Court Rules

Privacy Enforcement Tracker

1,788 enforcement actions from 16 federal and state jurisdictions. Every event traced back to its official government source.

1,788

Total Actions

16

Jurisdictions

$51.8B+

Total Fines Tracked

Access this data programmatically:MCP Server API Docs
FTCSettlementMultistate

Riverside Payments Inc.

The FTC and Washington alleged that Riverside Payments and affiliates misrepresented savings and cancellation terms, concealed fees and auto-renewing contracts, and obtained consumers’ financial information using false or fraudulent statements. The proposed stipulated order requires a $600,000 payment, customer notice and a period to rescind agreements without penalty, and prohibits deceptive claims while requiring clear disclosures, informed consent for negative-option billing, and a simple cancellation method.

MediumNotice FailureConsent Failure

$600K

NYSettlement

Bloomberg L.P.

New York Attorney General Letitia James secured a settlement with Bloomberg L.P. after finding that Bloomberg News failed to clearly disclose subscription price increases and automatic renewals, provide required acknowledgments and renewal notices, and make cancellation sufficiently easy. Bloomberg must pay $500,000 in penalties, provide refunds to eligible subscribers, and improve its subscription disclosures and practices.

MediumNotice FailureConsent FailureDark Patterns

$500K

VASettlementMultistate

General Motors

General Motors agreed to a $220 million settlement with a coalition of 36 attorneys general over allegations that it sold consumers’ driver behavior and location data to third parties, including data brokers that resold it to insurers. The settlement reportedly requires consumer consent before collecting or disclosing driving and location data, and Virginia is to receive about $6.5 million.

CriticalUnauthorized Data SharingConsent FailureGeolocation Data

$220.0M

MNSettlementMultistate

General Motors

A bipartisan coalition of 36 attorneys general settled allegations that General Motors collected and sold drivers’ driving-behavior and location data to data brokers, whose customers included insurance companies. GM will pay $220 million nationally, with Minnesota receiving $7,095,664, and must obtain affirmative express consent before collecting or disclosing driving and location data.

HighUnauthorized Data SharingConsent FailureNotice Failure

$7.1M

COSettlementMultistate

General Motors

General Motors agreed to a nationwide $220 million settlement over allegations that it sold drivers’ identifiable driving behavior and location data to data brokers, which then sold it to insurers. The settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy-program assessments and dealership oversight and training.

CriticalUnauthorized Data SharingConsent FailureNotice Failure

$220.0M

CTSettlementMultistate

General Motors LLC

Connecticut and a coalition of 36 attorneys general reached a $220 million settlement with General Motors over the collection and sale of consumers’ driving behavior and location data to data brokers and insurers without adequate disclosure or consent. The settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy program assessments and dealership oversight and training.

CriticalUnauthorized Data SharingConsent FailureNotice Failure

$220.0M

FTCEnforcement ActionMultistate

Toast Inc.

The FTC and state and local co-plaintiffs filed a lawsuit alleging Toast imposed hidden and unauthorized fees, enrolled restaurants in add-ons without consent, obstructed subscription cancellations, and misrepresented customer support availability. The complaint is pending in federal court; the press release announces no monetary penalty or imposed remedy.

LowConsent FailureDark Patterns
NJSettlementMultistate

General Motors, Inc.

A 36-attorney-general coalition resolved allegations that General Motors collected and sold identifiable driver behavior and location data to data brokers, which supplied it to insurers for use in assessing drivers and potentially raising premiums. The $220 million nationwide settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy-program assessments and dealership oversight and training.

CriticalUnauthorized Data SharingNotice FailureConsent Failure

$220.0M

NYSettlementMultistate

General Motors LLC

New York Attorney General Letitia James and a bipartisan coalition secured a $220 million settlement from General Motors LLC for selling drivers’ personal driving and location data to data brokers without adequate disclosure or consent. GM must limit the driving data it collects and implement privacy assessments and dealership oversight and training.

