Court Rules

Privacy Enforcement Tracker

1,788 enforcement actions from 16 federal and state jurisdictions. Every event traced back to its official government source.

1,788

Total Actions

16

Jurisdictions

$51.8B+

Total Fines Tracked

Access this data programmatically:MCP Server API Docs
TXEnforcement Action

ActBlue

Texas Attorney General Ken Paxton appealed a Massachusetts federal court order that blocked his office from proceeding with a Texas lawsuit against ActBlue under the Texas Deceptive Trade Practices Act. The lawsuit alleges ActBlue misrepresented that it no longer accepted gift card donations. The appeal seeks to reverse the preliminary injunction.

LowNotice Failure
MNSettlementMultistate

GS Labs

Attorney General Ellison announced a $4.87 million multistate settlement with GS Labs for overcharging patients, charging unlawful administrative fees, and failing to deliver timely COVID-19 test results. The settlement includes $3.63 million in restitution to affected consumers and $1.25 million to the multistate group, along with injunctive relief if GS Labs resumes operations.

MediumNotice FailureConsent Failure
MNEnforcement Action

Bridge It, Inc.

Minnesota Attorney General Keith Ellison filed a lawsuit against Bridge It, Inc. (doing business as Brigit) for violating Minnesota's payday lending laws. The lawsuit alleges Brigit operates as an unlicensed lender making short-term loans with APRs exceeding 300%, without disclosing rates or complying with state interest caps and disclosure requirements.

LowNotice FailureConsent Failure
COEnforcement ActionMultistate

State of Maryland, et al. v. Hegseth, et al.

Attorney General Phil Weiser joined a coalition of 20 attorneys general in suing the Trump administration over new federal contract terms that impose unclear requirements on contractors regarding diversity, equity, and inclusion (DEI). The lawsuit alleges the federal agencies violated the Administrative Procedure Act by failing to provide public notice or accept comments, exceeding their legal authority, and not adequately explaining the new requirements. The coalition seeks to enjoin the agencies from imposing the new contract terms.

LowNotice Failure
COSettlementMultistate

GS Labs

Colorado Attorney General Phil Weiser and a bipartisan coalition of 18 attorneys general announced a $4.87 million settlement with GS Labs, a former COVID-19 rapid testing business. The company was found to have violated the Colorado Consumer Protection Act by falsely advertising test results with no wait times, same day appointments, and no out-of-pocket expenses, while overcharging consumers and insurance providers.

HighNotice FailureConsent Failure

$4.9M

FTCSettlement

Illuminate Education Inc.

The FTC finalized a consent order against Illuminate Education Inc. for failing to secure students' personal data, leading to a breach affecting 10.1 million students. The order requires Illuminate to implement a data security program, delete unnecessary data, and limit data collection, but imposes no monetary penalty.

LowSecurity FailureData BreachChildren's Data
NJEnforcement Action

Xiao Hu

The New Jersey Bureau of Securities filed a lawsuit against Xiao Hu (aka Mark Hu) and his companies Skyline Technology USA LLC and Thunderbirds.ME, Inc. for allegedly defrauding at least 15 investors out of $2.5 million through unregistered securities offerings. Hu allegedly misappropriated at least $280,000 for personal expenses including a home purchase and vacation, and falsely claimed to have a Ph.D. from Columbia University.

LowConsent FailureNotice Failure
FTCEnforcement Action

X Corp.

The Federal Trade Commission is seeking public comment on a petition from X Corp., formerly known as Twitter, to set aside or modify its 2022 settlement order with the agency. The petition argues that the order no longer serves a valid regulatory purpose and that X Corp. has built a world-class privacy program. The Commission will vote after the comment period closes.

LowConsent FailureNotice Failure
FTCEnforcement Action

National Amendment Assistance

The FTC filed a complaint against National Amendment Assistance and related entities for allegedly deceiving homeowners into paying unlawful upfront fees for mortgage relief services falsely associated with the CARES Act. The court granted a temporary restraining order, and the FTC seeks redress for affected consumers.

LowConsent FailureNotice Failure
FTCSettlementMultistate

American Tax Service (ATS)

The FTC and State of Nevada settled charges against the operators of American Tax Service for impersonating federal and state government tax authorities and making false promises of tax debt relief. The defendants will surrender over $8 million in cash and assets and are banned from debt relief services, tax preparation, telemarketing, and impersonation.

HighNotice Failure

$8.0M

CAEnforcement ActionMultistate

Meta Platforms, Inc.

A bipartisan coalition of state attorneys general began trial against Meta Platforms, Inc., alleging the company knowingly designed addictive features on Facebook and Instagram that harm children and teens, deceived parents about platform safety, and illegally collected personal information from children under 13 without parental consent in violation of COPPA. The states seek monetary penalties, an injunction to stop unlawful practices, and other relief. The trial is being litigated in the U.S. District Court for the Northern District of California.

