Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by levelWhat for?
by topicWho?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 1 | €35m |
| 2023 | 1 | €7.16m |
| 2024 | 2 | €15.7m |
| 2025 | 8 | €1.2bn |
| 2026 | 4 | €2.31m |
16 cases
25 Jun 2026 Kochava Inc. und Collective Data Solutions, LLCKochava: court order ends FTC lawsuit over trade in location data Order
After almost four years of litigation, the federal district court for Idaho entered an order agreed between the FTC and the data broker Kochava. The FTC had alleged that Kochava sold precise location data from hundreds of millions of mobile devices without the knowledge and consent of the people concerned, revealing, for example, visits to health facilities and places of worship. Kochava and its subsidiary Collective Data Solutions, which has taken over the data broker business, may only share sensitive location data with affirmative consent and for services requested by the consumer, and must introduce, among other things, a sensitive-locations programme, checks on their data suppliers, disclosure of recipients and retention limits; no payment is provided for. The authority allegedly made the findings set out here; this account is not based on a final judgment.
Anyone who buys or passes on location data must verify consent at the source and consistently filter out sensitive locations.
Location data as sensitive data; due diligence when buying and reselling data
- Authority / court
- U.S. District Court for the District of Idaho auf Klage der Federal Trade Commission (FTC)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Section 5 FTC Act, 15 U.S.C. § 45 (unlautere Praktiken); Verfahren nach Section 13(b), 15 U.S.C. § 53(b)
- Action
- Order
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 26 Jun 2026
- FTC v. Kochava, Inc., No. 2:22-cv-00377-BLW (D. Idaho), Stipulated Order for Injunction and Other Relief (Document 138, dated 25.06.2026) Court decision
- FTC-Pressemitteilung: FTC to Ban Kochava and Subsidiary from Selling Sensitive Location Data (04.05.2026) Press release of an authority
- FTC Legal Library: FTC v Kochava, Inc. (Fallseite mit Zeitleiste) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
5 Jun 2026 Illuminate Education Inc.FTC: final order against education software provider Illuminate after data leak affecting 10.1 million students Order
According to the complaint by the US Federal Trade Commission (FTC), Illuminate promised schools data security but did not adequately protect its cloud databases, even though a service provider had pointed out vulnerabilities almost two years earlier; a hacker accessed data on 10.1 million students, including health information. The order requires an information security programme, data minimisation and a public deletion schedule, and prohibits misrepresentations about security and notification deadlines.
Do not leave known vulnerabilities unaddressed for years – security promises to customers are measured as binding commitments.
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- FTC Act (Verbot unlauterer und irreführender Praktiken)
- Action
- Order
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Culpability
- negligent
- Published
- 5 Jun 2026
- FTC Gives Final Approval to Order Against Illuminate Settling Allegations It Failed to Secure Students' Personal Data Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
11 Feb 2026 Disney DTC, LLC und ABC Enterprises, Inc. (The Walt Disney Company)California: $2.75 million against Disney over incomplete opt-outs for streaming €2.31m
Disney implemented objections to the sale and sharing of data only for individual services or devices rather than across the whole account, continued to disclose data via embedded ad-tech providers and offered no opt-out in connected TV apps. It was the largest CCPA settlement at the time of the agreement with the Attorney General of California.
An opt-out must take effect across all services, devices and integrated third-party providers of an account.
- Authority / court
- Attorney General of California (California Department of Justice)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 11 Feb 2026
Original amount 2,750,000 USD, converted at the ECB reference rate of 11 Feb 2026.