CriticalUnauthorized Data SharingNotice FailureConsent Failure

$220.0M

CTSettlement

SunRun, Inc.

Connecticut Attorney General William Tong announced settlements with SunRun, Inc., Elevate Solar Solutions, and two salespeople over allegations of deceptive solar sales, including impersonating consumers and locking homeowners into long-term contracts without consent. SunRun must pay $300,000 and provide consumer relief; Elevate and the salespeople face a stated $200,000 penalty, with $100,000 suspended subject to ongoing compliance.

MediumConsent Failure

$500K

NYCoalitionMultistate

Character Technologies, Inc.

New York Attorney General Letitia James and a bipartisan coalition of 39 other attorneys general filed a motion in Character Technologies, Inc.’s bankruptcy, citing risks to children and sensitive user information and potential violations of state privacy laws. The coalition asks the court, the company, and any prospective buyer to require meaningful privacy and safety protections; no fine or final remedy is reported.

LowChildren's DataHealth DataConsent Failure
FTCEnforcement ActionMultistate

Lens.com Inc.

The FTC, Utah, and Nevada sued Lens.com Inc., alleging that it advertised artificially low contact lens prices while hiding mandatory checkout charges and misleading consumers about its AutoRefill subscription. The complaint seeks to stop the alleged practices; the court has not yet decided the case, and no penalty or remedy has been imposed.

LowDark PatternsNotice FailureConsent Failure
NYSettlement

Brooklyn High Rise LLC

New York Attorney General Letitia James settled with Brooklyn High Rise LLC for illegally denying housing to prospective tenants based on housing court records, a practice known as tenant blacklisting. The company also charged non-refundable 'good faith' deposits. Brooklyn High Rise will pay $352,250 in penalties and restitution and must end its unlawful tenant screening practices.

MediumConsent FailureUnauthorized Data Sharing

$352K

FTCSettlement

Amazon.com, Inc.

A federal court approved a revised order in the FTC's Amazon Prime case under which Amazon will accelerate and expand redress payments under the September 2025 $2.5 billion settlement, which resolved allegations that Amazon enrolled millions of consumers in Prime subscriptions without their consent and knowingly made cancellation difficult. More consumers now qualify for refunds, the maximum payment cap rises from $51 to $200, and all future payments will be distributed automatically starting October 1, 2026, with potential supplemental $149 payments by April 2027. Amazon has already issued more than $845 million in redress payments as of September 2026.

CriticalConsent FailureDark Patterns

$2.5B

TXGuidance

N/A (consumer alert; no enforcement target)

Texas Attorney General Ken Paxton issued a consumer alert warning Texas businesses and nonprofits about a surge of demand letters alleging California Invasion of Privacy Act (CIPA) violations based on common website technologies such as cookies, pixels, and analytics tools. The AG cautions that some letters may exaggerate or misrepresent violations and may be fraudulent, noting serial CIPA plaintiff Vivek Shah has been declared a vexatious litigant. Recipients are advised not to pay or respond directly, to consult privacy counsel, and to report suspected fraud to the Consumer Protection Division.

LowUnauthorized Data SharingConsent Failure
ORSettlementMultistate

Credit Acceptance Corporation

Oregon Attorney General Dan Rayfield announced a $694 million multistate settlement with Credit Acceptance Corporation (CAC), a subprime auto lender, resolving allegations that CAC originated unaffordable loans and allowed dealers to 'pack' unwanted Vehicle Service Contracts and Guaranteed Asset Protection products into consumer loans. The settlement provides $60 million in cash restitution, $634 million in debt relief, and injunctive reforms including off ramps for risky loans, enhanced disclosures, and dealer monitoring.

