United States
US privacy fines and settlements
The United States has no single privacy regulator. The FTC acts on unfair or deceptive practices, the California Attorney General and the California Privacy Protection Agency enforce the CCPA, HHS enforces HIPAA, and other state attorneys general use their own laws.
Most US outcomes are settlements in which the company did not admit wrongdoing, so each summary says what the regulator alleged or found. Ignoring a browser opt-out signal such as Global Privacy Control is a recurring failure.
Last checked . Amounts are in the original currency; conversions are approximate.
Fines, largest first
-
US$1.4bn about £1.09bn
Meta Platforms (formerly Facebook)
Texas said Facebook's Tag Suggestions feature ran facial recognition on faces in uploaded photos for over a decade without informing Texans or getting consent. This first settlement under the Texas biometric law is payable over five years.
Texas Capture or Use of Biometric Identifier Act (CUBI) / Texas DTPA
Read the TX-AG decision on Meta Platforms (formerly Facebook) -
US$1.38bn about £1.05bn
Google
Texas said Google signed a settlement resolving two state lawsuits over tracking the location, incognito browsing activity and biometric identifiers of Texans.
Texas state law (location, incognito and biometric claims)
Read the TX-AG decision on Google -
US$220m about £165m
General Motors
A coalition of 36 attorneys general said GM enrolled drivers in its Smart Driver program from 2016 to 2024 and sold their driving and location data to data brokers, who passed it to insurers that used it to set premiums. Connecticut receives more than 6 million dollars.
Connecticut Data Privacy Act (CTDPA) and other state laws
Read the CT-AG decision on General Motors -
US$7.8m about £5.95m
BetterHelp, Inc.
The FTC found the online counselling service gave email addresses, IP addresses and answers from its health intake questionnaire to Facebook, Snapchat, Criteo and Pinterest for ad targeting. The final order bans sharing health data for advertising, and the 7.8 million dollar payment funds consumer refunds.
FTC Act s5
Read the FTC decision on BetterHelp, Inc. -
US$7m about £5.61m
Cerebral, Inc.
The FTC alleged the telehealth company exposed sensitive data of nearly 3.2 million people to LinkedIn, Snapchat, TikTok and others through tracking tools on its website and apps, and made cancelling difficult. The proposed order bans using or disclosing health data for advertising.
FTC Act s5 / ROSCA / Opioid Addiction Recovery Fraud Prevention Act
Read the FTC decision on Cerebral, Inc. -
US$2.75m about £2.01m
The Walt Disney Company
The Attorney General said Disney's opt outs, including Global Privacy Control signals, only covered one device or service while embedded third party ad tech kept receiving data. The settlement requires opt outs that stop sale and sharing across a logged in account.
CCPA
Read the CA-AG decision on The Walt Disney Company -
US$1.5m about £1.19m
Warby Parker, Inc.
After credential stuffing attacks let outsiders into nearly 198,000 customer accounts on the eyewear retailer's website, OCR found no accurate risk analysis, inadequate risk reduction and no regular review of system activity. Warby Parker did not contest the civil money penalty.
HIPAA Security Rule
Read the HHS-OCR decision on Warby Parker, Inc. -
US$1.5m about £1.22m
GoodRx Holdings Inc.
The FTC said the prescription discount platform passed users' health information to Facebook, Google, Criteo and others for advertising and never notified anyone of those disclosures. It was the first enforcement action under the Health Breach Notification Rule and bans GoodRx from sharing health data for advertising.
FTC Act s5 / Health Breach Notification Rule
Read the FTC decision on GoodRx Holdings Inc. -
US$1.55m about £1.13m
Healthline Media LLC
The Attorney General said the health publisher kept sharing data with ad partners after users opted out, including via Global Privacy Control, shared article titles hinting at medical diagnoses for ad targeting, lacked required contracts, and ran a cookie banner that did not actually switch off tracking.
CCPA / Unfair Competition Law
Read the CA-AG decision on Healthline Media LLC -
US$1.2m about £1.02m
Sephora, Inc.
Landmark first CCPA settlement: the Attorney General said the retailer did not tell shoppers it was selling their data, ignored opt out signals sent through Global Privacy Control, and did not cure within 30 days.
