Penalty Amount
$2,000,000
Consumers Affected
22,000,000
New Jersey joined a multistate $2 million settlement with online retailer CafePress over a 2019 data breach that exposed personal information of approximately 22 million consumers nationwide, including over 540,000 in New Jersey. The settlement requires CafePress to implement a comprehensive cybersecurity program, incident response plan, and third-party assessments for five years, with payment suspended pending compliance.
CafePress must pay $2 million (with $750,000 immediate, including $98,368 to New Jersey), implement a comprehensive information security program with regular updates and CEO reporting, develop an incident response and breach notification plan, enhance personal information safeguards (encryption, segmentation, penetration testing, password management, data minimization), provide clear consumer notice regarding account closure and data deletion, and undergo third-party security assessments for five years. The remaining balance is suspended contingent on compliance.
In-house legal teams should review vendor agreements, customer terms of service, and data processing agreements for clauses addressing data security, breach notification, and incident response. Specifically, examine requirements for encryption of sensitive data (e.g., SSNs, payment details), timelines for breach reporting, obligations to conduct third-party security assessments, and data retention/disposal policies. Changes may include mandating a comprehensive cybersecurity program, implementing regular risk assessments, strengthening access controls, and ensuring compliance with state data breach notification laws. Also, assess indemnification provisions for breach-related costs and audit rights to monitor vendor compliance.
Entity
CafePress
Industry
RetailOfficial Press Release
https://www.njoag.gov/ag-grewal-joins-2-million-settlement-with-online-retailer-cafepress-over-2019-data-breach/
121820 CafePress AVC
https://www.nj.gov/oag/newsreleases20/121820-CafePress-AVC.pdf
New Jersey Attorney General Enforcement Page
https://www.njoag.gov/about/divisions-and-offices/division-of-consumer-affairs/
"settlement with internet retailer CafePress"
"total payment to the states of $2 million"
"The data breach compromised the personal information of approximately 22 million consumers nationally"
$500K
The FTC finalized an order against CafePress for failing to secure consumer data and covering up a data breach. The company must implement comprehensive security measures, and its former owner must pay $500,000 in redress to victims.
$370K
The FTC settled with CafePress for failing to implement reasonable data security measures, leading to multiple breaches that exposed Social Security numbers and other sensitive data. As part of the settlement, over $370,000 in refunds are being distributed to 20,044 consumers who filed valid claims.
$650K
The New Jersey Attorney General and Division of Consumer Affairs announced that Match Group, Inc. will pay $650,000 and change its business practices to settle allegations that it misrepresented or failed to disclose its criminal background screening policies and practices to New Jersey users, violating the New Jersey Consumer Fraud Act and the Internet Dating Safety Act. Under a Consent Order, Match must accurately represent its screening policies, notify existing New Jersey members of updated disclosures within 150 days, and post clear and conspicuous disclosures and safety notifications about the limitations of criminal background screenings.
On August 31, 2026, New Jersey Attorney General Jennifer Davenport and the Division of Consumer Affairs joined the FTC and a bipartisan coalition of 21 other states in suing Amazon, alleging that for over seven years the company secretly rigged its advertising auctions—converting advertised 'second price' auctions into first-price auctions with hidden 'soft reserve price' surcharges—overcharging more than 500,000 small- and medium-sized businesses and extracting tens of billions of dollars. The complaint alleges Amazon actively concealed the surcharges, gave false and misleading answers to advertisers who asked directly about the auction format, and applied inflated upcharges on high-volume shopping days like Prime Day and Black Friday. The lawsuit was just filed; no penalties or remedies have been imposed yet.
A bipartisan coalition of state attorneys general led by New Jersey, California, Colorado, and Kentucky is taking Meta Platforms, Inc. to trial, alleging that Meta designed addictive features on Instagram and Facebook that harm minors' mental health, illegally collected data from children under 13 without the required protections under COPPA, and misled users about platform safety. Opening arguments begin August 18, 2026, in the U.S. District Court for the Northern District of California. No monetary penalty or final remedy has yet been imposed.
A coalition of 21 state attorneys general and Pennsylvania filed lawsuits against the Trump Administration, DOT, FMCSA, DHS, and AAMVA to prevent the unlawful demand for a database containing personal information of 17 million commercial driver's license holders. The lawsuits allege violations of federal privacy laws and the Administrative Procedure Act, and seek an emergency order to block the data transfer.