Electronic Frontier Foundation

The Electronic Frontier Foundation (EFF) is the oldest and, in the US context, the most comprehensively operational civil-liberties organisation working at the intersection of law, technology, and democratic rights. Founded in 1990 in San Francisco, where it remains headquartered, EFF operates as a 501(c)(3) non-profit sustained primarily by member and individual donations — a funding structure that is itself a deliberate posture: the founding premise was that digital civil liberties would need a defender independent of both government and technology industry. The organisation's three-lane operation — litigation and legal defence, policy advocacy, and the direct production of open-source privacy tools and technical-safety guides — makes it distinctive in the corpus: most civil-society organisations do two of these three, and very few do all three at the scale EFF does. Its position in the make-AI-good movement flows from this combination: EFF is simultaneously a litigator in AI and surveillance cases, a coalition anchor for grassroots surveillance-accountability campaigns, and the producer of infrastructure (Privacy Badger, Certbot, the Surveillance Self-Defense guide) that non-technical users and at-risk communities depend on for protection against the surveillance systems EFF simultaneously challenges in court.

Founding

EFF was founded in July 1990 by Mitch Kapor (then former president of Lotus Development Corporation), John Perry Barlow (a Wyoming rancher, lyricist for the Grateful Dead, and author of the 1996 "Declaration of the Independence of Cyberspace"), and John Gilmore (an early Sun Microsystems employee), in direct response to a law-enforcement overreach: the United States Secret Service had raided the Austin offices of Steve Jackson Games — a tabletop role-playing game publisher — and seized computers and manuscript files under the erroneous premise that the publisher's electronic bulletin board was a site for distributing stolen materials. The raid's legal framing treated a private BBS's messages as having no civil-liberties protection, revealing to the founders a gap between existing law and the emerging world of networked digital communications that needed to be closed by litigation, advocacy, and clear principle-setting before agencies, courts, and legislators set the defaults by default. EFF's subsequent legal programme has produced some of the most consequential US digital-rights precedents: Bernstein v. Department of Justice established that computer source code is constitutionally protected speech under the First Amendment, effectively settling the legality of strong encryption in the US; the challenge to the Communications Decency Act produced the Reno v. ACLU Supreme Court ruling that the internet deserves the highest First Amendment protection; and sustained FOIA litigation and amicus brief practice has shaped the legal framework governing digital privacy across decades of changing technology.

Programme areas

EFF's three interlocking modes of work — litigation and legal defence, policy advocacy, and technology production — are each run at institutional scale.

The legal programme runs through a General Counsel, Legal Director, dedicated litigation staff, and a Threat Lab under a Director of Investigations that produces technical and investigative research informing both litigation and policy. The active caseload combines direct defence of individuals facing government digital overreach, FOIA litigation against federal agencies using opaque AI systems, and amicus brief practice in state and federal courts on facial recognition evidence, encryption, and algorithmic decision-making. In June 2026 EFF joined an amicus coalition in Chatrie v. United States, in which the Supreme Court ruled 6-3 that individuals retain a Fourth Amendment expectation of privacy in location data — effectively prohibiting geofence warrants and marking the first major digital surveillance precedent since Carpenter v. United States (2018).

The policy programme maintains a Director of Federal Affairs for the US Congress and federal agencies, and an International Policy Director and Global Privacy Policy Director for engagement with EU institutions, the UN system, and bilateral processes. EFF does not sit inside the European Digital Rights (EDRi) network the way the EU-based organisations do, but its international staff maintain substantive engagement on cross-border AI and surveillance questions that European regulatory processes generate — particularly on facial recognition, biometric databases, and encryption policy where EFF has been building doctrine since the 1990s.