CCPA
Read the CA-AG decision on Sephora, Inc. -
US$1.35m about £1m
Tractor Supply Company
The CPPA's largest fine to date: the agency said the retailer's website did not honour Global Privacy Control or offer an effective opt out, its consumer and job applicant privacy notices were inadequate, and it shared data without required contracts.
CCPA
Read the CPPA decision on Tractor Supply Company -
US$633k about £489k
American Honda Motor Co.
The CPPA said Honda demanded identity verification and excess data for opt out requests, used a privacy choice tool that did not present options symmetrically, made it hard to use authorised agents, and shared data with ad tech firms without required contracts.
CCPA
Read the CPPA decision on American Honda Motor Co. -
US$375k about £297k
DoorDash
The Attorney General said DoorDash gave California customers' names, addresses and order histories to a marketing co-op in exchange for advertising reach, which counts as a sale, with no notice, no opt out and no disclosure in its privacy policy.
CCPA / CalOPPA
Read the CA-AG decision on DoorDash -
US$345k about £258k
Todd Snyder, Inc.
The CPPA said the clothing retailer's misconfigured privacy portal left opt out requests unprocessed for 40 days, and that it asked for more information than needed and required identity verification before people could opt out.
CCPA
Read the CPPA decision on Todd Snyder, Inc. -
US$193k about £156k
DoNotPay
Part of the FTC's Operation AI Comply sweep: the FTC found the 'robot lawyer' service could not support claims that its AI chatbot matched a human lawyer. The final order requires 193,000 dollars in monetary relief and notice to 2021 to 2023 subscribers.
FTC Act s5
Read the FTC decision on DoNotPay -
US$182k about £135k
Cadia Healthcare Facilities
OCR found five Delaware care providers posted names, photos and treatment details of 150 patients as website 'success stories' without written HIPAA authorisation, and gave no breach notice. They paid 182,000 dollars and accepted a two year monitored corrective action plan.
HIPAA Privacy Rule / Breach Notification Rule
Read the HHS-OCR decision on Cadia Healthcare Facilities -
US$100k about £80k
Easy Healthcare Corporation (Premom)
The FTC said the developer of the Premom ovulation tracking app shared users' health data through third party SDKs, including with Google, AppsFlyer and two China based firms, without telling users. The order bans sharing health data for advertising; Connecticut, DC and Oregon obtained a further 100,000 dollars in total.
FTC Act s5 / Health Breach Notification Rule
Read the FTC decision on Easy Healthcare Corporation (Premom) -
US$85k about £63k
TicketNetwork, Inc.
The Attorney General said the ticket marketplace's privacy notice was hard to read and left out key rights, its rights request mechanisms did not work, and it fixed the problems 346 days after the cure deadline.
Connecticut Data Privacy Act (CTDPA)
Read the CT-AG decision on TicketNetwork, Inc.
Orders, reprimands and findings
-
Order or finding
Kochava Inc. and Collective Data Solutions
Settling litigation filed in 2022, the FTC announced an order barring the data broker and its subsidiary from selling sensitive location data without affirmative express consent, with a sensitive location program, supplier checks and an easy way to withdraw consent. No money penalty.
FTC Act s5
Read the FTC decision on Kochava Inc. and Collective Data Solutions -
Order or finding
Mobilewalla Inc.
The FTC found the data broker gathered consumer data from real time bidding ad exchanges and sold sensitive location data without consent. The order bans selling sensitive location data and collecting bid request data for anything other than taking part in the auction.
FTC Act s5
Read the FTC decision on Mobilewalla Inc. -
Order or finding
Gravy Analytics and Venntel
The FTC found the location data broker and its subsidiary sold data revealing visits to healthcare facilities and places of worship, and kept using data after learning consent had not been obtained. The final order bans selling or using sensitive location data.
FTC Act s5
Read the FTC decision on Gravy Analytics and Venntel -
Order or finding
InMarket Media, LLC
The FTC said the marketing data aggregator collected location data through its SDK in third party apps without making sure users gave informed consent, and used it for ad targeting. The final order bars selling precise location data and targeting people based on sensitive locations.