HighChildren's DataConsent FailureDark Patterns
NJInvestigationMultistate

FIFA

New Jersey and New York Attorneys General announced an investigation into FIFA's ticketing practices for the 2026 World Cup. The investigation focuses on reports that fans were misled about seat locations, faced soaring prices due to variable pricing, and did not receive the tickets they paid for. Subpoenas have been sent to FIFA seeking information about its ticketing practices for matches hosted in New Jersey.

LowNotice FailureConsent FailureDark Patterns
COEnforcement Action

Xinbi Co., Ltd.

The Colorado Attorney General announced a major enforcement sweep targeting thousands of fraudulently filed businesses that used false information in Colorado registrations to facilitate scams including cryptocurrency fraud, investment fraud, and romance scams. The lawsuits seek court orders to dissolve these entities and the AG's office worked to take down associated websites.

LowNotice FailureConsent Failure
FTCSettlement

Cox Media Group

The FTC alleged that Cox Media Group (CMG), MindSift LLC, and 1010 Digital Works LLC deceived customers by falsely claiming to offer an AI-powered 'Active Listening' service that could target ads based on conversations captured from consumers' smart devices, and that consumers had opted into such targeting. In reality, the service did not use voice data and consumers had not consented. The companies agreed to pay a total of $930,000 and are prohibited from making misrepresentations about their services, voice data collection, and consumer consent.

MediumConsent FailureNotice FailureUnauthorized Data Sharing

$930K

NJGuidance

New Jersey Division of Consumer Affairs

The New Jersey Attorney General and Division of Consumer Affairs issued guidance warning hotels and short-term rental providers against charging hidden junk fees to consumers ahead of the 2026 FIFA World Cup. The guidance reminds businesses that New Jersey's consumer protection laws and the FTC's Unfair or Deceptive Fees Rule require transparent pricing and prohibit deceptive fee practices. No monetary penalties were imposed, but businesses are put on notice that violations may lead to enforcement actions.

LowNotice FailureConsent Failure
COSettlement

AIH Enterprises, LLC

The Colorado Attorney General shut down Smokin' Genie, a Fort Collins smoke shop owned by AIH Enterprises, LLC, and banned its owner from the industry for five years after the shop illegally sold kratom to a minor and failed to properly label kratom products. The settlement requires the store to cease operations, destroy inventory, and pay $200,000 if they violate the terms.

LowNotice FailureConsent Failure
TXInvestigation

Meta (formerly known as Facebook)

Texas Attorney General Ken Paxton launched an investigation into Meta's Meta AI Glasses over allegations of unlawful facial biometric data collection, deceptive privacy practices, and unauthorized sharing of user data with subcontractors. The investigation follows concerns that the glasses' always-on recording mode lacks proper user notice, planned facial recognition features would collect data without consent, and private user videos are accessed by third-party annotators in Kenya. The AG issued a Civil Investigative Demand to Meta to determine violations of Texas privacy laws.

LowBiometric DataConsent FailureUnauthorized Data Sharing
TXInvestigation

Meta

Texas Attorney General Ken Paxton launched an investigation into Meta regarding its Meta AI Glasses, alleging unlawful collection of facial biometric data, deceptive privacy representations, and unauthorized sharing of user data with subcontractors. The investigation follows concerns that the glasses’ always-on recording mode lacks proper notice, subcontractors access private user content including intimate moments, and Meta plans to deploy facial recognition technology to collect unsuspecting individuals’ facial geometry. The AG issued a Civil Investigative Demand to determine if Meta violated Texas law by deceptively misrepresenting its data use practices.

LowBiometric DataNotice FailureConsent Failure
FTCSettlement

Shutterstock Inc.

Shutterstock Inc. agreed to pay $35 million to settle FTC allegations that it charged consumers without their informed consent, failed to disclose auto-renewal and cancellation terms, and made cancellation difficult. The FTC alleged Shutterstock's subscription and on-demand pack offerings violated consumer protection laws through hidden fees and complicated cancellation processes.

CriticalConsent FailureNotice FailureDark Patterns

$35.0M

CASettlementMultistate

General Motors

California Attorney General Rob Bonta, along with multiple district attorneys and the California Privacy Protection Agency, announced a $12.75 million settlement with General Motors for illegally selling hundreds of thousands of Californians' location and driving data to data brokers Verisk and LexisNexis without notice or consent. The settlement includes the largest CCPA penalty to date, a five-year ban on selling driving data to consumer reporting agencies, and requirements to delete retained data and implement a robust privacy program.

