1,788 enforcement actions from 16 federal and state jurisdictions. Every event traced back to its official government source.
1,788
Total Actions
16
Jurisdictions
$51.8B+
Total Fines Tracked
Connecticut Attorney General William Tong issued a statement regarding a consent decree secured with Warner Bros./Paramount to protect editorial independence of CNN and CBS News. The consent decree establishes an editorial board structure, though the AG expressed disappointment that full divestiture was not achieved.
Colorado Attorney General Phil Weiser joined a coalition of 12 attorneys general in settling a lawsuit against Paramount Skydance Corporation over its merger with Warner Bros. Discovery, which the states alleged would harm competition by lowering film output and raising prices. The settlement includes a five-year commitment to increase film output, a $1.5 billion investment in domestic production, a $47.5 million worker fund, and an independent monitor. This is an antitrust/competition enforcement action, not a privacy enforcement action, despite the extraction schema's privacy focus.
Attorney General Jay Jones and a coalition of 24 attorneys general obtained a preliminary injunction blocking the Trump administration from demanding a database of state-owned records containing personal information of 17 million CDL drivers from AAMVA and from terminating over $10 million in federal funding. The lawsuits allege DOT, FMCSA, and DHS violated federal privacy laws by secretly creating a database with no guardrails on use or sharing of Social Security numbers and no public notice.
Texas Attorney General Ken Paxton issued a consumer alert warning Texas businesses and nonprofits about a surge of demand letters alleging California Invasion of Privacy Act (CIPA) violations based on common website technologies such as cookies, pixels, and analytics tools. The AG cautions that some letters may exaggerate or misrepresent violations and may be fraudulent, noting serial CIPA plaintiff Vivek Shah has been declared a vexatious litigant. Recipients are advised not to pay or respond directly, to consult privacy counsel, and to report suspected fraud to the Consumer Protection Division.
New York Attorney General Letitia James issued an industry alert urging workers with knowledge of unsafe or illegal conduct in AI development to file confidential complaints through the OAG's secure whistleblower portal. The alert cites the OAG's monitoring of cybersecurity, economic, and other safety risks from emerging AI, and highlights the RAISE Act (effective January 1, 2027), which will require large AI developers to publicly disclose safety measures and report security incidents, as well as the SHIELD Act's data security requirements. No company was named, charged, or penalized; the alert signals impending OAG enforcement authority over AI developers.
Virginia Attorney General Jay Jones announced that Governor Spanberger's declaration of a state of emergency due to prolonged, severe drought has triggered Virginia's anti-price gouging statutes, making it unlawful to charge unconscionable prices for necessary goods and services. A price is unconscionable if it grossly exceeds the price charged during the ten days immediately prior to the emergency. No entity was charged or fined; the release is a consumer advisory explaining how to report suspected price gouging to the Attorney General's Consumer Protection Section.
Colorado Attorney General Phil Weiser announced a settlement with Sares Regis Group, a Denver-metro property management company, after an investigation found it told prospective tenants that rental subsidies and housing vouchers were not accepted at its properties, in violation of the Colorado Anti-Discrimination Act and the Colorado Consumer Protection Act. Under the settlement, the company must adopt written source-of-income policies, train leasing employees, submit a compliance report to the AG's office, and refrain from misrepresenting its voucher acceptance, and it pays $30,000 to the Housing Rights Initiative. Note: this is a fair-housing enforcement action, not a privacy matter, so no privacy violation taxonomy categories apply.
$30K
Connecticut Attorney General William Tong issued an advisory that newly enacted privacy laws take effect October 1, 2026, including Public Act 26-64 (SB4), which amends the Connecticut Data Privacy Act, and Public Act 26-15 (SB5), which established the Connecticut Artificial Intelligence Responsibility and Transparency Act (CART Act). The new laws regulate surveillance pricing, facial recognition technology, genetic data collected by direct-to-consumer testing companies, a ban on the sale of precise geolocation data, a data broker registry, AI use in employment decisions, and chatbots offered to children. No enforcement action was taken; this is prospective guidance alerting consumers and businesses to new rights and compliance requirements.
FTC staff published FAQs on price transparency to help the automobile industry comply with the FTC Act, reiterating that an advertised vehicle price must be the actual price any consumer can pay, excluding only government-required charges. The guidance follows warning letters the FTC sent to 97 auto dealership groups earlier in 2026 and signals continued litigation against dealers that advertise one price but charge more through undisclosed fees. No specific entity was charged and no penalty was imposed.
New York Attorney General Letitia James led a bipartisan coalition of 17 other state attorneys general in sending a letter to Congress opposing the Digital Asset Market Clarity Act, warning that the bill would preempt state attorneys general authority to combat cryptocurrency fraud and scams. This is a legislative advocacy action, not an enforcement action against any company, and no penalties or remedies were imposed. The coalition urged Congress to preserve state enforcement power over both tokenized and non-tokenized securities and state crypto registration regimes.