FTC Act s5
Read the FTC decision on InMarket Media, LLC -
Order or finding
X-Mode Social, Inc. and Outlogic, LLC
First FTC order banning a data broker from selling sensitive location data, such as visits to medical clinics and places of worship. The company must keep a sensitive locations list, vet its data suppliers and adopt a retention schedule.
FTC Act s5
Read the FTC decision on X-Mode Social, Inc. and Outlogic, LLC -
Order or finding
Monument, Inc.
The FTC said the online alcohol addiction treatment service sent health information of up to 84,000 users to Meta and Google through tracking pixels and APIs despite promising confidentiality. The order bans disclosing health data for advertising.
FTC Act s5 / Opioid Addiction Recovery Fraud Prevention Act
Read the FTC decision on Monument, Inc. -
Order or finding
Rite Aid Corporation
The FTC said the pharmacy chain used AI facial recognition in hundreds of stores without reasonable safeguards, producing false shoplifter matches that fell disproportionately on women and people of colour. The order bans its use of facial recognition for surveillance for five years.
FTC Act s5 / 2010 FTC data security order
Read the FTC decision on Rite Aid Corporation -
Order or finding
Flo Health Inc.
Landmark earlier case: the FTC found the period and fertility tracking app shared users' health data with marketing and analytics firms including Facebook and Google despite privacy promises. The final order requires affirmative consent before sharing health data, notice to users and an independent privacy review, with no money penalty.
FTC Act s5
Read the FTC decision on Flo Health Inc.
Laws, deadlines and guidance
-
Law and guidance
Indiana Consumer Data Protection Act: Consumer Data Bill of Rights
Indiana's comprehensive consumer data protection law took effect on 1 January 2026. It gives residents rights over how their data is used, sold or shared, including deletion and correction, and the Attorney General enforces it.
Indiana Consumer Data Protection Act
Read the IN-AG decision on Indiana Consumer Data Protection Act: Consumer Data Bill of Rights -
Law and guidance
California Finalizes Regulations to Strengthen Consumers' Privacy
California's updated CCPA regulations on automated decisionmaking technology, risk assessments and cybersecurity audits took effect on 1 January 2026. ADMT duties for significant decisions apply from 1 January 2027, risk assessment attestations are due 1 April 2028, and audit certifications are phased from 2028 to 2030 by revenue.
CCPA regulations
Read the CPPA decision on California Finalizes Regulations to Strengthen Consumers' Privacy -
Law and guidance
FTC Finalizes Changes to Children's Privacy Rule Limiting Companies' Ability to Monetize Kids' Data
The FTC finalised COPPA Rule changes requiring separate parental consent before disclosing children's data to third parties for targeted advertising, limiting retention, and adding biometric identifiers to personal information. The rule takes effect 60 days after Federal Register publication, with one year to comply for most changes.
COPPA Rule (16 CFR Part 312)
Read the FTC decision on FTC Finalizes Changes to Children's Privacy Rule Limiting Companies' Ability to Monetize Kids' Data -
Law and guidance
Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
OCR's guidance on online tracking technologies says regulated entities may not use trackers in a way that leaks health data to vendors. On 20 June 2024 a Texas federal court vacated the part saying HIPAA applies when a tracker links an IP address to a visit to an unauthenticated public health page; the rest of the guidance stands.
HIPAA Privacy Rule
Read the HHS-OCR decision on Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
Would your website pass?
The free Trust Center scan checks the failures behind these decisions: trackers before consent, advertising pixels, security headers, where visitor data goes, privacy requests and AI tools.
How this list is built
- Every record links to the regulator's own decision, press release, the official journal or a court judgment. Trackers and news coverage are used only to find cases.
- The amount, date and organisation were read on that page. Where a regulator first proposed a different amount, the final one is shown.
- Status follows the regulator: final, reduced, or under appeal. Decisions overturned in court are removed from this list.
- Summaries are our own words and describe what the regulator found. They are not legal advice.
- Conversions use the European Central Bank reference rate on the decision date. The data is also available as JSON at /api/fines.