Theory 1: "Living Payload" Continuous Liability — Prior law treats software install as point-in-time. chrome.ai creates continuous, rolling liability: every API invocation = new processing event = new violation. CASL: $200/violation × daily chrome.ai calls = potentially astronomical.

Theory 2: "API Surface Duty of Care" — When vendor installs model with external API on user devices, they take on duty of care for that API's security. Google deployed, designed the API, didn't notify enterprise admins, didn't provide enterprise controls. Duty → breach → damages (if exploited).

Theory 3: "Consent Inheritance" Failure — Google claims 2024 ToS click-through covers 2026 model deployment. Legal challenge: consent must be contemporaneous and specific. Prior consent cannot be inherited for new, materially different uses. OPC 2018 guidelines + GDPR Article 7(3) both support this.

Theory 4: "Browser as Regulated Infrastructure" — If browsers host AI models with enterprise API surfaces, they cross from "software" to "infrastructure" subject to financial/healthcare/critical infrastructure regulation. Forward-looking but critical for regulatory advocacy.