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
13 Jan 2026 General Motors LLC, General Motors Holdings LLC und OnStar, LLCGeneral Motors/OnStar: FTC order after sale of location and driving data Order
The FTC finalised its order against General Motors and OnStar. According to the authority, GM used a misleading enrolment process to sign customers up for the OnStar service and the Smart Driver feature, collected precise location and driving behaviour data from millions of vehicles and sold it to third parties, including consumer reporting agencies, without clear notice and affirmative consent. GM may not disclose this data to consumer reporting agencies for five years and, for the 20-year term of the order, must obtain affirmative consent before collecting, using or sharing connected vehicle data, allow access and deletion, and offer a way to disable location collection; the order does not provide for any payment. The authority allegedly made the findings set out here; this account is not based on a final judgment.
Data from connected products may only be passed to third parties after clear notice and affirmative consent – a tick box in the enrolment process is no substitute.
Consent for connected products; sharing of location and usage data
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)
- Action
- Order
- Status of proceedings
- final
- Sector
- Automotive
- Employees
- 10,000 or more
- Published
- 14 Jan 2026
- FTC, In the Matter of General Motors LLC et al., Docket No. C-4828, Decision and Order (issued 13.01.2026) Decision of an authority
- FTC-Pressemitteilung: FTC Finalizes Order Settling Allegations that GM and OnStar Collected and Sold Geolocation Data Without Consumers' Informed Consent (14.01.2026) Press release of an authority
- FTC, In the Matter of General Motors LLC et al., Docket No. C-4828, Complaint Decision of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
30 Dec 2025 Rickenbacher Data LLC (Datamasters)CPPA: $45,000 against data broker Datamasters over failure to register €38,275
Without registering as a data broker, the Texas reseller traded in the names and contact details of millions of people, sorted by illnesses such as Alzheimer's or addiction, by age, presumed ethnicity and political views. In addition to the fine, the California Privacy Protection Agency (CPPA) requires it to stop selling data on all Californians.
Companies that buy or sell address lists for advertising must check registration obligations – health-related lists are particularly risky.
- Authority / court
- California Privacy Protection Agency (CPPA)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- California Delete Act (Registrierungspflicht für Datenhändler)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Other
- Published
- 8 Jan 2026
Original amount 45,000 USD, converted at the ECB reference rate of 30 Dec 2025.
- CalPrivacy Data Broker Enforcement Strike Force: enforcement actions Press release of an authority
- CPPA Order of Decision: Rickenbacher Data LLC d/b/a Datamasters (ENF25-172-D-DA) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 Dec 2025 Disney Worldwide Services, Inc. und Disney Entertainment Operations LLCDisney: 10 million USD over mislabelled children's videos on YouTube €8.48m
On a complaint filed by the U.S. Department of Justice on behalf of the FTC, the federal district court for the Central District of California entered an order against two Disney companies. Disney is alleged to have failed to label child-directed videos on YouTube as 'Made for Kids' because it designated audiences only at channel level; as a result, data from children under 13 could be collected via YouTube without notice to and consent from their parents and used for targeted advertising. Disney pays a civil penalty of 10,000,000 USD and must set up a programme for reviewing and designating the audience of its videos. The authority allegedly made the findings set out here; this account is not based on a final judgment.
A company distributing content through third-party platforms remains responsible for their privacy settings – channel-level defaults must be checked for each piece of content.
Children's privacy for content on third-party platforms; maintaining platform settings
- Authority / court
- Federal Trade Commission (FTC); Klage durch das U.S. Department of Justice, Anordnung des U.S. District Court for the Central District of California
- Area of law
- Data protection · Marketing and consent
- Legal basis
- COPPA Rule, 16 C.F.R. Part 312; Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c), 6505(d); Verfahren nach 15 U.S.C. §§ 45(m)(1)(A), 53(b)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 31 Dec 2025
Original amount 10,000,000 USD, converted at the ECB reference rate of 23 Dec 2025.
