United States News

🇺🇸

A state court imposed a $25 billion civil penalty after a jury found nearly 43.9 million violations involving Meta's representations about privacy, third-party data access and other platform practices.

21 October 2026 Judgment

🇺🇸

Four enacted bills expand CCPA deletion coverage, protect privacy settings, accelerate broker deletion processing and narrow specified online CIPA claims.

30 September 2026 Legislation

🇺🇸

Delaware enacted HB 381 to clarify when businesses must notify the Attorney General of a computer security breach.

4 September 2026 Legislation

🇺🇸

Delaware enacted HB 380, expanding coverage, sensitive-data protections, third-party controls and profiling duties from 1 January 2027.

4 September 2026 Legislation

🇺🇸

The D.C. Circuit denied an emergency stay, leaving in place a judgment that set aside the expanded SAVE citizenship-verification system while the appeal proceeds.

4 September 2026 Judgment

🇺🇸

The US FTC extended by seven days the comment period for a proposed enforcement policy on companies using personal data to set individualized prices.

3 September 2026 Policy

🇺🇸

CalPrivacy's Enforcement Advisory 2026-01 says data brokers can incur daily penalties while incorrect information remains in California's registry.

3 September 2026 Guidance

🇺🇸

SalesIntel must pay $36,400, publish rights metrics and process DROP requests after operating without timely California data-broker registration.

1 September 2026 Enforcement

🇺🇸

Azul Vision paid $50,000 and accepted two years of monitoring after providing requested records almost two years after the initial request.

27 August 2026 Enforcement

🇺🇸

Cox Media Group and two firms must pay $930,000 after claiming an ad service listened to smart-device conversations and that consumers had opted in, though it did neither.

27 August 2026 Enforcement

🇺🇸

A federal court temporarily restrained acquisition of a state-owned driver database containing names, birth dates and Social Security numbers while a multistate challenge proceeds.

20 August 2026 Judgment

🇺🇸

LocateSmarter was fined $116,490 after late registration and requiring partial Social Security numbers before Californians could opt out.

11 August 2026 Enforcement

🇺🇸

OSF paid $552,250 and accepted two years of monitoring after a ransomware incident exposed health information of 53,907 people.

29 July 2026 Enforcement

🇺🇸

The complaint alleges the telehealth provider sent sensitive condition-related data to Meta, Snap and others despite privacy promises, alongside subscription-practice claims.

29 July 2026 Enforcement

🇺🇸

The regulator's first sectoral audit will test whether major gig platforms honor access and control rights for consumers and independent-contractor workers.

21 July 2026 Enforcement

🇺🇸

A 43-jurisdiction coalition resolved claims arising from the 2023 breach affecting 6.9 million users and imposed new security, deletion and governance requirements.

14 July 2026 Enforcement

🇺🇸

The FTC and DOJ alleged RentGrow duplicated criminal and eviction records, omitted data sources from disclosures and mishandled disputes in tenant screening.

9 July 2026 Enforcement

🇺🇸

The FTC and DOJ alleged Amazon repeatedly failed to provide identity-theft victims with transaction records within the FCRA's 30-day deadline.

30 June 2026 Enforcement

🇺🇸

A federal stipulated order restricts Kochava and its subsidiary from selling or disclosing location data capable of tracing visits to sensitive places without consumer consent.

26 June 2026 Enforcement

🇺🇸

The employer-sponsored health plan paid $200,000 and accepted two years of monitoring after OCR identified potential HIPAA risk-analysis and disclosure violations.

18 June 2026 Enforcement

🇺🇸

Illuminate must delete unnecessary data, limit collection and retention and operate a security programme after a breach exposed data concerning 10.1 million students.

5 June 2026 Enforcement

🇺🇸

Covered platforms must operate a removal process and remove validly reported intimate images and known identical copies within 48 hours under the TAKE IT DOWN Act.

19 May 2026 Legislation

🇺🇸

LG agreed to stop using automated content recognition to collect Texans' viewing data without informed consent, clearer disclosures and a simple opt-out.

11 May 2026 Enforcement

🇺🇸

California alleged GM retained and sold location and driving data without adequate knowledge or consent, securing a $12.75 million penalty and deletion, consent and governance terms.

8 May 2026 Enforcement

🇺🇸

Four organizations paid a combined $1.165 million and accepted two-year corrective plans after OCR investigations into ransomware breaches and risk-analysis failures.

23 April 2026 Enforcement

🇺🇸

The FTC alleged OkCupid gave an unrelated company access to nearly three million user photos plus location data contrary to its privacy promises and without formal use restrictions.

30 March 2026 Enforcement

🇺🇸

HHS OCR settled with software business associate MMG Fusion over an unreported incident affecting about 15 million people and imposed a three-year corrective plan.

5 March 2026 Enforcement

🇺🇸

CalPrivacy's first student-and-schools decision required PlayOn Sports to pay $1.1 million and change privacy practices across its GoFan and school-sports services.

3 March 2026 Enforcement

🇺🇸

Samsung agreed to stop collecting or processing automated-content-recognition viewing data from Texas consumers without express consent and clearer disclosures.

26 February 2026 Enforcement

🇺🇸

HHS OCR began accepting complaints and breach reports under 42 CFR Part 2 from 16 February 2026, with civil remedies aligned to HIPAA enforcement.

13 February 2026 Regulation

🇺🇸

California alleged Disney failed to apply sale-and-sharing opt-outs across linked devices and streaming services, requiring a $2.75 million penalty and account-wide controls.

11 February 2026 Enforcement

🇺🇸

The FTC finalized a 20-year order requiring consent and consumer controls for connected-vehicle data and barring certain disclosures to consumer reporting agencies for five years.

14 January 2026 Enforcement

🇺🇸

CalPrivacy fined Datamasters $45,000 and barred its sale of Californians' information, while separately fining S&P Global $62,600 for data-broker registration failures.

8 January 2026 Enforcement

🇺🇸

CalPrivacy launched DROP, allowing Californians to send one request to hundreds of registered data brokers to delete and stop selling their personal information.

1 January 2026 Regulation