The tools and technology programme has produced infrastructure that much of the open internet depends on: Certbot is the standard command-line tool for automating Let's Encrypt certificate issuance, making HTTPS effectively universal for websites that could not afford commercial TLS certificates; Privacy Badger is a browser extension that automatically blocks cross-site tracking; Cover Your Tracks (formerly Panopticlick) tests browser fingerprint uniqueness; and Surveillance Self-Defense is the principal multi-language digital-security guide for at-risk populations — protesters, journalists, activists, LGBTQ+ youth, abortion access workers — providing practical guidance on encrypted communications, device security, and threat modelling for people whose safety depends on it. HTTPS Everywhere, EFF's browser extension that enforced HTTPS connections, was sunset in January 2023 once browser vendors integrated native HTTPS-first modes — an example of EFF retiring tools when the infrastructure they were compensating for has been fixed.

AI, surveillance, and grassroots mobilisation

EFF's AI-relevant work is primarily rooted in its long-running surveillance campaigns rather than emerging from the recent AI-governance wave. The organisation has been challenging government use of facial recognition for years, framing it as a civil-rights issue — not merely a privacy issue — on the evidence that the systems produce disparate error rates affecting women and people with darker skin, and that law enforcement use of facial recognition for identification in criminal proceedings has produced documented wrongful identifications. EFF's About Face campaign mobilises communities to oppose government facial recognition through a coalition that includes Lucy Parsons Labs, Oakland Privacy, and Media Justice; the campaign pursues both local ordinances and court interventions, including amicus briefs in criminal facial recognition cases seeking disclosure to defence counsel.

The Community Control of Police Surveillance (CCOPS) campaign, launched in 2016, is EFF's most directly grassroots-mobilisation-oriented programme: it pushes for local ordinances that require community approval — through city council votes — before police agencies can acquire and deploy surveillance technologies including facial recognition, automated licence plate readers, cell-site simulators, and drones. The jurisdictions that have enacted CCOPS laws include Santa Clara County, BART, Oakland, Berkeley, Palo Alto, San Francisco, and New York City. CCOPS is the campaign in EFF's portfolio most closely aligned with the "people outside AI being engaged in work to shape how AI is deployed" criterion of this corpus — it routes surveillance-technology acquisition decisions through democratic institutions where non-specialist community members participate, rather than allowing police agencies to acquire surveillance capability by procurement alone.

The Atlas of Surveillance is a crowdsourced research database documenting law enforcement surveillance technology deployments across the United States, built with more than 1,000 student and volunteer researchers in partnership with the Reynolds School of Journalism at the University of Nevada Reno. The database catalogues deployments of ALPRs, facial recognition systems, body cameras, drones, cell-site simulators, gunshot detection, and other surveillance technologies by agency, giving journalists, defence attorneys, and advocacy groups an evidence base for challenging deployment decisions. EFF's companion Street Level Surveillance guide explains how sixteen categories of law enforcement surveillance technology work — ALPRs, facial recognition, body cameras, cell-site simulators, drones, robots, gunshot detection, biometric surveillance, electronic monitoring, predictive policing software, real-time location tracking, social media monitoring, police databases, forensic extraction tools, community surveillance apps, and police access to IoT devices — for the same practitioner audiences.

EFF's Threat Lab extended this investigative reach into consumer hardware in June 2026. After researchers identified code in Meta's AI companion app capable of identifying strangers through Ray-Ban smart glasses, the Threat Lab confirmed through static code analysis that Meta had shipped an internal feature called "Name Tag" to millions of devices — a system that converts every face in view into a 2,048-number faceprint array and matches it against a stored database, without users' knowledge. Following EFF's disclosure and the resulting public outcry, Meta removed the code in a June 5 app update, stripping the recognition engine, alert logic, and biometric databases from the application. In the same period, EFF's legal team defended DeFlock.me — a crowdsourced website mapping ALPR deployments across the United States — against a cease-and-desist from ALPR manufacturer Flock Safety, establishing the mapping project as First Amendment-protected grassroots advocacy and reflecting a broader wave of community wins against ALPR expansion in cities across the country.