CriticalConsent FailureNotice FailureDark Patterns

$694.0M

MNSettlementMultistate

Credit Acceptance Corporation

Minnesota AG Keith Ellison and a bipartisan coalition of 41 state attorneys general reached a settlement with subprime auto lender Credit Acceptance Corporation requiring it to pay the states $75.5 million and forgive more than $630 million in consumer debt nationwide. The settlement resolves allegations that the company financed auto loans it knew or should have known consumers could not afford, and financed the sale of expensive add-on products that consumers did not know they were purchasing. The company must also fundamentally reform its lending practices, including risk disclosures, loan balance waivers for high-risk defaults, and enhanced consent and cancellation protections for add-on products.

CriticalConsent Failure

$75.5M

FTCSettlement

FleetCor Technologies Inc. (now Corpay Inc.)

FleetCor Technologies Inc. (now Corpay Inc.) and its CEO Ronald Clarke agreed to pay $100 million to settle an FTC administrative action alleging the company charged small business customers hidden and unauthorized fees for fuel cards and misrepresented gas savings, fraud-control features, and fees. A federal district court granted the FTC summary judgment on all counts in 2023, and a federal appeals court upheld that judgment and the permanent injunction in 2026. The settlement funds will be used to provide redress to harmed business customers.

CriticalConsent FailureNotice FailureDark Patterns

$100.0M

FTCSettlement

Humboldt Merchant Services

The FTC alleged that payment processor Humboldt Merchant Services knowingly processed payments for more than 1,000 shell merchant entities serving as fronts for fraudulent companies engaged in unauthorized billing scams, despite red flags including chargeback rates nearly 10 times higher than card-brand thresholds. Under the proposed stipulated order filed in the U.S. District Court for the Eastern District of Michigan, Humboldt will pay $12 million for consumer redress and is permanently banned from processing payments for merchants with a heightened risk of potential fraud.

CriticalConsent Failure

$12.0M

CTInvestigation

MediaLab.AI Inc.

Connecticut Attorney General William Tong announced a civil investigative demand into MediaLab.AI Inc., owner of the Kik Messenger app, over lax age assurance practices, content moderation, and child safety failures that advocates have dubbed a "predator's paradise." The action follows a July 2025 notice of violation under the Connecticut Data Privacy Act for privacy notice deficiencies and processing sensitive data — including health, biometric, and precise geolocation data — without proper consent, which the company has only partially addressed. The new investigation seeks records related to practices that may constitute unfair or deceptive acts or practices under the CTDPA and the Connecticut Unfair Trade Practices Act. No fine has been imposed to date.

LowChildren's DataConsent FailureNotice Failure
FTCSettlement

CMG Media Corporation

The FTC finalized orders requiring CMG Media Corporation (doing business as Cox Media Group), MindSift LLC, and 1010 Digital Works LLC to pay a total of $930,000 for falsely claiming they offered an AI-powered service that could target ads based on conversations captured from consumers' smart devices, and that consumers had opted into such targeting. The orders also prohibit the companies from making misrepresentations about their advertising services, voice data collection, and consumer consent.

MediumConsent Failure

$930K

NYSettlement

Thirty Madison, Inc.

New York Attorney General Letitia James secured $400,000 from Thirty Madison, Inc., an online medication provider, for misleading consumers about auto-renewing subscriptions and making cancellation difficult. The company failed to clearly disclose subscription terms and non-refundable fees, and required multiple steps to cancel. The settlement requires payment, refunds to eligible subscribers, and changes to subscription practices.

MediumNotice FailureConsent FailureDark Patterns

$400K

COSettlement

Cobblestone Denver Opco, LLC

Colorado Attorney General Phil Weiser announced a settlement with Cobblestone Denver Opco, LLC (Cobblestone Car Wash) over allegations that the company used unfair automatic renewal practices for monthly membership fees. The company failed to provide proper disclosures, notices, terms, and cancellation options, locking over 70,000 consumers into auto-renewal contracts. Cobblestone will pay $1,353,465 in restitution, has already refunded $253,406 to consumers, and must comply with the Colorado Consumer Protection Act, including providing easy-to-access cancellation options and 25-day advance notice of price increases.

