Jul 21, 2026

|

Our newest Gemini mod­els de­liver the ef­fi­ciency, la­tency, and re­li­a­bil­ity to build AI agents at scale.

Your browser does not sup­port the au­dio el­e­ment.

Listen to ar­ti­cle

[[duration]] min­utes

This con­tent is gen­er­ated by Google AI. Generative AI is ex­per­i­men­tal

Developers and cus­tomers build­ing pro­duc­tion AI agents need higher to­ken ef­fi­ciency, lower la­tency, and more re­li­able per­for­mance. Our Flash se­ries of mod­els is built to meet the sweet spot of ef­fi­ciency and qual­ity to en­able scal­ing agen­tic work­flows. Building on Gemini 3.5 Flash, we’re in­tro­duc­ing new Gemini mod­els:

3.6 Flash: Our work­horse model that de­liv­ers bet­ter cod­ing, knowl­edge work, and mul­ti­modal per­for­mance. According to the Artificial Analysis Index, it re­duces out­put to­ken us­age by 17% com­pared to 3.5 Flash, and in some bench­marks like DeepSWE by Datacurve, we ob­serve up to 65%, all at a lower cost per out­put to­ken.

3.5 Flash-Lite: Our fastest, most cost-ef­fec­tive 3.5-class model, de­liv­er­ing 350 out­put to­kens per sec­ond ac­cord­ing to the Artificial Analysis Index, also sig­nif­i­cantly out­per­form­ing prior Flash-Lite gen­er­a­tions in agen­tic work­flows.

3.5 Flash Cyber in CodeMender: Successful cy­ber­se­cu­rity ap­pli­ca­tions re­quire care­ful or­ches­tra­tion of a model along­side an agent in­fra­struc­ture. We’re in­tro­duc­ing a com­bi­na­tion of a new, highly ef­fi­cient, spe­cial­ized cy­ber-fo­cused model paired with our CodeMender code se­cu­rity agent that de­liv­ers com­pet­i­tive per­for­mance at the fron­tier.

Beyond to­day’s re­leases, Gemini 3.5 Pro is cur­rently test­ing with part­ners and we plan to make it broadly avail­able as soon as it’s ready. In par­al­lel, our team is al­ready fo­cus­ing on build­ing the next gen­er­a­tion of mod­els. We have started our most am­bi­tious pre-train­ing run yet, for Gemini 4, and are ex­cited by the progress.

3.6 Flash: More ef­fi­cient and bet­ter qual­ity than 3.5 Flash

Gemini 3.6 Flash builds di­rectly on de­vel­oper and cus­tomer feed­back from 3.5 Flash. 3.6 Flash not only de­liv­ers a step up in cod­ing and knowl­edge work, but it does this while mean­ing­fully im­prov­ing to­ken ef­fi­ciency. For ex­am­ple, on the Artificial Analysis Index, we see 3.6 Flash con­sum­ing 17% fewer out­put to­kens than 3.5 Flash. It also takes fewer rea­son­ing steps and tool calls to ac­com­plish multi-step work­flows.

This en­hanced ef­fi­ciency is also com­bined with a lower price than 3.5 Flash. At $1.50/1M in­put to­kens and $7.50/1M out­put to­kens, 3.6 Flash re­duces the over­all cost per agen­tic task, mak­ing agents more cost-ef­fec­tive to build and run.

3.6 Flash shows bet­ter to­ken ef­fi­ciency and re­duced ver­bosity than 3.5 Flash in an OSWorld ver­i­fied task (API)

Even while be­ing more ef­fi­cient, 3.6 Flash sees per­for­mance gains com­pared to 3.5 Flash across use cases:

3.6 Flash de­liv­ers higher pre­ci­sion with fewer un­wanted code ed­its and re­duced ex­e­cu­tion loops, as seen in DeepSWE (49% vs. 37%), and shows sig­nif­i­cant im­prove­ment in ML Research, as seen in MLE Bench (63.9% vs. 49.7%).

It has im­proved com­puter use ca­pa­bil­i­ties as seen in OSWorld-Verified (83.0% vs. 78.4%). Computer use is now a built-in client side tool via the Gemini API and Gemini Enterprise.

It out­per­forms 3.5 Flash in knowl­edge work, as shown by bench­marks like GDPval-AA v2 (1421 vs. 1349). Customers like Hebbia and Harvey have found it par­tic­u­larly ca­pa­ble at mul­ti­modal tasks like doc­u­ment pars­ing, chart and data analy­sis, and re­port draft­ing.

Customers re­port 3.6 Flash is a step for­ward in both cost and qual­ity, bal­anc­ing to­ken ef­fi­ciency, ac­cu­racy, and speed across com­plex work­flows and knowl­edge-based tasks:

Built with safety

3.6 Flash is ship­ping with en­hanced Frontier Safety safe­guards in the do­mains of Chemical, Biological, Radiological, and Nuclear (CBRN) and cy­ber of­fense mis­uses. These safe­guards make the model sub­stan­tially more re­sis­tant to jail­breaks. At the same time, the model has been trained to min­i­mize re­fusals for ben­e­fi­cial uses.