Minnesota Attorney General Keith Ellison joined a bipartisan coalition of 16 attorneys general in a letter to U.S. Senate Banking Committee leaders opposing the Digital Asset Market Clarity Act, warning it would strip states of their ability to combat cryptocurrency scams and fraud. The letter cites over $10 million in crypto scam losses by Minnesotans in 18 months and urges Congress to preserve state registration regimes and enforcement authority. No company was charged and no penalty was imposed; this is legislative advocacy rather than an enforcement action.
Connecticut Attorney General William Tong joined a bipartisan coalition of 16 other state attorneys general in sending a letter to the U.S. Senate Banking Committee opposing the Digital Asset Market Clarity Act, warning it would preempt state authority to protect investors from cryptocurrency fraud and scams. The coalition urges Congress to preserve state enforcement, registration, and federal-state cooperation roles over digital assets. This is a legislative advocacy action, not an enforcement action — no entity was charged, no violations were found, and no penalty was imposed.
Minnesota Attorney General Ellison reached a settlement with Minnesota Valley Cooperative Light and Power Association resolving allegations of deceptive and unfair practices, including disconnecting a customer's electricity despite the customer's need for life-sustaining medical equipment and failing to properly notify customers of consumer protections or offer appropriate payment plans. Under the consent judgment, the cooperative must provide separate disconnection notices, offer written payment plans, maintain records for AG oversight, and forgive amounts owed by the affected consumer.
Virginia Attorney General Jay Jones, joined by a bipartisan coalition of 48 other attorneys general, sent a letter urging the FCC to strengthen its 'Know Your Upstream Provider' (KYUP) rules to keep illegal robocalls off the U.S. phone network. The coalition asks the FCC to mandate baseline vetting measures for upstream providers, add monitoring triggers, strengthen STIR/SHAKEN caller ID authentication, establish base penalties, and require retention of KYUP data. No company was fined in this action; it is regulatory advocacy that builds on the Anti-Robocall Multistate Litigation Task Force's Operation Robocall Roundup, which sent warning letters to 37 voice providers.
Minnesota Attorney General Keith Ellison filed a lawsuit in Hennepin County against C4D, LLC, its owners Travis Benoit and Steven Legatt, and related entity Five Points Properties, LLC, alleging 18 counts of violating the Minnesota Human Rights Act, federal lending laws, and state consumer-fraud and contract-for-deed laws. The complaint alleges the defendants sold homes through predatory contracts for deed with inflated prices, hidden finance charges, and large annual balloon payments that leave buyers immediately underwater and forfeit all equity upon default, while targeting Somali-American Muslims on the basis of religion and national origin — a form of 'reverse redlining.' The AG seeks an injunction, civil penalties, and cancellation or reformation of existing contracts; no penalty amounts have been determined.
The FTC rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices, which had purported to apply the Health Breach Notification Rule to health apps and connected devices that collect consumer health information. The rescission follows the Commission's 2024 update to the Health Breach Notification Rule, which already covers health apps and connected devices like fitness trackers, and implements an executive order directing agencies to eliminate obsolete guidance documents. No company was charged or penalized; this is a deregulatory action.
Connecticut Attorney General William Tong announced a civil investigative demand into MediaLab.AI Inc., owner of the Kik Messenger app, over lax age assurance practices, content moderation, and child safety failures that advocates have dubbed a "predator's paradise." The action follows a July 2025 notice of violation under the Connecticut Data Privacy Act for privacy notice deficiencies and processing sensitive data — including health, biometric, and precise geolocation data — without proper consent, which the company has only partially addressed. The new investigation seeks records related to practices that may constitute unfair or deceptive acts or practices under the CTDPA and the Connecticut Unfair Trade Practices Act. No fine has been imposed to date.
Oregon Attorney General Dan Rayfield, leading a bipartisan coalition of 48 other state and territorial attorneys general, sent a letter urging the FCC to strengthen its 'Know Your Upstream Provider' (KYUP) rule so phone companies must properly vet, continuously monitor, and cut ties with upstream providers that facilitate illegal robocalls and caller ID spoofing. The coalition asks the FCC to set minimum vetting standards, require periodic re-checks rather than one-time contract reviews, strengthen caller ID authentication across the call chain, impose meaningful penalties, and mandate record-keeping for investigators. No fine or injunction was imposed; the letter notes Americans received more than 29.6 billion scam robocalls and texts last year and lost nearly $2 billion to these scams.
CalPrivacy (the California Privacy Protection Agency) issued Enforcement Advisory 2026-01 warning data brokers that providing incorrect information in their annual registration with California's data broker registry carries liability of a $200 fine per day. The advisory observes that the Enforcement Division has already brought multiple enforcement actions over reporting errors, and emphasizes that accurate registry disclosures are what make the newly launched Delete Request and Opt-Out Platform (DROP) work for Californians. No specific company was named and no penalty was imposed by the advisory itself; it functions as forward-looking guidance.