- U.S. v. Disney Worldwide Services, Inc. et al., No. 2:25-cv-08223 (C.D. Cal.), Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief (23.12.2025) Court decision
- FTC-Pressemitteilung: Court Approves Order Requiring Disney to Pay $10 Million to Settle FTC Allegations (31.12.2025) Press release of an authority
- FTC-Pressemitteilung: Disney to Pay $10 Million to Settle FTC Allegations the Company Enabled the Unlawful Collection of Children's Personal Data (02.09.2025) Press release of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
21 Nov 2025 Jam City, Inc.Jam City: 1.4 million USD in California over missing opt-outs in 21 gaming apps €1.22m
On a complaint by the California Attorney General, the Superior Court in Los Angeles entered a stipulated judgment against the mobile game developer Jam City. According to the investigation, none of Jam City's 21 apps offered a way, as required by the California Consumer Privacy Act (CCPA), to opt out of the sale or sharing of personal data for personalised advertising, and some games passed on data of teenagers aged between 13 and 16 without their affirmative consent. Jam City pays 1,400,000 USD, must offer opt-out options within the apps, may only sell or share data of under-16s on an opt-in basis and must instruct recipients to delete such data. The authority allegedly made the findings set out here; this account is not based on a final judgment.
A business that shares data for advertising through apps must enable the opt-out where the data is collected – directly in the app.
Right to opt out of data sales in apps; protecting minors in advertising tracking
- Authority / court
- Superior Court of California, County of Los Angeles, auf Klage des Attorney General of California (California Department of Justice)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- California Consumer Privacy Act (CCPA), Cal. Civ. Code § 1798.100 ff.; Zahlung nach Cal. Civ. Code § 1798.199.90
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Published
- 21 Nov 2025
Original amount 1,400,000 USD, converted at the ECB reference rate of 21 Nov 2025.
- People v. Jam City, Inc., Case No. 25STCV34029, Superior Court Los Angeles, Final Judgment and Permanent Injunction (21.11.2025) Court decision
- California DOJ, Pressemitteilung: Attorney General Bonta Secures $1.4 Million Settlement with Mobile App Gaming Company (21.11.2025) Press release of an authority
- California DOJ: Privacy Enforcement Actions (Übersicht) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
31 Oct 2025 Google LLCTexas: Google pays $1.375 billion over location, incognito and biometric data €1.19bn
Texas, represented by the Office of the Attorney General, had sued Google for unlawfully collecting location data, activity in incognito mode and biometric identifiers. Google signed a settlement of $1.375 billion, concluding two sets of proceedings.
Settings such as location history or incognito mode must deliver what they promise users – otherwise billion-dollar risks loom, even at the level of individual US states.
- Authority / court
- Office of the Attorney General of Texas
- Area of law
- Data protection · Cookies and tracking
- Action
- Other
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Employees
- 10,000 or more
- Published
- 31 Oct 2025
Original amount 1,375,000,000 USD, converted at the ECB reference rate of 31 Oct 2025.
- Attorney General Ken Paxton Finalizes Historic Settlement with Google and Secures $1.375 Billion Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
26 Sep 2025 Tractor Supply CompanyCPPA: $1.35 million against Tractor Supply over missing opt-out mechanisms €1.16m
The rural retail giant inadequately informed consumers and job applicants about their rights, offered no effective means of opting out of the sale and sharing of data (including no Global Privacy Control) and passed data on to third parties without the required contracts. An officer must certify compliance annually for four years, as required by the California Privacy Protection Agency (CPPA).
Privacy notices must also cover job applicants, and browser opt-out signals such as GPC must be implemented technically.
- Authority / court
- California Privacy Protection Agency (CPPA)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Retail and e-commerce
- Employees
- 10,000 or more
- Published
- 30 Sep 2025
Original amount 1,350,000 USD, converted at the ECB reference rate of 26 Sep 2025.
- CPPA: Tractor Supply Company enforcement decision Press release of an authority
- CPPA Order of Decision and Stipulated Final Order: Tractor Supply Company (ENF24-M-TR-04) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
1 Jul 2025 Healthline Media LLCCalifornia: $1.55 million against Healthline over disclosure of illness-related article titles €1.31m
Despite objections, the health portal continued to pass data to advertising partners and transmitted article titles suggestive of diagnoses for targeted advertising; the consent banner did not stop the tracking. In addition, the required contractual clauses with advertising partners were missing. The settlement was reached with the Attorney General of California.
