Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe and North America: 718 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by stateWhat for?
by topicWho?
by sectorAll sectors
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q3 2023 | 0 | — |
| Q4 2023 | 0 | — |
| Q1 2024 | 0 | — |
| Q2 2024 | 0 | — |
| Q3 2024 | 0 | — |
| Q4 2024 | 0 | — |
| Q1 2025 | 1 | €582,573 |
| Q2 2025 | 1 | €304,793 |
| Q3 2025 | 2 | €2.47m |
| Q4 2025 | 2 | €1.19bn |
| Q1 2026 | 1 | €2.31m |
| Q2 2026 | 0 | — |
| Q3 2026 | 0 | — |
7 cases
11 Feb 2026 Disney DTC, LLC und ABC Enterprises, Inc. (The Walt Disney Company)California: $2.75 million against Disney over incomplete opt-outs for streaming €2.31m
Disney implemented objections to the sale and sharing of data only for individual services or devices rather than across the whole account, continued to disclose data via embedded ad-tech providers and offered no opt-out in connected TV apps. It was the largest CCPA settlement at the time of the agreement with the Attorney General of California.
An opt-out must take effect across all services, devices and integrated third-party providers of an account.
- Authority / court
- Attorney General of California (California Department of Justice)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 11 Feb 2026
Original amount 2,750,000 USD, converted at the ECB reference rate of 11 Feb 2026.
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
30 Dec 2025 Rickenbacher Data LLC (Datamasters)CPPA: $45,000 against data broker Datamasters over failure to register €38,275
Without registering as a data broker, the Texas reseller traded in the names and contact details of millions of people, sorted by illnesses such as Alzheimer's or addiction, by age, presumed ethnicity and political views. In addition to the fine, the California Privacy Protection Agency (CPPA) requires it to stop selling data on all Californians.
Companies that buy or sell address lists for advertising must check registration obligations – health-related lists are particularly risky.
- Authority / court
- California Privacy Protection Agency (CPPA)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- California Delete Act (Registrierungspflicht für Datenhändler)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Other
- Published
- 8 Jan 2026
Original amount 45,000 USD, converted at the ECB reference rate of 30 Dec 2025.
- CalPrivacy Data Broker Enforcement Strike Force: enforcement actions Press release of an authority
- CPPA Order of Decision: Rickenbacher Data LLC d/b/a Datamasters (ENF25-172-D-DA) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
31 Oct 2025 Google LLCTexas: Google pays $1.375 billion over location, incognito and biometric data €1.19bn
Texas, represented by the Office of the Attorney General, had sued Google for unlawfully collecting location data, activity in incognito mode and biometric identifiers. Google signed a settlement of $1.375 billion, concluding two sets of proceedings.
Settings such as location history or incognito mode must deliver what they promise users – otherwise billion-dollar risks loom, even at the level of individual US states.
- Authority / court
- Office of the Attorney General of Texas
- Area of law
- Data protection · Cookies and tracking
- Action
- Other
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Employees
- 10,000 or more
- Published
- 31 Oct 2025
Original amount 1,375,000,000 USD, converted at the ECB reference rate of 31 Oct 2025.
- Attorney General Ken Paxton Finalizes Historic Settlement with Google and Secures $1.375 Billion Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
26 Sep 2025 Tractor Supply CompanyCPPA: $1.35 million against Tractor Supply over missing opt-out mechanisms €1.16m
The rural retail giant inadequately informed consumers and job applicants about their rights, offered no effective means of opting out of the sale and sharing of data (including no Global Privacy Control) and passed data on to third parties without the required contracts. An officer must certify compliance annually for four years, as required by the California Privacy Protection Agency (CPPA).
Privacy notices must also cover job applicants, and browser opt-out signals such as GPC must be implemented technically.
- Authority / court
- California Privacy Protection Agency (CPPA)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Retail and e-commerce
- Employees
- 10,000 or more
- Published
- 30 Sep 2025
Original amount 1,350,000 USD, converted at the ECB reference rate of 26 Sep 2025.
- CPPA: Tractor Supply Company enforcement decision Press release of an authority
- CPPA Order of Decision and Stipulated Final Order: Tractor Supply Company (ENF24-M-TR-04) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
1 Jul 2025 Healthline Media LLCCalifornia: $1.55 million against Healthline over disclosure of illness-related article titles €1.31m
Despite objections, the health portal continued to pass data to advertising partners and transmitted article titles suggestive of diagnoses for targeted advertising; the consent banner did not stop the tracking. In addition, the required contractual clauses with advertising partners were missing. The settlement was reached with the Attorney General of California.
Test consent banners technically: if rejecting does not actually switch off tracking, that is misleading and unlawful.
- Authority / court
- Attorney General of California (California Department of Justice)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- California Consumer Privacy Act (CCPA), Unfair Competition Law
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Published
- 1 Jul 2025
Original amount 1,550,000 USD, converted at the ECB reference rate of 1 Jul 2025.
- Attorney General Bonta Announces Largest CCPA Settlement to Date, Secures $1.55 Million from Healthline.com Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
6 May 2025 Todd Snyder, Inc.Todd Snyder: 345,178 USD – tracking opt-out ineffective for 40 days €304,793
For 40 days, the fashion retailer’s misconfigured privacy portal did not process objections to the sale and sharing of personal data; in addition, the company required too much data and identity verification before an opt-out. The California Privacy Protection Agency (CPPA) imposed 345,178 USD and required correct configuration of consent management and employee training.
A consent management platform does not relieve companies of responsibility: check regularly whether opt-outs are actually implemented technically.
Configuration and monitoring of consent management platforms
Missing or inadequate training played a role in the decision.
- Authority / court
- California Privacy Protection Agency (CPPA), Board
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Retail and e-commerce
Original amount 345,178 USD, converted at the ECB reference rate of 6 May 2025.
- CPPA Orders Clothing Retailer Todd Snyder to Pay Six-Figure Fine, Overhaul Privacy Practices (06.05.2025) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
7 Mar 2025 American Honda Motor Co., Inc.CPPA: $632,500 against Honda over obstructed privacy requests €582,573
Honda required excessive information for opt-out requests, used a cookie tool without equivalent choices, made it harder to appoint authorised agents and passed data on to ad-tech firms without the required contracts. The order of the California Privacy Protection Agency (CPPA) requires, among other things, a simplified procedure and training for employees.
Do not undermine data subject rights through form hurdles or asymmetric consent dialogues.
- Authority / court
- California Privacy Protection Agency (CPPA)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Automotive
- Employees
- 10,000 or more
- Published
- 12 Mar 2025
Original amount 632,500 USD, converted at the ECB reference rate of 7 Mar 2025.
- CPPA: Enforcement action against American Honda Motor Co. Press release of an authority
- CPPA Order of Decision: American Honda Motor Co., Inc. (ENF23-V-HO-2) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link