For more in­for­ma­tion, see the 3.6 Flash model card.

3.5 Flash-Lite: Built to scale agen­tic work­flows

Beyond Flash, we’re also re­leas­ing Gemini 3.5 Flash-Lite, de­signed for both low-la­tency tasks and tasks where high through­put is crit­i­cal for de­vel­op­ers work­flows, like agen­tic search and doc­u­ment pro­cess­ing.

3.5 Flash-Lite is the fastest model in the 3.5 se­ries. As mea­sured by Artificial Analysis, it runs at 350 out­put to­kens/​s. Priced at $0.3/1M in­put to­kens and $2.5/1M out­put to­kens and with sig­nif­i­cantly bet­ter qual­ity than 3.1 Flash-Lite, 3.5 Flash-Lite of­fers a strong price-to-per­for­mance ra­tio for de­vel­op­ers and cus­tomers run­ning high through­put pro­duc­tion traf­fic.

3.5 Flash-Lite ex­e­cutes high vol­ume tasks at a lower la­tency than 3.5 Flash.

3.5 Flash-Lite en­ables ef­fi­cient scal­ing for agen­tic sys­tems. Across think­ing lev­els, the model sig­nif­i­cantly out­per­forms 3.1 Flash-Lite. Depending on the work­load, de­vel­op­ers can con­fig­ure the model to pri­or­i­tize low-la­tency, low-cost ex­e­cu­tion for high-vol­ume tasks with the min­i­mal and low think­ing lev­els, or en­gage higher think­ing lev­els to process multi-step sub­agent work­loads. The model now also has com­puter use as a built-in tool to re­li­ably sup­port these agen­tic tasks across sur­faces.

It’s a sig­nif­i­cant step up in cod­ing and agen­tic tasks as seen in Terminal-Bench 2.1 (54% vs 31%), long con­text as seen in GDM-MRCR v2 (72.2% vs. 60.1%), and real-world task ex­e­cu­tion as seen in GDPval-AA v2 (1140 vs. 642).

In fact, on many agen­tic and cod­ing evals, 3.5 Flash-Lite even out­per­forms 3 Flash, in­clud­ing on SWE-Bench Pro (54.2% vs. 49.6%) and OSWorld-Verified (74.0% vs. 65.1%), mak­ing it a faster & more ca­pa­ble op­tion for work­loads on both 2.5 and 3 Flash.

Early cus­tomers of 3.5 Flash-Lite are high­light­ing its unique com­bi­na­tion of speed, in­tel­li­gence, and cost ef­fi­ciency for scal­ing agen­tic work­flows and data pro­cess­ing tasks:

For more in­for­ma­tion about the model, see the 3.5 Flash-Lite model card.

3.5 Flash Cyber in CodeMender: find­ing and fix­ing vul­ner­a­bil­i­ties ef­fi­ciently

AI mod­els have be­come ca­pa­ble of find­ing se­cu­rity vul­ner­a­bil­i­ties faster than cur­rent sys­tems can fix them. Tackling this grow­ing threat re­quires an ap­proach to se­cur­ing soft­ware that is highly ca­pa­ble and ef­fi­cient.

Flash’s per­for­mance and ef­fi­ciency makes it an ideal foun­da­tion to de­tect, val­i­date, and patch code se­cu­rity is­sues at scale. Gemini 3.5 Flash Cyber is built on top of 3.5 Flash, and fine-tuned for find­ing and fix­ing cy­ber­se­cu­rity vul­ner­a­bil­i­ties at a lower price per to­ken than larger mod­els.

Within CodeMender, which uses mul­ti­ple 3.5 Flash Cyber agents work­ing to­gether to pro­duce a sin­gle com­bined re­port, 3.5 Flash Cyber reaches com­pet­i­tive per­for­mance at the fron­tier on the pop­u­lar bench­mark CyberGym.

Given the dual-use na­ture of this tech­nol­ogy, we have taken an in­ten­tional ap­proach to de­ploy­ing 3.5 Flash Cyber. The model will be ex­clu­sively avail­able to gov­ern­ments and trusted part­ners via CodeMender soon as part of a lim­ited-ac­cess pi­lot pro­gram. This will give front­line de­fend­ers a head start in find­ing and fix­ing crit­i­cal vul­ner­a­bil­i­ties be­fore they can be ex­ploited, while mit­i­gat­ing against broader mis­use.

3.6 Flash and 3.5 Flash-Lite: Get started to­day

3.6 Flash and 3.5 Flash-Lite are avail­able start­ing to­day:

For de­vel­op­ers in the Gemini API via Google AI Studio and Android Studio. 3.6 Flash is also avail­able in Google Antigravity. Get started with the Developer Guide.

For en­ter­prises in Gemini Enterprise Agent Platform. 3.6 Flash is also avail­able in the Gemini Enterprise app.

For every­one via the Gemini app. 3.5 Flash-Lite is also rolling out in Google Search.

As you start build­ing with 3.6 Flash and 3.5 Flash-Lite, we wel­come your feed­back to im­prove fu­ture Gemini mod­els and look for­ward to re­leas­ing 3.5 Pro soon.

