United States Enforcement News

🇺🇸

SalesIntel must pay $36,400, publish rights metrics and process DROP requests after operating without timely California data-broker registration.

1 September 2026 Enforcement

🇺🇸

Azul Vision paid $50,000 and accepted two years of monitoring after providing requested records almost two years after the initial request.

27 August 2026 Enforcement

🇺🇸

Cox Media Group and two firms must pay $930,000 after claiming an ad service listened to smart-device conversations and that consumers had opted in, though it did neither.

27 August 2026 Enforcement

🇺🇸

LocateSmarter was fined $116,490 after late registration and requiring partial Social Security numbers before Californians could opt out.

11 August 2026 Enforcement

🇺🇸

OSF paid $552,250 and accepted two years of monitoring after a ransomware incident exposed health information of 53,907 people.

29 July 2026 Enforcement

🇺🇸

The complaint alleges the telehealth provider sent sensitive condition-related data to Meta, Snap and others despite privacy promises, alongside subscription-practice claims.

29 July 2026 Enforcement

🇺🇸

The regulator's first sectoral audit will test whether major gig platforms honor access and control rights for consumers and independent-contractor workers.

21 July 2026 Enforcement

🇺🇸

A 43-jurisdiction coalition resolved claims arising from the 2023 breach affecting 6.9 million users and imposed new security, deletion and governance requirements.

14 July 2026 Enforcement

🇺🇸

The FTC and DOJ alleged RentGrow duplicated criminal and eviction records, omitted data sources from disclosures and mishandled disputes in tenant screening.

9 July 2026 Enforcement

🇺🇸

The FTC and DOJ alleged Amazon repeatedly failed to provide identity-theft victims with transaction records within the FCRA's 30-day deadline.

30 June 2026 Enforcement

🇺🇸

A federal stipulated order restricts Kochava and its subsidiary from selling or disclosing location data capable of tracing visits to sensitive places without consumer consent.

26 June 2026 Enforcement

🇺🇸

The employer-sponsored health plan paid $200,000 and accepted two years of monitoring after OCR identified potential HIPAA risk-analysis and disclosure violations.

18 June 2026 Enforcement

🇺🇸

Illuminate must delete unnecessary data, limit collection and retention and operate a security programme after a breach exposed data concerning 10.1 million students.

5 June 2026 Enforcement

🇺🇸

LG agreed to stop using automated content recognition to collect Texans' viewing data without informed consent, clearer disclosures and a simple opt-out.

11 May 2026 Enforcement

🇺🇸

California alleged GM retained and sold location and driving data without adequate knowledge or consent, securing a $12.75 million penalty and deletion, consent and governance terms.

8 May 2026 Enforcement

🇺🇸

Four organizations paid a combined $1.165 million and accepted two-year corrective plans after OCR investigations into ransomware breaches and risk-analysis failures.

23 April 2026 Enforcement

🇺🇸

The FTC alleged OkCupid gave an unrelated company access to nearly three million user photos plus location data contrary to its privacy promises and without formal use restrictions.

30 March 2026 Enforcement

🇺🇸

HHS OCR settled with software business associate MMG Fusion over an unreported incident affecting about 15 million people and imposed a three-year corrective plan.

5 March 2026 Enforcement

🇺🇸

CalPrivacy's first student-and-schools decision required PlayOn Sports to pay $1.1 million and change privacy practices across its GoFan and school-sports services.

3 March 2026 Enforcement

🇺🇸

Samsung agreed to stop collecting or processing automated-content-recognition viewing data from Texas consumers without express consent and clearer disclosures.

26 February 2026 Enforcement

🇺🇸

California alleged Disney failed to apply sale-and-sharing opt-outs across linked devices and streaming services, requiring a $2.75 million penalty and account-wide controls.

11 February 2026 Enforcement

🇺🇸

The FTC finalized a 20-year order requiring consent and consumer controls for connected-vehicle data and barring certain disclosures to consumer reporting agencies for five years.

14 January 2026 Enforcement

🇺🇸

CalPrivacy fined Datamasters $45,000 and barred its sale of Californians' information, while separately fining S&P Global $62,600 for data-broker registration failures.

8 January 2026 Enforcement