New: a trial court in 1 of every 10 U.S. counties. Read the post
Court Rules

Privacy Enforcement Tracker

1,711 enforcement actions from 16 federal and state jurisdictions. Every event traced back to its official government source.

1,711

Total Actions

16

Jurisdictions

$51.3B+

Total Fines Tracked

Access this data programmatically:MCP Server API Docs
OREnforcement ActionMultistate

Hewlett Packard Enterprises and Juniper Networks

Antitrust enforcement action where Oregon Attorney General and a coalition of states filed a court brief opposing the $14 billion merger settlement between Hewlett Packard Enterprises and Juniper Networks, citing anticompetitive concerns and a corrupted process at the U.S. Department of Justice.

Low
OREnforcement ActionMultistate

Trump Administration

Consumer protection enforcement action where Oregon Attorney General Dan Rayfield led a coalition of 24 states in filing a motion for a preliminary injunction to stop the Trump Administration's imposition of tariffs on imported goods. The states argue the tariffs are unlawful under the International Emergency Economic Powers Act and Section 122 of the Trade Act of 1974, as they cause financial harm to consumers and state governments by increasing prices and procurement costs.

Low
FTCGuidance

No specific entity targeted

The Federal Trade Commission is seeking public comment on an Advance Notice of Proposed Rulemaking to address unfair or deceptive rental housing fee practices, including hidden mandatory fees not disclosed in advertised rent. The proposed rule would require clear disclosure of total rent and all associated fees, and would allow the FTC to seek civil penalties for violations. Past FTC enforcement actions against Invitation Homes and Greystar Real Estate Partners resulted in $48 million and $24 million settlements, respectively, for deceptive rent advertising practices.

Low
FTCGuidance

None

The FTC is seeking public comment on an Advance Notice of Proposed Rulemaking (ANPRM) to amend the Negative Option Rule, which governs prenotification negative option marketing plans. The rulemaking aims to address deceptive or unfair practices including misleading disclosures, unauthorized billing, and difficult cancellation processes, following over 100,000 consumer complaints about negative option practices in the past five years. Comments will be accepted for 30 days after the ANPRM is published in the Federal Register.

Low
CAEnforcement ActionMultistate

U.S. Department of Education(Department of Education)

California Attorney General Rob Bonta filed a lawsuit against the U.S. Department of Education to block the expansion of IPEDS data collection requiring colleges to submit race-linked student data. The lawsuit argues the demand is arbitrary, capricious, and burdensome, and could enable costly partisan investigations. A multistate coalition co-led the challenge.

LowStudent Data
CTEnforcement ActionMultistate

Department of Education

Connecticut Attorney General William Tong, joined by 17 other attorneys general, filed a lawsuit against the U.S. Department of Education to block new IPEDS data reporting requirements that demand student information disaggregated by race and sex. The coalition argues the rushed implementation is unlawful, invades student privacy, and risks unreliable data and baseless investigations. They seek an injunction to halt the data collection and protect student privacy.

LowStudent DataNotice Failure
OREnforcement ActionMultistate

Department of Education

Privacy enforcement action where Oregon AG and a coalition of 16 other states sue the Trump Administration to stop the Department of Education's new IPEDS data reporting requirements, arguing they jeopardize student privacy, lack proper definitions, and risk data errors and identification.

LowUnauthorized Data SharingNotice FailureSecurity Failure
ILEnforcement ActionMultistate

U.S. Department of Education(Department of Education)

Illinois Attorney General Kwame Raoul, joined by 16 other attorneys general, filed a lawsuit against the U.S. Department of Education to stop new data collection requirements under IPEDS that threaten student privacy by requesting sensitive personal information including income, test scores, and GPA.

LowStudent Data
MAEnforcement ActionMultistate

U.S. Department of Education(Department of Education)

Massachusetts Attorney General Andrea Campbell co-led a coalition of 17 attorneys general in filing a lawsuit against the Trump Administration to stop new data reporting requirements for colleges and universities through IPEDS. The requirements demand detailed student data disaggregated by race and sex, retroactive for seven years, which the coalition argues jeopardizes student privacy and could lead to baseless investigations.

