California Gov. Jerry Brown signed a tough new net neutrality bill into law Sunday, but the Justice Department promptly filed suit to keep the protections from taking effect.

Why it matters: The issue seems destined for the courts to decide between challenges to the FCC's moves as well as the California law. In rolling back protections last year, the FCC included language designed to preempt new state laws.

The details: In its suit, the Justice Department also maintains that California's law is an attempt to regulate interstate commerce, which is under federal purview.

What they're saying:

• Attorney General Jeff Sessions: “Once again the California legislature has enacted an extreme and illegal state law attempting to frustrate federal policy. The Justice Department should not have to spend valuable time and resources to file this suit today, but we have a duty to defend the prerogatives of the federal government and protect our Constitutional order."
• FCC Chairman Ajit Pai: "The law prohibits many free-data plans, which allow consumers to stream video, music, and the like exempt from any data limits," Pai said in a statement.
• California Attorney General Xavier Becerra: "A handful of powerful companies should not dictate the sources for the information we seek or the speed at which our websites load. We remain committed to ensuring that our internet can continue to represent freedom and opportunity, innovation and fairness."
• Former FCC adviser Gigi Sohn: "California's net neutrality bill is now the model for all future state and federal legislation. It completely reinstates the 2015 Open Internet Order, including protections for interconnection and against anticompetitive and anti-consumer zero rating practices. This is what Internet users across the political spectrum have said they want by overwhelming majorities. "

Our take:

• The crux of this clash between California and the feds is a bigger question over whether regulators can forbid states from passing rules, even when regulators have declined (or say they don’t have authority) to enact rules themselves. That’s why the courts — and ultimately even the Supreme Court — may have to weigh in. 
• States are stepping in to fill the void on multiple fronts, including net neutrality, as the federal government rolls back regulations and takes a more laissez-faire approach. Dozens of states have also passed their own laws regarding online privacy and even rules for autonomous vehicle deployment as legislation languishes on Capitol Hill. Conflicting standards will eventually have to be reconciled. 
• Just last week, the FCC voted to preempt state and local authorities on another provision related to broadband networks: It's limiting how much money that city, county and state governments can charge telecom companies to install new antennas needed for 5G networks, and putting restrictions around the approval process. Expect local jurisdictions to sue the FCC over this one.

Brown also signed a number of other measures into law Sunday, including a first-of-its-kind law mandating all publicly traded companies with headquarters in the state to include at least one woman on their boards of directors by the end of next year.

The details: California is the first state to enact a law of this type. Under the policy, by 2021, companies with at least five directors are required to have two or three women directors, depending on the size of the board.

• According to Board Governance Research, women held just 15.5% of the board seats of California-based public companies in 2017.

After briefly balking, Tesla CEO Elon Musk settled with the SEC on Saturday. The two sides had been close to a deal earlier in the week but it briefly fell apart, prompting the SEC to sue Musk on Thursday.

The details:

• Musk gets to remain as CEO, but within 45 days must step down as chairman for a period of 3 years.
• He also must pay a $20 million penalty. Tesla also has to pay $20 million.
• Musk has to comply with new company procedures for any future communications related to Tesla, including via his Twitter account.

The bottom line: This is a smart decision for both Musk and Tesla, as a drawn-out court case would have clouded both of their futures for months to come.

The background: Musk got into hot water for tweets related to his efforts to take Tesla private, particularly claiming that he had "funding secured" at $420 per share, even though the SEC claims he never discussed that specific price with prospective investors.

• Musk reportedly had been ready to settle with the SEC last week, but then backed out of the deal because he felt the charges were unjustified.
• The SEC responded with a lawsuit, which could have resulted in him being barred from serving as an officer or director of any public company for years.

Read more here from Axios' Dan Primack and Ben Geman.

Go deeper: Elon Musk throws a Tesla tantrum

Separately, Musk told employees in a Sunday email that Tesla is close to profitability.

Aeva, a secretive Silicon Valley startup co-founded by two former Apple engineers, has unveiled its first product and Axios' Kia Kokalitcheva has the details.

What's new: Aeva's first product is a box it says can replace the cobbled-together sensor units that sit on top of autonomous vehicles (AVs).

Why it matters: Sensors are one of the critical technologies in autonomous driving as they enable the cars to “see” their environments.

The details: Aeva’s box aims to bring together the camera, lidar (“light detection and ranging"), and radar sensors collected atop AVs in an efficient, self-contained way.

• The main difference in Aeva’s approach to lidar from most other companies, it says, is that its sensors send out a continuous light wave instead of light pulses. So instead of collecting a series of frames (lidar maps surroundings by measuring how quickly a light pulse reflects back), and having to calculate its movements, it can directly measure its velocity and predict where it’s headed.
• That makes the system sort of a cross between lidar and radar, another common sensor used in self-driving cars. Other companies have been exploring this approach as well, as the New York Times noted last year.
• Of course, self-driving cars will still need additional sensors around the car, such as on the sides.

What's next: Aeva says a number of customers are already incorporating its sensor boxes into their vehicles. It declined to name these customers, but said they include major automakers and ride-hailing companies.

• Aeva says that each box costs “several hundred dollars,” but would not name an exact price.
• The cost of sensors like lidar has been a concern for the industry and has been a factor in keeping prices high for AVs.

Funding: Aeva has raised $45 million in seed and Series A funding from Lux Capital and Canaan Partners, among other investors.

Facebook crossed into new territory on Friday as it publicly disclosed a massive security breach that gave away the keys to as many as 50 million Facebook user accounts. That, notes Axios' David McCabe, comes just months after CEO Mark Zuckerberg said such an event had never occurred on its platform.

Why it matters: The Cambridge Analytica scandal was about gaming Facebook’s systems to scrape user data. This is something different: what looks like the biggest intrusion taking advantage of flaws in Facebook’s code since the social network was created on Harvard’s campus in 2004.

Flashback: At a Senate hearing earlier this year, Sen. Cory Gardner asked Zuckerberg if Facebook had ever been hacked.

• Gardner: "Have those hacks ever accessed user data?"
• Zuckerberg: "I don't believe so."

That changed midday Friday, when Facebook staffers disclosed in a hastily-assembled call with reporters that bugs had allowed hackers to obtain "access tokens" — which would let them effectively take over an account — for 50 million accounts.

• Another 40 million users saw their accounts flagged because they had been subject to an internal lookup used in the hack.
• Facebook says it doesn't know yet whether or how the access tokens were used, but if they were used, they provided full access to the account and its data.
• The bugs have been in place since July 2017, and Facebook says it won't know more about the timing of the activity until it completes an internal investigation.

Go deeper: David has more here.

On Tap

• The Bits & Pretzels startup conference takes place in Munich through Tuesday.
• GeekWire Summit kicks off tonight in Seattle. I'll be there talking about the future of the free press on Tuesday and interviewing eBay CEO Devin Wenig on Wednesday.
• Verizon begins its 5G-based home broadband service in parts of four cities.

Trading Places

• Black Girls CODE has a new 10-person board of directors that includes organization founder and CEO Kimberly Bryant, along with TaskRabbit CEO Stacy Brown-Philpot, Zume president Julia Collins and University of South Florida professor Sylvia Wilson Thomas.

ICYMI

• The U.S. International Trade Commission made an initial finding that Apple violated a Qualcomm patent, but determined that iPhone imports shouldn't be blocked. (Axios)
• Estonia is suing Gemalto for more than $175 million over flaws in its digital ID card. (Reuters)
• Tim Berners-Lee has a new startup aimed at trying to decentralize the web he helped create. (Tim Berners-Lee)

Check out the winners of this contest for micro-scale photography.