Get the lat­est news from Google in your in­box

Sign up for our newslet­ters with prod­uct up­dates, event in­for­ma­tion, spe­cial of­fers, and more.

Your in­for­ma­tion will be used in ac­cor­dance with Google’s pri­vacy pol­icy. You may opt out at any time.

VPN providers aren’t li­able for copy­right in­fringe­ment, said the EU Court

The Court ex­plic­itly rec­og­nized VPNs as “lawful tech­ni­cal tools”

The case cen­tered on the copy­right bat­tle in­volv­ing Anne Frank’s di­ary

In a ma­jor vic­tory for dig­i­tal rights and com­mon sense, the Court of Justice of the European Union (CJEU) has of­fi­cially cat­e­go­rized Virtual Private Networks (VPNs) as “lawful tech­ni­cal tools” while es­tab­lish­ing new bound­aries for on­line copy­right dis­putes.

The land­mark judg­ment — handed down in July 2026 — stems from a com­plex le­gal bat­tle over the on­line pub­li­ca­tion of Anne Frank’s his­tor­i­cal man­u­scripts. At its core, the case forced Europe’s top judges to an­swer a highly tech­ni­cal ques­tion: if a pub­lisher ac­tively tries to block vis­i­tors from a spe­cific coun­try, are they still break­ing the law if a user sneaks past the dig­i­tal bor­der us­ing cir­cum­ven­tion soft­ware?

According to the CJEU, the an­swer is no. As long as a web­site em­ploys “state-of-the-art” geo-block­ing tech­nol­ogy, the pub­lisher can­not be held li­able for copy­right in­fringe­ment sim­ply be­cause a de­ter­mined reader de­cides to fire up the best VPN to by­pass the re­stric­tions.

The rul­ing sets a mas­sive prece­dent. It con­firms that copy­right hold­ers can­not point to the mere ex­is­tence of VPNs to claim a web­site’s se­cu­rity mea­sures are com­pletely in­ef­fec­tive.

More im­por­tantly for pri­vacy ad­vo­cates, the court firmly pushed back against the de­mo­niza­tion of pri­vacy soft­ware, ce­ment­ing the le­git­i­mate sta­tus of VPN providers across the European Union.

The Anne Frank dis­pute ex­plained

The EU’s top court just con­firmed: Geo-blocking is the copy­right hold­er’s prob­lem, not the VPN’s. Providers are not li­able for users by­pass­ing re­stric­tions ⚖️ @torrentfreak https://​t.co/​fLw­b5kYAy1July 17, 2026

The EU’s top court just con­firmed: Geo-blocking is the copy­right hold­er’s prob­lem, not the VPN’s. Providers are not li­able for users by­pass­ing re­stric­tions ⚖️ @torrentfreak https://​t.co/​fLw­b5kYAy1July 17, 2026

The le­gal tug-of-war be­gan when a coali­tion of Dutch and Belgian aca­d­e­mic in­sti­tu­tions pub­lished a free, schol­arly on­line edi­tion of Anne Frank’s man­u­scripts.

Because copy­right laws are not fully har­mo­nized across Europe, the le­gal sta­tus of the fa­mous di­ary varies by ter­ri­tory. In Belgium and roughly 60 other coun­tries, the writ­ings en­tered the pub­lic do­main years ago. However, in the Netherlands, parts of the text re­main pro­tected by copy­right un­til 2037.

To re­spect this ter­ri­to­r­ial di­vide, the pub­lish­ers hosted the site in Belgium and used geo-block­ing to pre­vent ac­cess from Dutch IP ad­dresses. Visitors from the Netherlands were met with a no­tice ex­plain­ing why they could­n’t en­ter the site.

The Anne Frank Fonds, which holds the Dutch copy­right, sued. They ar­gued that be­cause stan­dard VPNs eas­ily al­low users to mask their true IP ad­dress and spoof a Belgian lo­ca­tion, the schol­arly web­site was ef­fec­tively com­mu­ni­cat­ing the pro­tected work to the Dutch pub­lic.

The CJEU ul­ti­mately re­jected this ar­gu­ment. In its judg­ment, the court noted that while geo-block­ing mea­sures can in­evitably be cir­cum­vented, “the pos­si­bil­ity of such cir­cum­ven­tion can­not, in it­self and in all cir­cum­stances, be a de­ci­sive fac­tor in find­ing those mea­sures to be in­ad­e­quate and, there­fore, in­ef­fec­tive.”

Why this mat­ters for the in­ter­net and VPN users

For every­day in­ter­net users, the “So What?” of this rul­ing is deeply re­as­sur­ing. It val­i­dates that us­ing a VPN to en­crypt your on­line traf­fic, hide your IP ad­dress, or by­pass dig­i­tal bor­ders is a le­git­i­mate use of con­sumer tech­nol­ogy.

The judges ex­plic­itly shielded VPN com­pa­nies from col­lat­eral dam­age in piracy law­suits, a topic that has sparked in­tense de­bate among European ISPs and right­sh­old­ers. The court specif­i­cally ar­gued that the provider of a VPN or sim­i­lar ser­vices is not li­able for users by­pass­ing re­stric­tions.