LowStudent Data
CTEnforcement ActionMultistate

U.S. Department of Education(Department of Education)

Connecticut Attorney General William Tong joined a coalition of 17 attorneys general in filing a lawsuit against the U.S. Department of Education to stop new data reporting requirements under IPEDS that demand detailed student information. The coalition argues the requirements are unlawful, arbitrary, and jeopardize student privacy by requesting in-depth data that could lead to inadvertent errors and baseless investigations. The lawsuit seeks an injunction to block the implementation of these requirements.

LowStudent Data
NYEnforcement ActionMultistate

U.S. Department of Education

New York Attorney General Letitia James, joined by 16 other states, sued the U.S. Department of Education over a new survey requiring colleges to submit extensive student data, arguing it violates the Administrative Procedure Act and threatens student privacy. The lawsuit seeks to block the mandate and prevent penalties for non-compliance.

LowStudent Data
CAEnforcement ActionMultistate

Live Nation

California Attorney General Rob Bonta and a coalition of state attorneys general announced they will continue their antitrust lawsuit against Live Nation/Ticketmaster after the U.S. Department of Justice settled the case. The states aim to hold Live Nation accountable for anticompetitive conduct that harms consumers, artists, and venues in the live music industry.

Low
NJEnforcement Action

Susaida Nazario

A former employee of the New Jersey Department of Children and Families was indicted for allegedly leaking confidential child protection case information in exchange for bribes. The defendant, Susaida Nazario, misused her access to provide case details to an unauthorized individual, compromising sensitive children's data.

LowChildren's Data
CTAdministrative Order

Aquarion Company(Aquarion)

PURA preliminarily approved the sale of Aquarion Water Company to a new nonprofit Aquarion Water Authority, expected to double water rates. Attorney General Tong opposes the decision, citing loss of public oversight and high costs to consumers. The conversion removes PURA regulation, placing rate approvals under a board with no history of rejecting hikes.

Low
OREnforcement ActionMultistate

Trump Administration

Consumer protection lawsuit led by Oregon Attorney General Dan Rayfield, on behalf of a coalition of 24 states and two governors, challenging the Trump Administration's imposition of worldwide tariffs under Section 122 of the Trade Act of 1974. The suit alleges the administration is acting without legal authority, violating the Administrative Procedure Act and constitutional separation of powers, and causing immediate financial harm to American consumers and businesses through increased prices.

LowConsumer Fraud
CAEnforcement ActionMultistate

GoFundMe

California Attorney General Rob Bonta, co-leading a bipartisan coalition of 21 attorneys general and charitable regulators, sent a letter to GoFundMe demanding the platform remove all plagiarized donation web pages for over 1.4 million charities, disclose information about donations, and ensure pages do not outrank official charity sites in search results. The action follows reports that GoFundMe used charities' information without consent and engaged in deceptive solicitations, violating state charitable solicitation and consumer protection laws.

LowConsent Failure
CAGuidance

U.S. Department of Health and Human Services(Department of Health and Human Services)

California Attorney General Rob Bonta sent a letter to the U.S. Department of Health and Human Services opposing a proposed rule that would eliminate model card requirements for AI tools in healthcare, warning that such rollbacks could lead to biased and unsafe healthcare decisions by reducing transparency.

LowAI/Automated DecisionsHealth Data
ILEnforcement ActionMultistate

U.S. Department of Agriculture(USDA)

Attorney General Raoul secured a court order preventing the U.S. Department of Agriculture from collecting SNAP applicants' and recipients' personal data without an agreed-upon protocol that restricts sharing with unrelated entities like the Department of Homeland Security. The court found that the USDA's proposed protocol would violate federal law by allowing data use for immigration enforcement, contrary to the intended purpose of SNAP.

LowUnauthorized Data Sharing
MAEnforcement ActionMultistate

U.S. Department of Agriculture(USDA)

Massachusetts Attorney General Andrea Campbell secured a preliminary injunction from the U.S. District Court blocking the Trump Administration's USDA from cutting off SNAP funding to states that refuse to turn over personal data of SNAP applicants and recipients. The court found USDA's proposed data protocol unlawful because it allowed sharing data with entities unrelated to federal benefits administration.