Test consent banners technically: if rejecting does not actually switch off tracking, that is misleading and unlawful.
- Authority / court
- Attorney General of California (California Department of Justice)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- California Consumer Privacy Act (CCPA), Unfair Competition Law
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Published
- 1 Jul 2025
Original amount 1,550,000 USD, converted at the ECB reference rate of 1 Jul 2025.
- Attorney General Bonta Announces Largest CCPA Settlement to Date, Secures $1.55 Million from Healthline.com Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
6 May 2025 Todd Snyder, Inc.Todd Snyder: 345,178 USD – tracking opt-out ineffective for 40 days €304,793
For 40 days, the fashion retailer’s misconfigured privacy portal did not process objections to the sale and sharing of personal data; in addition, the company required too much data and identity verification before an opt-out. The California Privacy Protection Agency (CPPA) imposed 345,178 USD and required correct configuration of consent management and employee training.
A consent management platform does not relieve companies of responsibility: check regularly whether opt-outs are actually implemented technically.
Configuration and monitoring of consent management platforms
Missing or inadequate training played a role in the decision.
- Authority / court
- California Privacy Protection Agency (CPPA), Board
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Retail and e-commerce
Original amount 345,178 USD, converted at the ECB reference rate of 6 May 2025.
- CPPA Orders Clothing Retailer Todd Snyder to Pay Six-Figure Fine, Overhaul Privacy Practices (06.05.2025) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
7 Mar 2025 American Honda Motor Co., Inc.CPPA: $632,500 against Honda over obstructed privacy requests €582,573
Honda required excessive information for opt-out requests, used a cookie tool without equivalent choices, made it harder to appoint authorised agents and passed data on to ad-tech firms without the required contracts. The order of the California Privacy Protection Agency (CPPA) requires, among other things, a simplified procedure and training for employees.
Do not undermine data subject rights through form hurdles or asymmetric consent dialogues.
- Authority / court
- California Privacy Protection Agency (CPPA)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Automotive
- Employees
- 10,000 or more
- Published
- 12 Mar 2025
Original amount 632,500 USD, converted at the ECB reference rate of 7 Mar 2025.
- CPPA: Enforcement action against American Honda Motor Co. Press release of an authority
- CPPA Order of Decision: American Honda Motor Co., Inc. (ENF23-V-HO-2) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
13 Nov 2024 National Amusements, Inc.Cinema operator National Amusements: 250,000 USD over data breach and late notice €235,206
In December 2022 an attacker used an employee's stolen credentials to break into the systems of the cinema operator National Amusements because multi-factor authentication was not enforced for all access routes; data such as social security, passport and account numbers of 82,128 people was affected – according to the company, current and former employees and contractors – of whom 23,365 were in New York, and some of the social security numbers were stored unencrypted. Those affected were only notified on 18 December 2023, more than a year after the incident. Under the Assurance of Discontinuance with the New York Attorney General's office, the company pays 250,000 USD and must introduce, among other things, encryption, password rules, vulnerability testing and an incident response plan. The authority allegedly made the findings set out here; this account is not based on a final judgment.
Employee data also triggers notification duties – notice must not wait until the data review is fully completed.
Multi-factor authentication for all access routes; timely notification of data breaches
Missing or inadequate training played a role in the decision.
- Authority / court
- Office of the New York State Attorney General (Bureau of Internet & Technology)
- Area of law
- Data protection · Employee data
- Legal basis
- New York Executive Law § 63(12); New York General Business Law § 899-aa (Benachrichtigung bei Datenpannen) und § 899-bb (SHIELD Act, Datensicherheit)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Other
- Published
- 15 Nov 2024
Original amount 250,000 USD, converted at the ECB reference rate of 13 Nov 2024.