By plac­ing the le­gal bur­den on pub­lish­ers to main­tain “state-of-the-art” dig­i­tal fences, rather than de­mand­ing ab­solute, im­pos­si­ble per­fec­tion, the EU has drawn a prag­matic line in the sand.

Publishers aren’t ex­pected to build un­hack­able walls, and VPN providers aren’t re­spon­si­ble for the ac­tions of users who climb over them. Ultimately, this rul­ing proves that the bor­der­less in­ter­net can still co­ex­ist with ter­ri­to­r­ial copy­right laws, pro­vided every­one uses the right tech­ni­cal safe­guards.

Follow TechRadar on Google News and add us as a pre­ferred source to get our ex­pert news, re­views, and opin­ion in your feeds. Make sure to click the Follow but­ton!

K3 is a fron­tier qual­ity open model at a frac­tion of the cost. Even big­ger is that it com­ple­ments Fable pre­dictably, which makes it pos­si­ble to get the high­est qual­ity in­tel­li­gence by rout­ing tasks.

🧭 tl;dr: We ran Kimi K3 (open) against Fable 5 (closed) on ~1,000 agen­tic tasks find­ing:

We achieved 93% ac­cu­racy with rout­ing be­tween K3 and Fable.

Results were up to ~50X more cost ef­fec­tive than Fable alone on long agen­tic loops, and con­sis­tently lower cost across every use case.

How We Measured

We av­er­aged bench­marks, each aimed at a dif­fer­ent kind of work, and ran K3 and Fable 5 through the same har­ness. About 1,030 tasks in all, in real agent loops.

One quick de­f­i­n­i­tion be­fore we get into the re­sults. Oracle rout­ing is a method for mea­sur­ing the best the­o­ret­i­cal per­for­mance by run­ning the task through each model and then pick­ing the cheap­est cor­rect op­tion (the cost/​per­for­mance ceil­ing). In a prac­ti­cal router, you don’t get to run your task against mul­ti­ple mod­els. The router makes a pre­dic­tion of which model has the best cost and qual­ity trade off, but ul­ti­mately it’s a guess.

In this study, or­a­cle rout­ing demon­strated K3 is se­lected for 72 – 96% of tasks. This sug­gests a near-per­fect router might be achiev­able, by learn­ing the dif­fer­ence be­tween day-to-day tasks and the true long tail of fron­tier work. It will re­quire an or­der of mag­ni­tude more rout­ing data, and real world per­for­mance to say de­fin­i­tively.

K3 is a good model.

From a 10,000 foot view, it can be easy to look at both mod­els and call the head-to-head a tie. For ex­am­ple, if you look at SWE, the head­line bench­mark, K3 gets 92.4%, Fable 92.6%. Across the five types of tasks we bench­marked on, the two mod­els tend to stay within a few points of each other, with Fable pulling slightly ahead on its cod­ing-lan­guage breadth (Multi-lang).

It’s easy to stop there and say “they’re roughly even”. The news is that they have dis­cretely bet­ter per­for­mance across dif­fer­ent task types.

Two Models is Better than One

If you take a peek in­side a sin­gle bench­mark, there’s more to see than just a top-line ac­cu­racy num­ber. Take SWE, where the two are dead even over­all. If you split SWE by prob­lem do­main you can see where each model shines. K3 is sharpest on sym­bolic math and dev tool­ing; Fable wins on web & data vi­su­al­iza­tion work. The same pat­tern runs through the multi-lan­guage set, where Fable’s breadth car­ries Java, Python and C++, while K3 draws even on JavaScript and Rust.

For long-hori­zon work at a ter­mi­nal, dri­ving a shell and prod­ding at sys­tems across dozens of turns, K3 showed its true col­ors. It cleared a batch of tasks Fable never cracked: a 7z hash, FEAL crypt­analy­sis, leaked se­crets, a live vul­ner­a­bil­ity, run­away async jobs.

K3 can be up to 50x lower cost on Fireworks. 🫳🎤

While qual­ity is a near-tie at a high level, price is­n’t close.

So where’s this huge price gap com­ing from? to­ken pric­ing, prompt caching, and ef­fort-per-task. On SWE for ex­am­ple, K3 works much harder than Fable: roughly 55 turns and 1.3M to­kens a task ver­sus 21 turns and 130K. On the long ter­mi­nal tasks it’s the other way around: Fable is the one that spi­rals, run­ning up 64 turns and 1.5M to­kens (sometimes straight into a time­out).

Prompt caching does most of the work of turn­ing that ef­fort into K3′s price ad­van­tage: even when K3 reads ten times the to­kens, with cache hits that means that SWE runs still come in lower cost than Fable. There’s a trade­off. Tasks with ex­tra turns gen­er­ally mean more wall-clock time per run i.e. slower runs. If you need an an­swer in two sec­onds, that mat­ters; if you’re run­ning agents in the back­ground at scale, a bill that’s a frac­tion of the size mat­ters a lot more.

Don’t pick a model. Route.