AI copyright and fair use

EFF's AI-related work expanded significantly in 2025 to encompass a second major front: the wave of copyright litigation challenging AI training as infringement. EFF's core position — that AI training is a legitimate, transformative fair use — frames the underlying dispute as a question about who controls AI's future: if training on publicly available text and code requires per-work licensing, only incumbents with pre-existing blanket-licensing relationships can build competitive AI systems, cementing concentration and foreclosing new entrants. EFF filed amicus briefs across multiple appeals — Doe v. GitHub, Thomson Reuters v. Ross Intelligence, Bartz v. Anthropic, Kadrey v. Meta, Concord Music Group v. Anthropic, and In re Mosaic LLM Litigation — arguing consistently that the market substitution theory at the heart of these cases contradicts fundamental copyright principles and would give rightsholders veto power over any expression that might conceivably compete. EFF also challenged the US Copyright Office's May 2025 draft report on AI training for leaning against fair use, arguing the framing would entrench Big Tech incumbents at the expense of smaller developers who depend on the fair use doctrine precisely because they lack the resources for blanket licensing.

EFF's fair-use defence extended to the technical standards layer in 2025: EFF intervened at the Internet Engineering Task Force (IETF) to oppose proposals for "preference signal" mechanisms that would allow websites to veto AI training and web search through restrictive signals embedded in HTTP responses, contributing to the defeat of the most expansive proposals — protecting the technical infrastructure that independent researchers, archivists, and open-source AI developers depend on. Related legislative battles include EFF's opposition to the NO FAKES Act — a bill that would create federal personality rights covering AI-generated synthetic media, which EFF argues would suppress lawful commentary far beyond its stated anti-deepfake rationale — and EFF's 2026 participation in a coalition of eighteen civil society organisations opposing New York's Stealth Crawler Prohibition Act (Senate Bill 9934A), which would have restricted automated web data collection in ways EFF argued would harm journalism, research, and open-source AI development.

AI policy position

EFF's stated regulatory philosophy on AI is distinctive among US digital-rights organisations: rather than treating AI as a sui generis regulatory subject requiring new AI-specific legislation, EFF frames it as a general-purpose tool set and argues that existing legal frameworks — FOIA for government AI use, privacy law for corporate AI use, competition law for platform concentration — should be extended and enforced rather than replaced. The practical priorities flowing from this position are: comprehensive privacy legislation covering all corporate surveillance and data-broker activity; antitrust enforcement to prevent incumbents from using AI capability as an entry barrier against competitors; and robust transparency requirements for government AI systems. In practice EFF has also filed suit directly: in March 2026 EFF filed a FOIA lawsuit against the Centers for Medicare and Medicaid Services over the WISeR program, an AI system that evaluates Medicare care requests and reportedly issues denials on their basis, citing the public's right to understand how a federal AI system makes consequential decisions about patient care. On the legislative front, EFF has opposed the GUARD Act — a Senate bill that would require AI companion app providers to implement age-verification systems tied to users' real-world identities, advanced by the Senate Judiciary Committee in April 2026 and the Senate Commerce Committee in August 2026 — arguing that the requirement harms privacy far beyond its child-protection rationale, and that millions of Americans without current government ID or major-bank accounts would be structurally excluded from tools the bill ostensibly protects them from.

The sharpest AI policy battle of the 2025–2026 period has been the fight over federal preemption of state AI laws. In May 2025 EFF opposed a provision in the House Energy and Commerce Committee's budget reconciliation bill that would have imposed a ten-year moratorium on state AI regulation, effectively freezing any US AI accountability law for a decade while Congress moved at its characteristic speed on emerging technology. EFF argued the provision would override existing state laws addressing documented AI harms, block states from reacting to new problems as they emerged, and hand a structural advantage to the same companies seeking to eliminate consumer protections. In November 2025 EFF sent a formal letter opposing preemption through the National Defense Authorization Act (NDAA) or standalone bills, framing the effort as a choice between "the real concerns of everyday Americans" and the interests of "a few, deep-pocketed companies looking to set their own rules." The Senate ultimately removed the preemption provision before the reconciliation bill's signing in July 2025 — a direct outcome EFF and allied organisations had campaigned for — but the preemption push continued into 2026: a bipartisan June 2026 discussion draft, the Great American Artificial Intelligence Act, proposed a three-year freeze on state AI laws governing model development, and the Trump administration issued an executive order creating an AI Litigation Task Force directed to challenge state AI laws in court.

