The Lyceum: Tech Policy & Regulation Weekly — Mar 26, 2026

A Los Angeles jury found Meta and YouTube liable for addicting a teenager — not for what was posted, but for how the platforms were designed. A day earlier, a New Mexico jury ordered Meta to pay $375 million for the same basic theory. Two verdicts in 48 hours using product-liability law to sidestep Section 230 are no longer an experiment; they are a litigation playbook. Meanwhile, lawmakers unveiled a high-profile data-center moratorium proposal, the FDA's gene therapy decision of the decade lands Friday, and a hard BIS export-control deadline is 18 days out with no grace period. This is a week where multiple regulatory clocks are ticking simultaneously — and several of them are about to go off.

On Tuesday, a Los Angeles jury found Meta and YouTube liable on all counts in a bellwether social media addiction trial, awarding roughly $3 million in compensatory damages and recommending an additional $3 million in punitive damages after finding "malice, oppression, or fraud," according to CNN. One day earlier, a New Mexico jury ordered Meta to pay $375 million in civil penalties for failing to protect children from predators on Instagram and Facebook, per NBC News.

The dollar amounts are modest. The legal theory is not. Both cases targeted platform design — infinite scroll, autoplay, push notifications, recommendation algorithms — rather than specific user content. That distinction matters enormously: Section 230 shields platforms from liability for content they host, but it doesn't protect them from claims that the product itself is defective. The plaintiffs treated Instagram and YouTube the way a plaintiff would treat a faulty medical device. The juries agreed.

What changes if this holds: every platform deploying AI-driven engagement optimization now carries product-liability exposure that Section 230 cannot block. A consolidated federal trial covering thousands of similar claims is set to begin this summer in the Northern District of California, per CNBC. The settlement math for that docket just changed dramatically. If appellate courts narrow or reverse these verdicts, the theory stalls — but the replicable template is already in the hands of plaintiffs' firms nationwide. Watch for post-trial motion rulings in both cases and whether California Attorney General Rob Bonta files amicus support.

Senator Bernie Sanders and Representative Alexandria Ocasio-Cortez unveiled a joint proposal on March 25, 2026, to pause all new large-scale data center construction until federal AI safeguards covering workers, consumers, the environment, and civil rights are in place, per Axios. The proposal also includes a provision most coverage missed: it would prohibit exports of advanced chips to countries without equivalent AI protections — which, today, would cover nearly all countries.

The proposal is unlikely to be enacted as written. The White House published a framework urging the opposite — streamlined federal permitting for AI infrastructure. Senator Mark Warner reportedly called parts of the proposal "idiocy" at an Axios event the same day. But the federal effort looks largely symbolic. Good Jobs First counted at least 12 state legislatures with active data center moratorium bills this session, per Common Dreams. State-level permitting is where data centers actually get built or blocked.

What changes if the political energy translates: state moratorium bills create real permitting risk for projects already in development queues in Virginia, Texas, and Georgia. If even two or three pass, hyperscalers face years of delay in those jurisdictions. The observable signal is whether any state moratorium bill clears a full chamber vote before summer recess. The federal proposal's value is as a menu of ideas — environmental review triggers, labor standards, export linkages — that states and cities can adopt piecemeal.

After April 13, 2026, any chip designer that hasn't submitted an application for "approved" IC designer status under BIS's Foundry Due Diligence Rule loses access to critical license exceptions — the AIA and ACM exceptions that allow advanced chip exports without individual licenses. No grace period. No comment period. Just a compliance cliff.

Before April 13, designers headquartered in allied countries automatically qualified as "authorized." After April 13, they must have applied and can only retain authorized status for 180 days while the application is pending, per WilmerHale. The exposure falls primarily on foundries and outsourced assembly firms (OSATs) that export to these designers — if a customer's status lapses and a supplier didn't verify it, an unlicensed export could occur.

Every TSMC, GlobalFoundries, and Samsung fab customer relationship affected by this rule needs a status check before April 13. BIS has also been widening export controls to quantum computing supply chains and advanced packaging substrates, per Kharon. The observable signal: whether BIS publishes clarifying guidance or an FAQ before the deadline, which compliance teams are counting on.

On March 20, 2026, the White House released a National Policy Framework for Artificial Intelligence urging Congress to preempt "unduly burdensome" state AI laws and route oversight through existing agencies — the FDA for health AI, the FTC for consumer protection, the FCC for communications — rather than creating a standalone federal AI regulator.

This is a non-binding blueprint, not legislation. It provides executive-branch policy language that the DOJ's AI Litigation Task Force could use to challenge state statutes. Colorado's AI Anti-Discrimination Law takes effect in June 2026. California's emerging liability framework is advancing. The framework essentially tells states: stand down, or expect federal pushback.