LowUnauthorized Data Sharing
TXSettlement

Samsung Electronics America, Inc.(Samsung)

Texas Attorney General Ken Paxton reached an agreement with Samsung Electronics America, Inc. to stop collecting Automated Content Recognition (ACR) data from smart TVs without consumers' express consent. Samsung must update its smart TVs to provide clear and conspicuous disclosures and obtain consent before any data collection, ensuring Texans are informed and in control of their viewing data.

LowConsent FailureNotice Failure
OREnforcement Action

Devon T. Horace(Alberta Main Street)

Consumer protection case involving theft of charitable funds. Former Alberta Main Street president Devon T. Horace pleaded no contest to theft and falsifying business records, paid $85,080.95 in restitution, and was sentenced to probation and community service.

LowSecurity Failure
HHSEnforcement Action

BMG of Kansas, Inc.

BMG of Kansas, Inc. (Health Plan, KS) reported a HIPAA breach affecting 1,327 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.

LowData BreachHealth DataSecurity Failure
HHSEnforcement Action

AltaMed Health Services Corporation

AltaMed Health Services Corporation (Healthcare Provider, CA) reported a HIPAA breach affecting 501 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.

LowData BreachHealth DataSecurity Failure
NJAdministrative Order

Arya International Inc. (Mystical Stars, LLC)

The New Jersey Bureau of Securities issued a Summary Cease and Desist Order against Arya International Inc. (operating as Mystical Stars, LLC) and owner Rupal K. Patel for operating a nationwide investment fraud scheme involving unregistered securities. The scheme targeted friends and family of dance students, raising over $5.4 million from 74 investors, including 48 New Jersey residents, through false promises of guaranteed 10-20% returns. The order requires the entities to immediately halt sales of unregistered securities and cease misleading investors.

Low
FTCGuidance

Website and Online Service Operators(Online Service Operators)

The FTC issued a policy statement announcing it will not enforce COPPA against operators that collect age verification data under specific conditions. The policy aims to encourage the use of age verification technologies to protect children online. Operators must limit data use, ensure security, provide notice, and use accurate verification methods.

LowChildren's DataConsent FailureNotice Failure
FTCGuidance

Operators of General Audience and Mixed Audience Sites and Services(Online Service Operators)

The FTC issued a policy statement announcing that it will not enforce the COPPA Rule against website and online service operators that use age verification technologies solely to determine user age, provided they comply with conditions such as limiting data use, ensuring security, and providing clear notice. This policy aims to incentivize age verification tools to protect children online.

LowChildren's Data
HHSEnforcement Action

Commonwealth Care Alliance

Commonwealth Care Alliance (Health Plan, MA) reported a HIPAA breach affecting 634 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Paper/Films.

LowData BreachHealth DataUnauthorized Data Sharing
CANew Law

California Privacy Protection Agency (CalPrivacy)

CalPrivacy sponsored AB 2021, the Whistleblower Protection and Privacy Act, introduced by Assemblymember Pilar Schiavo. The bill establishes whistleblower protections under the CCPA, including an award program and anti-retaliation provisions, to encourage insiders to report privacy violations.

LowNotice FailureUnauthorized Data SharingConsent Failure
OREnforcement ActionMultistate

U.S. Department of Health and Human Services and Centers for Disease Control and Prevention(Department of Health and Human Services)

Health enforcement case: Oregon Attorney General Dan Rayfield, along with a coalition of states, filed a lawsuit challenging the Trump Administration's overhaul of the childhood immunization schedule. The complaint alleges that HHS Secretary RFK Jr. and CDC officials bypassed federal law, ignored scientific evidence, and endangered children by demoting key vaccines from the recommended schedule. The states seek to declare the actions unlawful and enjoin the new policy.

Low
HHSEnforcement Action

Weill Cornell Medicine

Weill Cornell Medicine (Healthcare Provider, NY) reported a HIPAA breach affecting 516 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Electronic Medical Record.

LowData BreachHealth DataUnauthorized Data Sharing

Explore Enforcement Data