If you send every task to who­ever han­dles it best, you don’t land some­where be­tween the two mod­els, you land above both.

Per-task rout­ing al­ways out per­forms any sin­gle model run:

The or­a­cle router choose K3, 72 – 96% of task traf­fic. By ar­chi­tect­ing a router this way, you end up with over­all qual­ity above ei­ther model alone at a cost close to just us­ing just the cost-op­ti­mized one.

K3 is cost op­ti­mized on all work types

Put both qual­ity and cost on one plot. K3 in blue lands to the left (the more cost-ef­fec­tive side) of Fable in red in all five task-fam­i­lies. Accuracy trades back and forth: Fable pulls ahead on multi-lan­guage, K3 on ter­mi­nal and le­gal, the rest roughly level.

Single Models Are Wasteful and No Longer SoTA

Kimi K3 + Fable routed to­gether un­locks their best qual­i­ties at the best price.

The sin­gle model provider, to­ken maxxing days, are com­ing to an end. The task-level data says these mod­els are spe­cial­ists at very dif­fer­ent prices. The best AI no longer comes out of a sin­gle lab, it’s a mix­ture of mod­els.

What this means in prac­tice:

Open as the de­fault. A 50x lower cost open model like K3 should be your base case, since the or­a­cle sends it most of the traf­fic any­way.

The router is your moat. A router must be tai­lored to your work­load and learn­ing that task/​model split con­tin­u­ously is the best chance you’ll have at stay­ing ahead.

This case in­volves Apple’s han­dling of user-up­loaded files hosted in pri­vate iCloud stor­age. Instead of adopt­ing PhotoDNA to scan hosted files for CSAM, Apple cre­ated its own pro­pri­etary al­ter­na­tive, NeuralHash, which ap­par­ently was­n’t as good. So Apple U-turned on its ef­forts to scan for CSAM in its cloud stor­age. Instead, Apple im­ple­mented end-to-end en­cryp­tion for iCloud files.

Apple’s manuev­ers con­fused the pub­lic and seemed like an em­bar­rass­ing un­forced er­ror for Apple. It also en­sured pres­sure from gov­ern­ments and plain­tiffs, in­clud­ing CSAM vic­tims, who pre­ferred Apple’s more in­ter­ven­tion­ist ap­proaches, which Apple had vol­un­tar­ily demon­strated it was will­ing to do.

This law­suit rep­re­sents a full-scale at­tack on Apple and Section 230. “Plaintiffs al­lege that Apple’s fail­ure to im­ple­ment any known CSAM de­tec­tion is a de­sign de­fect be­cause Apple can safely im­ple­ment read­ily avail­able fea­tures to pre­vent the spread of known CSAM but has con­tin­u­ously failed to do so.” Prior blog post. The court dis­misses the third amended com­plaint, which tees this case up for the Ninth Circuit, where (as usual) any­thing could hap­pen.

* * *

The court re­it­er­ates that Section 230 ap­plies to the plain­tiffs’ claims:

First, Plaintiffs’ claims treat Apple as a pub­lisher or speaker of the CSAM con­tent that an­i­mates Plaintiffs’ in­juries. Fundamentally, Plaintiffs con­tend that Apple has elected to per­mit users to dis­sem­i­nate and share third-party CSAM con­tent when it could have—and, in their view, should have—used read­ily avail­able tech­nol­ogy to pre­vent the dis­tri­b­u­tion of child pornog­ra­phy de­pict­ing the Plaintiffs in this pu­ta­tive class. The du­ties Plaintiffs seek to in­voke “spring[ ] from the de­fen­dan­t’s sta­tus as pub­lisher,” and con­se­quently, “immunity ap­plies.” Second, im­mu­nity also ap­plies be­cause “the means to avoid li­a­bil­ity re­quires [Apple] to act as a pub­lisher.” As a re­sult, Apple is en­ti­tled to com­plete im­mu­nity un­der § 230.

First, Plaintiffs’ claims treat Apple as a pub­lisher or speaker of the CSAM con­tent that an­i­mates Plaintiffs’ in­juries. Fundamentally, Plaintiffs con­tend that Apple has elected to per­mit users to dis­sem­i­nate and share third-party CSAM con­tent when it could have—and, in their view, should have—used read­ily avail­able tech­nol­ogy to pre­vent the dis­tri­b­u­tion of child pornog­ra­phy de­pict­ing the Plaintiffs in this pu­ta­tive class. The du­ties Plaintiffs seek to in­voke “spring[ ] from the de­fen­dan­t’s sta­tus as pub­lisher,” and con­se­quently, “immunity ap­plies.” Second, im­mu­nity also ap­plies be­cause “the means to avoid li­a­bil­ity re­quires [Apple] to act as a pub­lisher.” As a re­sult, Apple is en­ti­tled to com­plete im­mu­nity un­der § 230.

