AI Is Now Fighting a Three-Front Legal War

The Apple-OpenAI suit that landed Friday is not a copyright case. Apple alleges that OpenAI systematically stole hardware trade secrets — product designs, manufacturing processes, supply-chain strategies — through a campaign that recruited more than 400 former Apple employees and, in one instance, exploited a software bug to download over a thousand pages of confidential files ^[1].

OpenAI's nascent hardware business now rests on the shakiest of foundations, rotten to its core by its illegal reliance on misappropriated trade secrets. — Apple

The suit targets OpenAI's nascent consumer hardware business, not its models. It belongs to a different legal front entirely. That front is one of three now bearing down on the AI industry simultaneously. For two years, the legal story was a single question — does training on copyrighted work violate the law? — and the answer was always going to be a bill. That question is still being litigated, by nearly 400 newspapers, five major publishers, and musicians ^[2][3][4]. But it has been joined by two others whose stakes are not financial. One is hardware trade secrets, where the remedy can be an injunction that blocks a product from market. The other is privacy and security enforcement, where the remedy can be a market ban, a supply-chain blacklist, or an order to break open a walled garden. The difference is in kind, not merely in degree. A copyright judgment produces a licensing obligation or damages — a cost of doing business that every AI company has already priced into its litigation reserves. A trade-secret injunction can kill a product before it ships. A privacy order from the European Commission can force a company to grant rivals free access to its platform, as Meta was ordered to do with WhatsApp in June, the first such interim measure in 17 years ^[5]. A supply-chain blacklist can cut off a company's access to government contracts and trigger cascading risk disclosures across the sector, as happened when the Trump administration designated Anthropic a "supply chain risk" in February ^[6]. And a Digital Markets Act order can compel Google to open Android to rival AI assistants, with fines of up to 10% of global turnover ^[7]. The trade-secret front is not an automatic win for plaintiffs — a federal judge dismissed xAI's similar suit against OpenAI in June, ruling that routine recruitment inquiries about a candidate's past work do not constitute theft ^[8]. But Apple's complaint is different in scale and specificity: it alleges a checklist designed to evade security detection and a former engineer exploiting a bug to exfiltrate documents. The evidence, if it holds, is concrete in a way that xAI's was not. What is new — and what makes this moment different from any prior legal cycle in tech — is how the companies themselves have begun to act. They are not waiting for governments to draw the lines. They are drawing their own. Anthropic unilaterally restricts sales to companies controlled by the People's Republic of China, including subsidiaries incorporated outside China, and embeds tracking code in its Claude Code tool to identify China-based users — a private embargo that predates and exceeds any government export control ^[9]. Alibaba retaliated by banning Claude Code for all employees, classifying it as "high-risk software with security vulnerabilities" ^[9]. OpenAI banned Chinese-linked accounts conducting US-focused influence operations — amplifying anti-data-center sentiment, spreading false claims about compromised user data — a counterintelligence function performed by a corporation, not a government, and without a government ordering the action ^[10]. The company also expanded Lockdown Mode to all ChatGPT users in June, a security setting that blocks outbound network requests and data exfiltration at the cost of disabling the product's most advanced features ^[11]. Anthropic voluntarily restricted its Mythos model — capable of autonomous zero-day exploit discovery — to a vetted-access program called Project Glasswing, walling off its most dangerous capability before any regulator demanded it ^[12]. Each of these is a sovereign act — a border, an embargo, a weapons restriction — performed by a corporation, not a government, and in each case without a government ordering the action. The hardware layer is where these dynamics converge. Every major AI lab is now building proprietary silicon: OpenAI's Jalapeño chip with Broadcom, designed in nine months using OpenAI's own models and targeting gigawatt-scale deployment by 2029 ^[13]. DeepSeek is developing custom inference chips to bypass US export controls, recruiting chip-design engineers privately and consulting foundries ^[14]. The same hardware layer that trade-secret lawsuits contest — Apple alleges the trade secrets OpenAI stole are precisely the kind that would accelerate a competitor's hardware program — is the layer every company is racing to control. And the race is being shaped by government export controls that make self-sufficiency a survival requirement. Privacy has become the era's most versatile legal instrument because it serves three masters at once. It is a regulator's tool. Canadian privacy watchdogs found OpenAI violated privacy laws by scraping overbroad personal data — health conditions, political affiliations, minors' information — to train ChatGPT, with British Columbia's commissioner finding non-compliance in 12 of 13 areas examined ^[15]. The European Commission provisionally found Meta violated the Digital Services Act by failing to prevent children under 13 from accessing its platforms, with fines of up to 6% of global revenue at stake ^[16]. A Munich court ruled Google is directly liable for defamatory AI Overviews content, rejecting the defense that users must fact-check AI results.

If AI Overviews is legally treated as completely unreliable, and all of the displayed links need to be checked independently, then its entire function and benefits would be significantly diminished. — Regional Court of Munich

It is a corporate shield. When news publishers sought sanctions against OpenAI for destroying billions of ChatGPT conversation logs — logs that could establish the scale of copyrighted material the models ingested — OpenAI's defense invoked user privacy.

We’ll continue defending our users’ privacy and the long-established principles of fair use. — OpenAI

The same data that would prove copyright infringement is protected by privacy obligations, and OpenAI is exploiting that collision as a legal barrier ^[17]. And it is a boundary that companies compulsively violate. Meta embedded dormant facial-recognition code in its Ray-Ban smart glasses app despite more than $2 billion in prior biometric privacy settlements in Illinois and Texas ^[18]. Google silently installed a 4GB Gemini Nano AI model on Chrome users' devices without explicit consent — the model re-downloads if deleted and sends queries to Google servers, which one privacy researcher flagged as a likely violation of European privacy law ^[19]. Meta launched a Muse AI feature that auto-opted-in all public adult Instagram accounts with only a buried manual opt-out, then removed it three days later after a backlash from SAG-AFTRA and the Creative Arts Agency ^[20]. The competitive pressure to deploy AI features may be overriding even the threat of catastrophic penalties. The pattern looks less like a calculated strategy than a compulsion — though the sources cannot tell us which. The copyright front, for all its volume, operates in a known framework. Nearly 400 newspapers sued OpenAI and Microsoft in June ^[2]. Major publishers including Hachette, Macmillan, and Elsevier sued Meta, alleging Mark Zuckerberg personally authorized abandoning a $200 million licensing plan in favor of a fair-use legal strategy ^[3]. Google is defending an AI music copyright suit by arguing YouTube's Terms of Service grant a broad royalty-free license to reproduce uploaded content ^[4]. Elon Musk is simultaneously pursuing an antitrust suit against Apple and OpenAI and a landmark challenge to OpenAI's nonprofit-to-for-profit conversion ^[21]. The cases are numerous, expensive, and procedurally complex. But the worst outcome any of them can produce is a bill — damages, a licensing fee, a settlement. No copyright judgment can ban a product from a market, cut off a chip supply, or force a company to open its platform to competitors. The newer fronts can. And the companies know it. That is why they are building fortresses — proprietary chips, lockdown modes, vetted-access programs, unilateral embargoes — before governments finish building the legal walls around them. The question is whether those fortresses will be treated as compliance or as competition. The European Commission's WhatsApp order and its Android demand suggest an answer: a fortress, to a regulator, looks like a walled garden that needs breaking open.