What changes if Congress acts on it: the 50-state compliance patchwork collapses into a single federal standard, dramatically simplifying governance for multinationals and reducing leverage for state attorneys general. If Congress ignores it — the more likely near-term outcome — the framework still shapes litigation arguments and settlement negotiations. Watch for whether draft bills based on the framework appear in April and for whether the DOJ Task Force files its first preemption lawsuit before Colorado's June effective date.

The FDA issued a notice of proposed rulemaking targeting deceptive drug advertising, with telehealth platforms, medical spas, and compounding pharmacies named as primary concerns. The agency wants to reverse a 1997 policy that allowed broadcast drug ads to include only the most important risk information with a reference to the full label — effectively proposing to wind the clock back nearly 30 years on how drug ads work.

The enforcement machine is already running hot. The Office of Prescription Drug Promotion has issued at least nine warning letters in 2026 as of March 9, putting it on pace for over 50 this year — compared to five in all of 2024, per Sidley Austin. ImmunityBio received a warning letter over Anktiva promotions in a TV ad and podcast, per FiercePharma.

The FDA announced it's deploying AI tools to proactively surveil drug ads, per the FDA's own press release. That could change the enforcement math — a compliant ad from 2023 that would never have triggered a letter under the old reactive posture could now generate action under automated scanning. If the final rule covers algorithmically personalized promotional content, it would be the first FDA rule with a direct AI-generated content obligation. Watch for the comment period deadline and whether the rule targets specific platforms.

A federal judge ruled this week that Epic Systems must face antitrust claims alleging it used monopoly power in the electronic health record market to harm rival businesses — specifically through API access restrictions and interoperability barriers that blocked competing clinical and AI tools from integrating with hospital systems.

Epic is the dominant EHR platform in U.S. hospitals. The plaintiff's theory — that a dominant platform has antitrust obligations around interoperability with AI and analytics tools — survived a motion to dismiss and is now headed to discovery. Early coverage frames this as a potential class-action lever to force open patient portals and data portability, per BenefitsPro.

This is early-stage litigation, not a verdict. But if the court eventually accepts the argument that an EHR monopolist can't wall off its data from competing AI tools, every hospital CIO and health AI startup needs to understand the implications. Watch for whether the DOJ or FTC files an amicus brief or statement of interest — that would signal federal antitrust interest in health IT interoperability as a broader enforcement theory.

The European Parliament and Council are actively negotiating the Digital Omnibus on AI — a package that would push back high-risk AI compliance deadlines to December 2027 for high-risk systems and August 2028 for product-embedded systems. Meanwhile, the current law's August 2, 2026 deadline for high-risk compliance remains binding.

The compliance problem is obvious: you cannot build your AI Act roadmap around deadline dates that are actively being renegotiated in trilogue. Companies that paused compliance work betting on delay are taking a real risk. Companies that did the work are positioned either way.

What failure looks like: the Omnibus stalls in trilogue, the original deadlines hold, and companies that assumed delay find themselves scrambling to meet an August 2026 deadline with six months of lost preparation time. The observable signal is whether the EU AI Office issues interim guidance acknowledging the legislative uncertainty — that itself would be a tell about enforcement posture.

The number that should be in your next board deck: U.S. tech companies are planning roughly 56 gigawatts of on-site natural gas generation for data centers, according to industry analysis circulating this week. That's the equivalent of dozens of large power plants tied directly to hyperscale facilities rather than the broader grid.

Pair that with a draft European Commission roadmap, leaked via Table Media, that envisions tripling EU data center capacity while treating them as controllable grid resources with explicit reporting and flexibility obligations. And a Federal Register filing that explicitly ties AI-driven data center build-out to rising household energy bills, framing data centers as a consumer-protection issue.

The transatlantic split is forming: Europe is drafting hard reporting and flexibility mechanisms; the U.S. debate is centered on permitting moratoria and ratepayer protections. Data center siting is quietly becoming a regulated infrastructure decision, not just a real estate play. Watch for FERC or NERC initiatives explicitly targeting "large flexible loads" or on-site generation.

A jury treating Instagram's infinite scroll like a defective brake pad. Bernie Sanders trying to shut down buildings that don't exist yet. The FDA using AI to catch drug ads while proposing rules about whether AI drug ads should exist. It was that kind of week.

Wikipedia just decided that humans have to write the encyclopedia about the species that built the machines that could write the encyclopedia — and somehow that's the most optimistic story here.

See you next week.

If someone on your team is still treating state AI laws as a federal-preemption problem that will solve itself, forward them this issue.