Citing Doe 1 v. Meta, the court says:

Plaintiffs’ in­juries are the di­rect re­sult of the ac­tions of third par­ties who used iCloud to share CSAM, a use Apple nei­ther ex­plic­itly con­dones nor pre­vents (even as­sum­ing—as al­leged in the TAC—that Apple was aware of the use of iCloud for this pur­pose)….though Plaintiffs al­lege that Apple knew that its tools were likely to be used to dis­trib­ute child pornog­ra­phy (as con­firmed by the in­ter­nal Apple text mes­sages at the cen­ter of this case), un­der the cur­rent state of the law, Apple is still en­ti­tled to im­mu­nity un­der § 230—irrespective of that gen­eral knowl­edge…. Plaintiffs can­not avoid the fact that a tool that de­tects CSAM must re­view CSAM to make such a de­ter­mi­na­tion. And while Apple could have taken steps to do so—as its com­peti­tors have done by us­ing PhotoDNA—Grindr con­firms that § 230 bars claims aris­ing from the de­sign de­ci­sions Apple could have taken where those claims re­late to Apple’s role fa­cil­i­tat­ing the com­mu­ni­ca­tion and con­tent of oth­ers

Plaintiffs’ in­juries are the di­rect re­sult of the ac­tions of third par­ties who used iCloud to share CSAM, a use Apple nei­ther ex­plic­itly con­dones nor pre­vents (even as­sum­ing—as al­leged in the TAC—that Apple was aware of the use of iCloud for this pur­pose)….though Plaintiffs al­lege that Apple knew that its tools were likely to be used to dis­trib­ute child pornog­ra­phy (as con­firmed by the in­ter­nal Apple text mes­sages at the cen­ter of this case), un­der the cur­rent state of the law, Apple is still en­ti­tled to im­mu­nity un­der § 230—irrespective of that gen­eral knowl­edge….

Plaintiffs can­not avoid the fact that a tool that de­tects CSAM must re­view CSAM to make such a de­ter­mi­na­tion. And while Apple could have taken steps to do so—as its com­peti­tors have done by us­ing PhotoDNA—Grindr con­firms that § 230 bars claims aris­ing from the de­sign de­ci­sions Apple could have taken where those claims re­late to Apple’s role fa­cil­i­tat­ing the com­mu­ni­ca­tion and con­tent of oth­ers

(A re­minder that the de­fen­dan­t’s sci­en­ter is ir­rel­e­vant to Section 230).

The plain­tiffs tried to fit into the new Section 230 ex­cep­tions cre­ated in Doe v. Twitter, but the court re­buffs the move:

This case does not con­cern or even dis­cuss Apple’s con­tent re­port­ing sys­tems; it con­cerns Apple’s “failure to im­ple­ment in­dus­try-stan­dard safe­guards” against the dis­sem­i­na­tion of CSAM. Though re­port­ing sys­tems and CSAM safe­guards may both be de­scribed as “defects,” the lat­ter re­quires the Court to treat Apple as a pub­lisher. Twitter “could ful­fill its pur­ported duty to cure re­port­ing in­fra­struc­ture de­fi­cien­cies with­out mon­i­tor­ing, re­mov­ing, or in any way en­gag­ing with third-party con­tent”; Apple can­not ful­fill a duty to in­sti­tute CSAM safe­guards with­out de­ploy­ing a tool like NeuralHash or PhotoDNA. Both NeuralHash and PhotoDNA were built to mon­i­tor and re­port vi­ola­tive im­ages up­loaded to com­pany servers. Yet just the de­ci­sion re­gard­ing whether to de­ploy ei­ther tool is a choice re­lated to con­tent mod­er­a­tion.

This case does not con­cern or even dis­cuss Apple’s con­tent re­port­ing sys­tems; it con­cerns Apple’s “failure to im­ple­ment in­dus­try-stan­dard safe­guards” against the dis­sem­i­na­tion of CSAM. Though re­port­ing sys­tems and CSAM safe­guards may both be de­scribed as “defects,” the lat­ter re­quires the Court to treat Apple as a pub­lisher. Twitter “could ful­fill its pur­ported duty to cure re­port­ing in­fra­struc­ture de­fi­cien­cies with­out mon­i­tor­ing, re­mov­ing, or in any way en­gag­ing with third-party con­tent”; Apple can­not ful­fill a duty to in­sti­tute CSAM safe­guards with­out de­ploy­ing a tool like NeuralHash or PhotoDNA. Both NeuralHash and PhotoDNA were built to mon­i­tor and re­port vi­ola­tive im­ages up­loaded to com­pany servers. Yet just the de­ci­sion re­gard­ing whether to de­ploy ei­ther tool is a choice re­lated to con­tent mod­er­a­tion.

Also, Apple did­n’t fail to sat­isfy any duty to re­port items to NCMEC if it never iden­ti­fied CSAM in the first place.

The Lemmon v. Snap workaround fails: “all of Plaintiffs’ claims here are in­ex­orably linked to third-party con­tent; Plaintiffs do not al­lege that Apple cre­ated con­tent like a Snapchat fil­ter that caused them harm.” The Roommates.com workaround also fails: “Plaintiffs do not al­lege that Apple mod­i­fied or aug­mented the CSAM on its servers in any way.”

