Enforcement actions are the clearest available statement of what regulators consider unlawful, and this hub collects them with the underlying orders cited.
Data Security Rules
October 19, 2026
On December 20, 2024 the FTC issued its final complaint and decision and order against Marriott and Starwood, Docket No. C-4807, alleging deceptive and unfair data security behind three breaches between 2014 and 2020. The order mandates a specified security program, biennial outside assessments, deletion requests and loyalty point restoration for 20 years.
Read more →
State AG Enforcement
October 19, 2026
On October 9, 2024 the attorneys general of 49 states and the District of Columbia settled with Marriott over the Starwood reservation database breach and a later intrusion using franchise employee credentials. Marriott agreed to pay $52 million divided among the states and to a detailed, court-ordered security program, without admitting liability.
Read more →
Data Brokers
October 5, 2026
In April 2024 the FCC fined the four national wireless carriers a combined $196,486,875 for selling access to customer location data through aggregators without adequate safeguards. All four paid and sued. Two circuits upheld the fines, one vacated AT&T's, and in June 2026 the Supreme Court held the FCC's forfeiture process does not violate the Seventh Amendment.
Read more →
Data Brokers
October 5, 2026
The FTC alleged that General Motors enrolled drivers in OnStar Smart Driver through a bundled consent screen and then sold their driving events to Verisk and LexisNexis, which built consumer reports that insurers used. The order, proposed in January 2025 and issued as final in January 2026, runs 20 years and contains no payment.
Read more →
Data Security Rules
September 21, 2026
The Justice Department launched the Civil Cyber-Fraud Initiative on October 6, 2021 to pursue government contractors and grantees under the False Claims Act for knowing cybersecurity failures. This publication located sixteen resolved matters announced in DOJ releases through September 1, 2026, totaling about $69.1 million. Every one settled, and most began as whistleblower suits.
Read more →
CCPA / CPRA
September 1, 2026
California is the only state whose comprehensive privacy law has produced a substantial public enforcement record, and it has two enforcers producing it. This charts the twelve publicly documented CCPA actions, the penalty in each, the document each rests on, and the allegations that recur across almost all of them.
Read more →
HIPAA
September 1, 2026
In 2019 the Office for Civil Rights announced that enforcing a patient's right to their own records would be an enforcement priority. The resulting settlements had reached 41 cases by September 2022 and have continued since. Read together they describe an unusually repetitive fact pattern: a person asks for records, months pass, and the file arrives only after a federal complaint.
Read more →
Biometric Privacy
August 31, 2026
Texas has regulated the commercial capture of biometric identifiers since 2009, and for more than a decade nobody enforced the statute. The record now consists of two Attorney General actions, against Meta and against Google, and the settlement documents are more informative than the headline figures.
Read more →