- NYAG, In the Matter of National Amusements, Inc., Assurance of Discontinuance No. 24-024 (wirksam 13.11.2024) Decision of an authority
- NYAG-Pressemitteilung: Attorney General James Secures $250,000 from Movie Theater Operator for Failing to Protect Employees' Personal Information (15.11.2024) Press release of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
26 Jun 2024 a British software maker and two subsidiariesSoftware maker: 16.5 million USD and ban on selling browsing data €15.4m
The FTC issued its final order against a British software maker, its Czech subsidiary and its former data subsidiary. According to the authority, the software maker collected detailed browsing data through browser extensions and antivirus software, stored it indefinitely and sold it via the data subsidiary to more than 100 third parties without adequate notice and consent, even though the products were marketed as protecting against online tracking. The software maker must pay 16,500,000 USD for consumer redress, may no longer sell or license browsing data for advertising purposes, must delete the data transferred to the data subsidiary together with any products and algorithms derived from it, and must set up a privacy programme.
A company that advertises protection against tracking must not monetise the same usage data itself – marketing claims and data use must match.
Privacy promises versus actual data use; sale of usage data
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)
- Action
- Disgorgement of profits
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 27 Jun 2024
Original amount 16,500,000 USD, converted at the ECB reference rate of 26 Jun 2024.
- Federal Trade Commission (FTC), Veröffentlichung der Behörde (Entscheidung 2024) Decision of an authority
Checked against the official source on 8 Oct 2026 · Company name anonymised since 26 Jun 2026 · Direct link
Report an error
7 Jul 2023 a US online therapy providerOnline therapy provider: 7.8 million USD after sharing health data for advertising €7.16m
The FTC finalised its order against an online therapy provider. According to the authority, despite promises of confidentiality the company passed e-mail addresses, IP addresses and answers from its health questionnaire to three social networks and an advertising technology company for advertising purposes without obtaining affirmative consent. The provider pays 7,800,000 USD for partial refunds to customers, may no longer share health data for advertising, must obtain affirmative consent before sharing with certain third parties, must instruct the recipients to delete the data and must set retention periods.
Marketing tools such as audience matching must never be fed with health information unless affirmative consent has been given.
Health data and marketing tools; tracking pixels and custom audiences
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)
- Action
- Disgorgement of profits
- Status of proceedings
- final
- Sector
- Healthcare
- Published
- 14 Jul 2023
Original amount 7,800,000 USD, converted at the ECB reference rate of 7 Jul 2023.
- Federal Trade Commission (FTC), Veröffentlichung der Behörde (Entscheidung 2023) Decision of an authority
Checked against the official source on 8 Oct 2026 · Company name anonymised since 7 Jul 2025 · Direct link
Report an error
20 Sep 2022 a large US broker-dealer and wealth managerSEC: $35 million against US wealth manager over unsafe disposal of hard drives €35m
From 2015, the firm had thousands of hard drives and servers containing data on around 15 million customers decommissioned by a moving company with no experience in data destruction; the devices were resold unencrypted and offered online. In addition, 42 servers with unencrypted customer data went missing. The penalty was imposed by the US Securities and Exchange Commission (SEC).
Disposal of data carriers is a matter for senior management: engage only certified service providers, require proof of destruction and actually activate the encryption that is available.
Secure disposal of data carriers and management of service providers
- Authority / court
- U.S. Securities and Exchange Commission (SEC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Regulation S-P (Safeguards Rule und Disposal Rule)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Culpability
- negligent
- Published
- 20 Sep 2022
Original amount 35,000,000 USD, converted at the ECB reference rate of 20 Sep 2022.
- SEC, Pressemitteilungen (Übersicht) (Entscheidung 2022) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 20 Sep 2024 · Direct link