* * *

The case reaches its in­evitable de­noue­ment of a win for Apple. However, Judge Wise re­mains trou­bled about its im­pli­ca­tions. She ex­presses her un­easi­ness in stronger-than-nor­mal terms:

As it stands, noth­ing in the law pre­vents any com­pany, in­clud­ing Apple, from uti­liz­ing avail­able tech­nol­ogy or cre­at­ing new tech­nol­ogy to iden­tify and re­port child pornog­ra­phy stored and dis­trib­uted on their tra­di­tional servers or through their cloud ser­vices. Conversely, there is no law that ob­lig­ates com­pa­nies to proac­tively do so. Undoubtedly any such leg­is­la­tion would come at a cost of at least some loss of pri­vacy for mil­lions of peo­ple. But if law­mak­ers ex­pected that com­pa­nies would take steps to pre­vent their prod­ucts from be­ing used for stor­ing and dis­trib­ut­ing child pornog­ra­phy based on some­thing short of a le­gal im­per­a­tive, this case, like many oth­ers be­fore it, demon­strates the in­ad­e­quacy of that ap­proach. If law­mak­ers want to en­sure that Apple and other com­pa­nies ad­dress their role in the dis­sem­i­na­tion of CSAM, they must re­quire it un­der the law. In other words, law­mak­ers can fix this prob­lem that is con­tribut­ing to the ex­ploita­tion of chil­dren.

As it stands, noth­ing in the law pre­vents any com­pany, in­clud­ing Apple, from uti­liz­ing avail­able tech­nol­ogy or cre­at­ing new tech­nol­ogy to iden­tify and re­port child pornog­ra­phy stored and dis­trib­uted on their tra­di­tional servers or through their cloud ser­vices. Conversely, there is no law that ob­lig­ates com­pa­nies to proac­tively do so. Undoubtedly any such leg­is­la­tion would come at a cost of at least some loss of pri­vacy for mil­lions of peo­ple. But if law­mak­ers ex­pected that com­pa­nies would take steps to pre­vent their prod­ucts from be­ing used for stor­ing and dis­trib­ut­ing child pornog­ra­phy based on some­thing short of a le­gal im­per­a­tive, this case, like many oth­ers be­fore it, demon­strates the in­ad­e­quacy of that ap­proach. If law­mak­ers want to en­sure that Apple and other com­pa­nies ad­dress their role in the dis­sem­i­na­tion of CSAM, they must re­quire it un­der the law. In other words, law­mak­ers can fix this prob­lem that is con­tribut­ing to the ex­ploita­tion of chil­dren.

She goes through this fram­ing pretty quickly, but we should slow it down. The “loss of pri­vacy for mil­lions of peo­ple” she briefly ref­er­ences de­serves a lit­tle more care. The opin­ion down­plays the en­cryp­tion an­gle; it men­tions en­cryp­tion only twice, as if it’s an af­ter­thought. However, en­cryp­tion is the crit­i­cal at­tribute un­der­ly­ing Apple’s moves. Forcing Apple to scan for CSAM in iCloud means break­ing end-to-end en­cryp­tion for every­one and all pur­poses, in­clud­ing: male­fac­tors who would in­ter­cept pri­vate files for crim­i­nal pur­poses; and gov­ern­ment ac­tors who have re­peat­edly shown that they will break into, dis­trib­ute, and weaponize pri­vately stored file caches (I was just think­ing about the North Korea Sony hack. Remember it?).

So yes, the “privacy loss” Judge Wise men­tions in­deed would be a ma­jor cost to every­one. Worse, it would en­sure new vic­tims have their sen­si­tive, pri­vate, or abu­sive im­ages non­con­sen­su­ally in­ter­cepted and dis­sem­i­nated. (Do you re­call the Fappening and Snappening?) End-to-end en­cryp­tion is­n’t just some nice-to-have fea­ture; it is one of the core planks of a tech­nol­ogy ar­chi­tec­ture that keeps peo­ple safer.

Judge Wise con­tin­ues:

This Order does not turn on whether Apple’s de­ci­sions con­tributed to Plaintiffs’ in­juries. All Plaintiffs’ claims are founded on Apple serv­ing as a pub­lisher of third-party con­tent. It is that role as “publisher” that is dis­pos­i­tive on the is­sue of im­mu­nity. This does not mean that the ex­is­tence of im­ages and videos of the pu­ta­tive class mem­bers be­ing sex­u­ally abused—con­tent that they al­lege is reg­u­larly stored and dis­sem­i­nated on iCloud—has not caused Plaintiffs real and last­ing harm… the out­come also adds cre­dence to claims that the Ninth Circuit “has ex­panded § 230(c)’s scope to pro­vide func­tional im­mu­nity to in­ter­net com­pa­nies, even when they are aware (or should be aware) of un­law­ful con­tent on their web­sites.” The prac­ti­cal out­come is that the cur­rent state of the law pri­or­i­tizes pri­vacy—a laud­able and crit­i­cally im­por­tant value given that in our mod­ern world nearly all our most per­sonal and in­ti­mate data (including fi­nan­cial and health records) are stored and trans­mit­ted on­line. But the law should not ig­nore how those who cre­ate, view, and dis­trib­ute child pornog­ra­phy lever­age pri­vacy pro­tec­tions to avoid de­tec­tion by law en­force­ment. In the cur­rent le­gal frame­work, there is no pro­tec­tion for mem­bers of the pu­ta­tive class—in­di­vid­u­als who as chil­dren were pho­tographed and filmed while be­ing abused in the vilest ways imag­in­able, and who now are re­peat­edly vic­tim­ized each time the in­ti­mate and tor­tured im­ages of their trauma are dis­trib­uted to oth­ers. Those chil­dren are the col­lat­eral dam­age of our in­ef­fec­tive le­gal land­scape. They de­serve bet­ter.

