cloud and AI stacks. The signal: the first follow-on damages filings from browser and search rivals in member-state courts over the next 12 months.

Buried inside the same Trump v. Slaughter opinion is a second charge that got almost no attention.

In concurring opinions, Chief Justice Roberts and Justice Gorsuch cast doubt on whether the FTC can issue binding rules under its UDAP power — "Unfair or Deceptive Acts or Practices," the legal hook the agency uses for everything from junk-fee rules to data privacy to non-compete bans. If that authority is constitutionally shaky, a large chunk of the FTC's regulatory agenda becomes challengeable. (The Supreme Court Also Took a Swing at the FTC's Rulemaking Power)

This is a signal, not a holding. But in administrative law, doubts voiced by justices in the majority get litigated fast. What changes: any company sitting under a pending FTC rule now has a fresh argument to fight it. The signal to watch: industry groups filing challenges to the FTC's commercial-surveillance and data rulemaking, citing the Slaughter concurrences as grounds. (Supreme Court lets presidents fire independent regulators, rules for Trump in FT)

Signed in April, effective July 1, and easy to miss. That's exactly why you shouldn't.

Governor Abigail Spanberger's SB 338 amended the Virginia Consumer Data Protection Act to prohibit selling or offering for sale a consumer's precise geolocation data, defined as location within roughly a 1,750-foot radius — a buffer wide enough to obscure where people live, work, worship, and shop. Per Proskauer's New Media and Technology Law Blog, this replaces the old consent-based rule with an outright ban, putting Virginia alongside Maryland and Oregon. (Virginia Expands VCDPA with Ban on Sale of Precise Consumer Geolocation Data | N)

The catch, as Hunton notes, is that Virginia defines "sale" narrowly — only monetary exchanges — while Maryland and Oregon reach any exchange for "valuable consideration." That leaves a grey zone for ad-tech deals where value flows as free SDKs or analytics rather than cash. Consumer Reports reports California, Connecticut, Massachusetts, and Vermont are weighing similar bans. (Virginia Governor signs landmark location privacy bill into law)

What changes: downstream buyers of location datasets now need real source-of-data diligence and vendor representations, not just a consent checkbox. The signal: whether the Virginia Attorney General tests the "not-a-sale" edge cases — and whether any Northeast or West Coast state passes committee before recess, triggering a compliance cascade.

Clinical AI developers have spent two years asking the FDA where the door is. On June 25, the agency showed them.

UpDoc Inc. announced FDA clearance for what it describes as the first Software as a Medical Device — the regulatory category for software performing a medical function — built on a patient-facing large language model. The FDA has been cautious about AI that talks directly to patients, because the risk profile differs sharply from AI that merely assists clinicians. A cleared example establishes both a precedent and a pathway. (FDA Clears the First AI Chatbot as a Medical Device — and Opens a Regulatory Lan)

What changes: other developers now have a cleared comparator to point to, which is far better than operating in a gray zone where nobody knows if your product is a medical device. The signal: a wave of SaMD submissions from clinical AI companies.
What failure looks like: if the FDA treats this as a one-off rather than a lane, submissions stall and the industry retreats back into ambiguity.

A president who can now fire the referee mid-game, a €4.1 billion fine that spent eight years becoming a starter pistol for everyone Google ever beat, and an AI that will happily whisper your unreleased video titles to a stranger who edits a comment. The FTC spent decades building rules against deceptive practices, and its own Supreme Court just suggested it may never have had the power to write them — which is a hell of a deceptive practice to pull on yourself. That's the week. (The Supreme Court Also Took a Swing at the FTC's Rulemaking Power)

Forward this to the general counsel who still has "agency independence" written into a compliance memo — they'll want to update that paragraph. (FDA Clears the First AI Chatbot as a Medical Device — and Opens a Regulatory Lan)