EFF's critique of weak federal legislation extended to two further 2026 proposals. The SECURE Data Act — a Republican-drafted privacy bill advanced in May 2026 — drew EFF opposition for preempting all 21 existing state consumer privacy laws and for an AI training carve-out that explicitly permitted data collection to "develop" new technologies, effectively allowing AI companies to harvest personal data for training regardless of other privacy requirements in the bill. In August 2026 EFF joined Fight for the Future and Public Knowledge in urging the FTC to withdraw a proposed AI accuracy policy that EFF characterised as unconstitutional prior restraint on speech — installing the government as arbiter of truth over AI outputs — and that attempted to override Colorado's automated-decision-making law, a state consumer protection EFF had defended throughout the preemption campaigns.

Leadership

Cindy Cohn led EFF as Executive Director from 2015 through May 2026, having joined the organisation as outside lead counsel in 1993 for the Bernstein v. Department of Justice encryption case and having served as Legal Director and General Counsel from 2000 onward. Nicole Ozer succeeded Cohn as Executive Director in June 2026; Ozer was the founding director of the Technology and Civil Liberties Program at the American Civil Liberties Union of Northern California, where she led the legislative campaigns that produced the California Electronic Communications Privacy Act and the California Reader Privacy Act, and she subsequently served as the Inaugural Executive Director of the Center for Constitutional Democracy at UC Law San Francisco. The board is chaired by Gigi Sohn, the net-neutrality advocate and former FCC commissioner nominee, and includes Bruce Schneier (security technologist and Berkman Klein Center fellow, also on the Access Now board), Jonathan Zittrain (Harvard Law), Pamela Samuelson (Berkeley Law), and Anil Dash (CEO of Glitch), among others. In July 2026 Ozer articulated EFF's strategic direction for the organisation, naming four priorities: challenging increasingly sophisticated government and corporate surveillance systems; preserving strong encryption and online anonymity; ensuring AI is developed and deployed in ways that respect fundamental rights; and addressing concentrated corporate power that limits creative access and developer rights. A cross-movement framing was central — rather than treating digital rights as a standalone policy domain, Ozer emphasised integrating EFF's work with civil rights, reproductive rights, disability rights, workers' rights, and economic justice struggles, positioning digital terrain battles as integral to all rights fights rather than a separate specialised field.

Position in the movement

EFF is the oldest anchoring organisation in the US digital-rights field and occupies a position in this corpus that no other US organisation matches: it combines the member-funded independence and international coalition reach of Access Now's model — compressed into the US jurisdiction — with litigation-and-precedent work that produces binding law, and with open-source tool production that makes EFF's influence concrete rather than symbolic. Its member-funded model — not foundation-dependent, not government-funded — provides structural independence that EFF explicitly frames as central to its mission, distinguishing it from think-tanks and policy-dependent organisations that must manage funder relationships with the same platforms they are challenging. The CCOPS and About Face campaigns represent EFF's clearest grassroots-mobilisation footprint — they move beyond litigation and policy briefing into coalition-building at the city level, engaging non-specialists in surveillance-technology decisions through democratic processes. EFF was also a founding member of the Access Now #KeepItOn coalition when it launched at RightsCon Silicon Valley in 2016 — the cross-organisational network working to document and oppose state-ordered internet shutdowns. That combination of litigation infrastructure, tool production, and demonstrated grassroots campaign capacity is why EFF anchors the movement-graph's US digital-rights coverage in a way that more narrowly focused organisations do not.