This Order does not turn on whether Apple’s de­ci­sions con­tributed to Plaintiffs’ in­juries. All Plaintiffs’ claims are founded on Apple serv­ing as a pub­lisher of third-party con­tent. It is that role as “publisher” that is dis­pos­i­tive on the is­sue of im­mu­nity. This does not mean that the ex­is­tence of im­ages and videos of the pu­ta­tive class mem­bers be­ing sex­u­ally abused—con­tent that they al­lege is reg­u­larly stored and dis­sem­i­nated on iCloud—has not caused Plaintiffs real and last­ing harm…

the out­come also adds cre­dence to claims that the Ninth Circuit “has ex­panded § 230(c)’s scope to pro­vide func­tional im­mu­nity to in­ter­net com­pa­nies, even when they are aware (or should be aware) of un­law­ful con­tent on their web­sites.” The prac­ti­cal out­come is that the cur­rent state of the law pri­or­i­tizes pri­vacy—a laud­able and crit­i­cally im­por­tant value given that in our mod­ern world nearly all our most per­sonal and in­ti­mate data (including fi­nan­cial and health records) are stored and trans­mit­ted on­line. But the law should not ig­nore how those who cre­ate, view, and dis­trib­ute child pornog­ra­phy lever­age pri­vacy pro­tec­tions to avoid de­tec­tion by law en­force­ment. In the cur­rent le­gal frame­work, there is no pro­tec­tion for mem­bers of the pu­ta­tive class—in­di­vid­u­als who as chil­dren were pho­tographed and filmed while be­ing abused in the vilest ways imag­in­able, and who now are re­peat­edly vic­tim­ized each time the in­ti­mate and tor­tured im­ages of their trauma are dis­trib­uted to oth­ers. Those chil­dren are the col­lat­eral dam­age of our in­ef­fec­tive le­gal land­scape. They de­serve bet­ter.

Judge Wise is­n’t well-sit­u­ated to com­pare the rel­a­tive strengths and lim­i­ta­tions of the full range of po­ten­tial anti-CSAM op­tions, but a lead­ing tool has al­ways been and re­mains the gov­ern­men­t’s ef­forts to find and pros­e­cute the cre­ators, dis­sem­i­na­tors, and down­load­ers of CSAM. (Do you re­call the fed­eral gov­ern­men­t’s choices that leave chil­dren more vul­ner­a­ble?) Making sure the gov­ern­ment is do­ing what it can should be the #1 pri­or­ity. In con­trast, break­ing end-to-end en­cryp­tion should­n’t be any­where in the reg­u­la­tory toolkit.

Case Citation: Amy v. Apple Inc., 2026 WL 2031817 (N.D. Cal. July 13, 2026). The com­plaint.

Technology

Data cen­ter leases, GPU sup­ply con­tracts raise li­a­bil­i­ties at Meta, Oracle, Nikkei study shows

A Meta data cen­ter in the state of Georgia. The com­pa­ny’s off-bal­ance-sheet debt is about $420 bil­lion, nearly triple its trans­par­ent debt. © AP

KOHEI YAMADA

July 21, 2026 02:29 JST

PALO ALTO, California — Hidden debt at U.S. tech gi­ants swelled eight­fold in roughly four years to an es­ti­mated $1.65 tril­lion as ar­ti­fi­cial in­tel­li­gence in­vest­ments bal­looned, a Nikkei study shows, ex­ceed­ing ac­tual debt and mak­ing it tougher for in­vestors to as­sess risk.

Incremental is a li­brary that gives you a way of build­ing com­plex com­pu­ta­tions that can up­date ef­fi­ciently in re­sponse to their in­puts chang­ing, in­spired by the work of Umut Acar et. al. on self-ad­just­ing com­pu­ta­tions. Incremental can be use­ful in a num­ber of ap­pli­ca­tions, in­clud­ing:

Building large cal­cu­la­tions (of the kind you might build into a spread­sheet) that can re­act ef­fi­ciently to chang­ing data.

Constructing views in GUI ap­pli­ca­tions that can in­cor­po­rate new data ef­fi­ciently.

Computing de­rived data while guar­an­tee­ing that the de­rived data stays in sync with the source data, for in­stance fil­ter­ing or in­vers­ing a map­ping.

You can find de­tailed doc­u­men­ta­tion of the li­brary and how to use it in in­cre­men­tal/​src/​in­cre­men­tal_intf.ml. You can also find an in­for­mal in­tro­duc­tion to the li­brary in this blog post and this video.