HighNotice FailureOpt-Out FailureDark Patterns

$1.4M

CTSettlement

Manchester City Nissan

Connecticut Attorney General William Tong and the Federal Trade Commission announced a $4 million settlement with Manchester City Nissan (Chase Nissan LLC) resolving allegations that the dealership double-charged for 'certified pre-owned' vehicles and collected unauthorized junk fees. The settlement requires payment for consumer redress, prohibits misrepresentations, mandates clear disclosure of the maximum total price, and requires express informed consent for all charges.

HighConsent FailureNotice Failure

$4.0M

FTCSettlementMultistate

Chase Nissan LLC

The FTC and Connecticut secured a $4 million settlement with Chase Nissan LLC (doing business as Manchester City Nissan) over allegations the dealership charged consumers unauthorized fees, including double-charging for 'certified pre-owned' vehicles and inserting charges like total loss protection into financing agreements without consent. The settlement requires $4 million in consumer redress, prohibits misrepresentations about vehicle certification and warranties, mandates prominent disclosure of the maximum total vehicle price, and requires express informed consent for all charges.

HighConsent FailureNotice Failure

$4.0M

CAEnforcement ActionMultistate

Meta Platforms, Inc.

A bipartisan coalition of 33 state attorneys general, led by Minnesota AG Keith Ellison, began trial against Meta Platforms, Inc., alleging the company knowingly designed and deployed harmful features on Facebook and Instagram that drive children and teens to use the platforms compulsively, while falsely assuring parents and the public that its platforms were safe for young users. The states also allege Meta illegally collected personal information from children under 13 without parental consent, violating COPPA. The trial opened before Judge Yvonne Gonzalez Rogers in the U.S. District Court for the Northern District of California, with the states seeking monetary penalties and injunctive relief.

LowChildren's DataConsent FailureDark Patterns
NJEnforcement ActionMultistate

Meta Platforms, Inc.

A bipartisan coalition of state attorneys general led by New Jersey, California, Colorado, and Kentucky is taking Meta Platforms, Inc. to trial, alleging that Meta designed addictive features on Instagram and Facebook that harm minors' mental health, illegally collected data from children under 13 without the required protections under COPPA, and misled users about platform safety. Opening arguments begin August 18, 2026, in the U.S. District Court for the Northern District of California. No monetary penalty or final remedy has yet been imposed.

LowChildren's DataConsent FailureNotice Failure
NYEnforcement ActionMultistate

Meta Platforms, Inc.

New York Attorney General Letitia James issued a statement marking the first day of trial in a multistate lawsuit against Meta, alleging the company knowingly designed addictive features on Facebook and Instagram that harm children's mental health. The coalition alleges Meta illegally collected personal information from children under 13 without parental consent, violating COPPA, and seeks monetary penalties, restitution, and an injunction against deceptive practices.

LowChildren's DataConsent FailureDark Patterns
MNEnforcement Action

X.AI

Minnesota Attorney General Keith Ellison filed an opposition to X.AI's motion for a preliminary injunction seeking to block enforcement of Minnesota's anti-nudification law, which bans commercial platforms from allowing users to generate synthetic intimate images of real people. The court previously denied X.AI's motion for a temporary restraining order, and the law took effect August 1, 2026. The AG argues X.AI cannot show irreparable harm and is unlikely to prevail on the merits of its First Amendment claims.

LowConsent FailureAI/Automated Decisions
FTCEnforcement Action

Credit Glory LLC

The FTC filed a complaint against Credit Glory LLC and related entities for deceptive credit repair practices, including false promises, impersonating debt collectors, charging illegal upfront fees, and using negative option billing without consent. A federal court temporarily halted the operation.

LowConsent FailureNotice FailureDark Patterns

Explore Enforcement Data