Privacy Enforcement Tracker

California Attorney General Rob Bonta, four California District Attorneys, and CalPrivacy announced a $12.75 million General Motors settlement over allegations that GM sold Californians' OnStar location and driving behavior data to LexisNexis and Verisk in violation of the CCPA and Unfair Competition Law. The settlement bans sales of driving data to consumer reporting agencies for five years and requires a privacy program for OnStar data collection.

The FTC took action against Match Group Americas and Humor Rainbow, Inc. (operator of OkCupid) for sharing photos, demographic information, and location data of millions of OkCupid users with AI firm Clarifai — a company with which OkCupid had no business relationship — in violation of OkCupid's own privacy policy. The proposed 20-year consent order bars Match and OkCupid from misrepresenting their information practices and the function of privacy controls; no monetary civil penalty was imposed.

The California Privacy Protection Agency (CPPA) fined Ford Motor Company $375,703 for adding unnecessary friction to the consumer opt-out process. Ford required consumers to verify their email address before their opt-out requests would be processed — those who did not click the confirmation link had their requests ignored. This was CalPrivacy's second enforcement action stemming from its connected vehicles investigative sweep. Ford must process all previously unfulfilled opt-out requests, provide compliant opt-out submission methods, audit tracking technologies on its website, and ensure proper handling of opt-out preference signals.

The California Privacy Protection Agency (CPPA) issued a $1.10 million fine against PlayOn Sports, whose GoFan platform sells digital tickets for approximately 1,400 California schools. PlayOn used tracking technologies to deliver targeted ads to ticketholders without providing a sufficient opt-out mechanism, instead directing users to third-party ad industry tools rather than operating its own opt-out. This is the first CPPA enforcement action addressing student privacy violations.

California Attorney General Rob Bonta secured the largest CCPA settlement in state history — $2.75 million against Disney for failing to fully effectuate consumer opt-out requests across all streaming services and devices linked to their Disney accounts. When consumers opted out on one Disney streaming app, the opt-out did not carry across to other Disney platforms like Hulu or ESPN+.

Massachusetts AG and Connecticut AG jointly settled with Comstar, an ambulance billing vendor, for $515,000 ($415,000 to MA, $100,000 to CT) following a 2022 ransomware attack that exposed the personal and medical information of 585,621 individuals. The company failed to conduct adequate risk assessments and maintain reasonable data security practices. Settlement requires Comstar to implement a comprehensive information security program, appoint a CISO, and maintain compliance documentation.

The CPPA's Data Broker Enforcement Strike Force fined Rickenbacher Data LLC (d/b/a Datamasters) $45,000 for failing to register as a data broker under the California Delete Act (SB 362). Datamasters bought and resold names, addresses, phone numbers, and email addresses of millions of people with health conditions including Alzheimer's disease and drug addiction for targeted advertising. The company was also ordered to stop selling all Californians' personal information.

The CPPA fined S&P Global, Inc. $62,600 for failing to register as a data broker under the California Delete Act (SB 362). The New York-based provider of data and technology failed to register due to an administrative error. After discovering the error, the company promptly registered and agreed to implement procedures to ensure ongoing compliance with California's data broker registration requirements.

California Attorney General Rob Bonta announced a $1.4 million settlement with Jam City, a mobile gaming company, for CCPA violations including lacking opt-out mechanisms in 20 of 21 apps and selling personal information of minors aged 13-16 without obtaining required affirmative authorization.

California Attorney General Rob Bonta secured a $530,000 settlement with Sling TV and Dish Media Sales for confusing CCPA opt-out flows, requiring unnecessary webform steps from logged-in users, lacking in-app opt-out methods on living-room devices, and failing to provide sufficient children's privacy protections.

The California Privacy Protection Agency (CPPA) issued its largest monetary penalty to date — $1.35 million against Tractor Supply Company for failing to properly notify consumers and job applicants of their privacy rights, failing to maintain adequate service provider agreements, and failing to provide effective opt-out mechanisms.

Connecticut Attorney General William Tong announced the state's first enforcement action under the Connecticut Data Privacy Act (CTDPA) — an $85,000 settlement with TicketNetwork, Inc., a Connecticut-based online ticket marketplace. The AG found that TicketNetwork's privacy notice was "largely unreadable," lacked required consumer data rights disclosures, and had misconfigured or inoperable opt-out mechanisms. The company had been given multiple notices to cure since November 2023 but failed to fully remediate.

California Attorney General Rob Bonta announced a $1.55 million settlement with Healthline Media LLC for violating the CCPA by failing to honor opt-out requests and improperly sharing consumer data with third parties.

Texas Attorney General Ken Paxton secured a $1.375 billion settlement with Google related to data privacy rights of Texans. The settlement addressed unauthorized collection and use of personal data, marking the second billion-dollar privacy settlement for Texas.

The California Privacy Protection Agency (CPPA) fined Honda $632,500 for requiring excessive verification or personal information for privacy rights requests, using asymmetrical privacy choices, making authorized-agent requests difficult, and sharing personal information with ad tech companies without required contract terms.