Minnesota Attorney General Keith Ellison announced the first round of restitution, issuing 8 refund checks totaling $38,634 to consumers harmed by Omega Dental Care, a defunct Eden Prairie dental clinic owned and operated by Anne Soberay. The refunds, paid from the state's Consumer Protection Restitution Account (CPRA), compensate consumers who paid out of pocket for dental services that were never provided. The refunds follow an earlier settlement between the AG's office and Omega Dental Care and Soberay. Note: this is a consumer protection (non-delivery of services) action, not a privacy enforcement action; no privacy violation types from the taxonomy apply.
Attorney General William Tong issued a consumer alert warning Connecticut residents about unregulated, offshore decentralized finance (DeFi) cryptocurrency exchanges, naming GMX, Gains Network, dYdX, Aevo, Drift Protocol, Vertex Protocol, and Hyperliquid. The alert highlights risks including bypassing U.S. law via VPNs, predatory leverage up to 250x, misleading synthetic asset products, and lack of KYC protections. No enforcement action or penalty was imposed; at least one Connecticut consumer reportedly lost $200,000 deposited with an unregulated DeFi exchange.
The FTC announced a seven-day extension of the public comment period on its proposed enforcement policy statement regarding personalized pricing, pushing the deadline from Sept. 18, 2026 to Sept. 25, 2026. Personalized pricing refers to using personal data to set prices based on what the company believes an individual consumer is willing to spend. This is a procedural announcement about draft agency guidance, not an enforcement action against any company, and no entity was named, no violation found, and no penalty imposed.
New York Attorney General Letitia James issued a consumer alert (not an enforcement action) warning New Yorkers about scammers exploiting confusion from recent federal changes to student loan repayment programs, including the elimination of the SAVE plan and phase-out of income-driven repayment plans. The alert describes common scam tactics — upfront fees, false guarantees of loan forgiveness, manufactured urgency, demands for powers of attorney, and requests for federal student aid (FSA) credentials — and urges consumers to report scams to the OAG. No company was named, no violation was alleged against a specific entity, and no penalty was imposed.
New York Attorney General Letitia James issued a consumer alert warning borrowers about scammers exploiting recent federal changes to student loan repayment programs, including the elimination of the SAVE plan and phase-out of income-based plans. The alert provides tips for borrowers, including refusing upfront fees, never granting powers of attorney to unknown parties, and never sharing Federal Student Aid login credentials. No specific company was named and no penalties or remedies were imposed; this is an advisory alert, not an enforcement action.
The California Privacy Protection Agency Board issued a Decision and Final Stipulated Order requiring Virginia-based data broker SalesIntel Research, Inc. to pay a $36,400 fine for operating as a data broker without registering by the 2025 deadline under the Delete Act. SalesIntel sells consumer personal information, including more than 200 million professional contacts and de-anonymized website traffic data, for targeted advertising. In addition to the fine, the company must post privacy rights metrics on its website, integrate with CalPrivacy's Delete Request and Opt-out Platform (DROP), and process future deletion requests through that system.
$36K
Texas Attorney General Ken Paxton opened an investigation into TriWest Healthcare Alliance Corp., the U.S. government contractor that administers the VA Community Care Network and the Defense Health Agency's TRICARE West Region, over reports that it wrongfully denied health care claims by falsely treating insureds as having other health insurance (OHI). The OAG has issued Civil Investigative Demands (CIDs) and plans to interview consumers and employees to determine whether TriWest violated the Texas Deceptive Trade Practices Act. No findings or penalties have been imposed yet.
The California Privacy Protection Agency announced that the California State Legislature approved the Expanding Privacy Rights Act (SB 923), which expands the CCPA's right to delete to cover all non-exempt personal information a business holds about a consumer, including data originally collected from third parties. The bill also requires online-only businesses with a direct relationship to consumers to provide online methods, such as webforms, for submitting access, deletion, and correction requests, and expressly permits businesses to retain suppression lists so deleted information stays deleted. The bill, authored by Senator Becker and sponsored by CalPrivacy, now goes to the Governor for consideration.
The Minnesota Attorney General entered into a 10-year oversight agreement with Sanford Health and North Memorial Health to allow their merger to proceed, conditioned on commitments to invest $600 million in Minnesota hospitals, maintain core services including the Level 1 trauma center at Robbinsdale Hospital, honor collective-bargaining agreements, and maintain charity care and government program participation. The agreement also requires quarterly meetings and annual reporting to the Attorney General for 10 years.
Attorney General Weiser joined a coalition of attorneys general in suing to block new unlawful conditions on Title X funding imposed by HHS, which would penalize states and providers that refuse to abandon nondiscrimination initiatives or conform to the administration's ideological vision of family planning. The lawsuit argues the conditions conflict with federal law, violate the Administrative Procedure Act, and are unconstitutionally vague.
The California Privacy Protection Agency announced that more than 500,000 Californians have registered for the Delete Request and Opt-out Platform (DROP) since its January 1, 2026 launch. After the August 1, 2026 deadline for brokers to begin processing requests, 654 data brokers are in the system and approximately 25% have reported processing deletion requests, with tens of millions of records already deleted. No enforcement action has been announced yet; the agency warned that brokers who fail to delete eligible personal information face significant fines.
All data sourced from official government enforcement pages.