CriticalGeolocation DataUnauthorized Data SharingNotice Failure

$12.8M

CAGuidance

California Privacy Protection Agency

The California Privacy Protection Agency sent a letter to Congress opposing the SECURE Data Act, a federal bill that would preempt state privacy laws like the CCPA and Delete Act. The letter argues the bill would eliminate rights for 40 million Californians, including the DROP platform and opt-out preference signal requirements, and urges Congress to set a floor rather than a ceiling on privacy protections.

LowNotice FailureOpt-Out FailureData Broker Non-Compliance
FTCEnforcement Action

Innovative Partners, LP; American Collective, LP; Papyrus Green Investments LLC; Health Plan Administrators, LLC; Amani Ibrahim Shokry; Ahmed Ibrihim Shokry

The FTC filed a complaint and obtained a temporary restraining order against six defendants operating a deceptive health care scheme that impersonated government and insurance carriers to sell fake comprehensive health plans. The defendants allegedly charged consumers without express informed consent, failed to disclose material terms including cancellation processes, and misled consumers into paying for inadequate coverage that left many with substantial medical debt. The FTC seeks refunds for affected consumers and alleges violations of the FTC Act, Telemarketing Sales Rule, Impersonation Rule, and Gramm-Leach-Bliley Act.

LowConsent FailureNotice Failure
FTCEnforcement Action

Innovative Partners

The FTC filed a complaint against Innovative Partners in April 2026, alleging the operators impersonate the government and large insurance carriers to deceive consumers seeking health insurance into buying supposedly comprehensive PPO plans that do not offer the coverage they seek.

LowNotice Failure
FTCSettlement

Humor Rainbow, Inc. and Match Group Americas

The FTC settled with Humor Rainbow, Inc. (operator of OkCupid) and Match Group Americas over allegations that OkCupid deceived users by sharing personal data including photos and location information with an unauthorized third party, contrary to its privacy policy promises to inform users and provide opt-out opportunities. The settlement permanently prohibits the companies from misrepresenting their data collection, use, disclosure, and privacy control practices. No monetary penalty was imposed.

LowOpt-Out FailureNotice FailureUnauthorized Data Sharing
FTCConsent Decree

Air AI

Consumer fraud enforcement action where the FTC settled with Air AI for misleading entrepreneurs with false earnings and refund guarantees. The company will be banned from marketing business opportunities and pay a suspended $18 million judgment with $50,000 for consumer relief. Violations included failure to provide required disclosures and false claims under the Telemarketing Sales Rule and Business Opportunity Rule.

CriticalNotice Failure

$18.0M

OREnforcement ActionMultistate

U.S. Department of Agriculture

Consumer protection and civil rights lawsuit filed by Oregon AG and 20 other states against the U.S. Department of Agriculture over unlawful funding conditions that coerce states into complying with policies unrelated to nutrition programs. The conditions relate to immigration, DEI, and gender identity, and are alleged to violate the Spending Clause and Administrative Procedure Act. The suit seeks to block these conditions to protect billions in funding for programs like SNAP, WIC, and school lunches that serve vulnerable populations.

CriticalNotice Failure
FTCSettlement

Xponential Fitness

Consumer fraud enforcement action where the FTC settled with Xponential Fitness for violating the Franchise Rule by misrepresenting key information to franchisees, including time to open and costs. The settlement includes a $17 million monetary judgment for redress and prohibits future misrepresentations.

CriticalNotice Failure

$17.0M

OREnforcement ActionMultistate

Department of Education

Privacy enforcement action where Oregon AG and a coalition of 16 other states sue the Trump Administration to stop the Department of Education's new IPEDS data reporting requirements, arguing they jeopardize student privacy, lack proper definitions, and risk data errors and identification.

LowUnauthorized Data SharingNotice FailureSecurity Failure
CTEnforcement ActionMultistate

Department of Education

Connecticut Attorney General William Tong, joined by 17 other attorneys general, filed a lawsuit against the U.S. Department of Education to block new IPEDS data reporting requirements that demand student information disaggregated by race and sex. The coalition argues the rushed implementation is unlawful, invades student privacy, and risks unreliable data and baseless investigations. They seek an injunction to halt the data collection and protect student privacy.

LowStudent DataNotice Failure
CPPASettlement

PlayOn Sports

The California Privacy Protection Agency settled with PlayOn Sports for $1.10 million over CCPA violations, including failing to provide adequate opt-out mechanisms and improperly tracking users, particularly students. The company must implement proper opt-out methods, improve disclosures, and comply with children's data consent requirements.

HighOpt-Out FailureNotice FailureChildren's Data

$1.1M

Explore Enforcement Data