Texas Attorney General Ken Paxton filed the first-ever enforcement action under a state comprehensive data privacy law, suing Allstate and its subsidiary Arity for collecting and selling the driving behavior data of over 45 million Americans. Arity paid app developers (GasBuddy, Fuel Rewards, Routely) to embed tracking SDKs that collected precise geolocation data without consumer notice or consent. The data was used to build a "driving behavior database" sold to insurance companies to justify premium increases. The AG is seeking over $1 million in penalties ($7,500 per TDPSA violation, $10,000 per Data Broker Law violation). Case is ongoing.

Texas Attorney General Ken Paxton secured a record $1.4 billion settlement with Meta for running facial recognition on photos uploaded to Facebook without user consent, violating the Texas Capture or Use of Biometric Identifier Act (CUBI). This is the largest privacy settlement ever obtained by a single state.

NGL Labs and two co-founders agreed to pay $5 million and were banned from offering their anonymous messaging app to anyone under 18, for marketing the service to children and teens, sending fake messages that appeared to come from real people to sell a paid subscription, and violating the COPPA Rule. Brought jointly by the FTC and the Los Angeles County District Attorney's Office as co-plaintiff — the charged statutes are federal, not California privacy law.

Mobile game developer Tilting Point Media settled for $500,000 for collecting personal information from children under 13 playing its games without parental consent.

Telehealth firm Cerebral agreed to pay more than $7 million — nearly $5.1 million in partial consumer refunds plus a civil penalty — for disclosing the sensitive health data of nearly 3.2 million consumers to third parties such as LinkedIn, Snapchat, and TikTok for advertising, and for failing to honor its "cancel anytime" promise. The complaint charged the FTC Act, the Restore Online Shoppers' Confidence Act (ROSCA), and the Opioid Addiction Recovery Fraud Prevention Act (OARFPA) — not the Health Breach Notification Rule.

The FTC settled with InMarket Media, prohibiting the data aggregator from selling or licensing precise location data. InMarket tracked consumers' locations through its own apps and third-party apps carrying its SDK to serve targeted advertising without fully informing them or obtaining consent. The order was finalized in May 2024.

The FTC banned data broker X-Mode Social (now Outlogic) from sharing or selling sensitive location data, marking the first FTC action to prohibit a data broker from selling sensitive location data.

The FTC barred Rite Aid from using facial recognition technology for surveillance purposes for five years after its AI-based system, deployed from 2012 to 2020 without reasonable safeguards, falsely tagged consumers as shoplifters — particularly women and people of color. The order carried no civil penalty but requires biometric-use notice and deletion of collected biometric information.

Amazon agreed to pay a $25 million civil penalty to settle federal COPPA allegations that Alexa retained children's voice recordings and geolocation data for years, failed to honor some parental deletion requests, and used unlawfully retained data to improve its algorithms.

Ring agreed to pay $5.8 million for consumer refunds under a proposed federal order resolving FTC allegations that employees and contractors had broad access to customers' private videos and that weak security controls enabled account and camera takeovers.

Illinois-based Easy Healthcare, maker of the Premom fertility app, agreed to a $100,000 civil penalty in a proposed order filed by the Department of Justice on behalf of the FTC, for sharing users' sensitive health data with third-party analytics and marketing companies including AppsFlyer and Google without consent and failing to notify consumers of those disclosures. This was the FTC's second enforcement action under the Health Breach Notification Rule, after GoodRx.

DoorDash was fined for selling consumers' personal information to a marketing cooperative without providing notice or an opportunity to opt out of the sale.

Epic Games paid a $275 million civil penalty for COPPA violations involving Fortnite, including collecting children's personal information without parental consent and retaining data after deletion requests. A separate $245 million consumer-refund order addressed dark patterns and unwanted charges and is not included in this record's penalty amount.

The FTC sued Idaho-based data broker Kochava in federal court for selling geolocation data that could be used to track people to sensitive locations such as reproductive health clinics, places of worship, and domestic violence shelters. The complaint sought an injunction rather than a civil penalty; the matter was still in litigation as of the cited release.

Sephora settled with the California AG for $1.2 million for failing to disclose it was selling consumers' personal information, failing to process opt-out requests via Global Privacy Control (GPC), and failing to cure violations within 30 days.

OpenX paid $2 million to settle federal allegations that its advertising exchange collected personal information from children under 13 without parental consent and continued collecting geolocation data from some Android users who had opted out of location tracking.

Zoom settled a class action for $85 million related to privacy and security issues including sharing user data with Facebook, Google, and LinkedIn, and falsely claiming end-to-end encryption.

Google and YouTube paid $170 million to settle COPPA allegations that YouTube collected persistent identifiers from viewers of child-directed channels without first notifying parents or obtaining consent. The joint FTC and New York Attorney General resolution allocated $136 million to the FTC and $34 million to New York.