Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by action- Fine €35.9m 99 % · 5 cases
- Order €187,889 1 % · 7 cases
Who?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2023 | 1 | – |
| 2024 | 6 | €30.9m |
| 2025 | 5 | €5.19m |
| 2026 | 0 | – |
12 cases
10 Apr 2025 Luka Inc.Garante: 5 million EUR against Replika operator Luka over lack of legal basis €5m
The US operator of the Replika chatbot had not determined a legal basis for the processing, had an inadequate privacy notice and, despite declaring that minors were excluded, had no age verification. Italy's data protection authority (Garante per la protezione dei dati personali) imposed 5 million EUR and opened further proceedings concerning the training of the underlying language model.
A declared exclusion of minors is worthless without effective age verification at registration and during use.
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- DSGVO (Rechtmäßigkeit, Transparenz, Schutz Minderjähriger)
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Telecoms, IT and software
- Published
- 19 May 2025
- AI: Il Garante sanziona la società che gestisce il chatbot “Replika” Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
30 Jan 2025 Hangzhou DeepSeek Artificial Intelligence Co., Ltd.; Beijing DeepSeek Artificial Intelligence Co., Ltd.Garante blocks DeepSeek: immediate limitation of processing for Italian users Order
After the Chinese providers had declared that they did not operate in Italy and were not subject to the GDPR, Italy's data protection authority (Garante per la protezione dei dati personali) ordered, as a matter of urgency and with immediate effect, the limitation of the processing of Italian users' data and opened an investigation.
Companies that offer AI services to European users are subject to the GDPR – regardless of where they are headquartered.
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- DSGVO, Art. 58 Abs. 2 lit. f (Beschränkung der Verarbeitung)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Published
- 30 Jan 2025
- Intelligenza artificiale: il Garante privacy blocca DeepSeek Press release of an authority
- Garante, Provvedimento del 30 gennaio 2025 [10098477] (DeepSeek) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
16 Jan 2025 DoNotPay, Inc.FTC: “robot lawyer” DoNotPay pays 193,000 USD for untested AI promises €187,889
According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), DoNotPay advertised its AI chatbot as “the world’s first robot lawyer” that could replace a human lawyer, without ever having tested its performance against lawyers or having it reviewed by legal professionals. The final settlement order (5–0 vote) prohibits such claims without evidence and requires 193,000 USD and notification of subscribers from 2021 to 2023 about the limitations of the legal features.
Back performance claims for AI products with tests that prove exactly the advertised capability – “replaces the professional” is a verifiable promise.
Substantiating advertising claims about AI capabilities
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- Section 5 FTC Act (irreführende Geschäftspraktiken)
- Action
- Order
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 11 Feb 2025
Original amount 193,000 USD, converted at the ECB reference rate of 16 Jan 2025.
- FTC Finalizes Order with DoNotPay That Prohibits Deceptive 'AI Lawyer' Claims, Imposes Monetary Relief, and Requires Notice to Past Subscribers Press release of an authority
- FTC Cases and Proceedings: DoNotPay Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
14 Jan 2025 Presto Automation Inc.SEC: “AI washing” – Presto Automation overstated the automation of its drive-thru AI Order
According to the Securities and Exchange Commission (SEC, the US securities regulator), the restaurant technology company, which was listed at the time, made misleading statements about its voice AI product “Presto Voice” from 2021 to 2023: it concealed that the speech recognition initially belonged to a third party and claimed that the AI eliminated the need for human order-taking, although the vast majority of orders required human intervention. The SEC issued a cease-and-desist order without a fine.
Disclose in investor communications on AI how much human work is in the product and who owns the technology – exaggeration is a capital markets violation.
Capital markets communication on AI products (“AI washing”)
- Authority / court
- U.S. Securities and Exchange Commission (SEC)
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- Section 17(a)(2) Securities Act 1933; Section 13(a) Securities Exchange Act 1934
- Action
- Order
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Mitigating circumstances
- No fine owing to cooperation and remedial measures.
- Published
- 14 Jan 2025
- In the Matter of Presto Automation Inc. (Securities Act Release No. 11352) Decision of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
13 Jan 2025 IntelliVision Technologies Corp.FTC: IntelliVision may no longer advertise facial recognition as “free of bias” Order
According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), the provider of AI facial recognition claimed without sufficient evidence that its software was among the most accurate on the market and performed without gender or skin-colour bias; contrary to its advertising, it had not been trained on millions of faces, and there was no evidence for the claim that it could not be fooled by photos or videos. The final settlement order prohibits false statements on accuracy, demographic performance and spoofing detection, as well as such statements without reliable testing.
Treat statements on the fairness and accuracy of an AI model as advertising claims – anyone promising “bias-free” must have tested performance for each population group.
Verifiable statements on the accuracy and fairness of AI models
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- Section 5 FTC Act (irreführende Geschäftspraktiken)
- Action
- Order
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 13 Jan 2025
- FTC Finalizes Order Prohibiting IntelliVision from Making Deceptive Claims About Its Facial Recognition Software Press release of an authority
- FTC Cases and Proceedings: Intellivision Technologies Corp. Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
26 Nov 2024 Evolv Technologies Holdings, Inc.FTC: Evolv to let schools exit contracts – alleged overstated advertising for AI weapons scanners Order
According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), Evolv advertised that its AI-powered security scanners would detect all weapons, ignore harmless items and be more accurate and faster than metal detectors; according to the complaint, the devices at one school missed a knife in October 2022 that was used to stab a student. The settlement order filed together with the complaint at the federal court in Massachusetts is to allow schools with contracts from April 2022 to June 2023 to cancel and to prohibit unsubstantiated claims about detection performance, false alarms and staffing costs; according to the FTC case page, court approval was still pending in March 2025.
Keep performance claims for safety-critical AI accurate – overstated claims become a contractual risk, and customers can be released from contracts based on them.
Performance claims for AI security technology
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- Section 5 FTC Act; Stipulated Order for Permanent Injunction
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Defence and security
- Published
- 26 Nov 2024
- FTC Takes Action Against Evolv Technologies for Deceiving Users About its AI-Powered Security Screening Systems Press release of an authority
- FTC v. Evolv Technologies Holdings, Inc. Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
2 Nov 2024 OpenAIGarante: 15 million EUR against OpenAI over ChatGPT – later annulled by the court overturned
Italy's data protection authority (Garante per la protezione dei dati personali) imposed 15 million EUR because OpenAI trained ChatGPT with user data without an appropriate legal basis, breached transparency obligations, failed to report a data breach from March 2023 and did not provide for age verification; in addition, a six-month information campaign was ordered. The Rome Court (Tribunale di Roma) upheld OpenAI's action in judgment no. 4153/2026 (published on 18 March 2026); the Garante subsequently removed the decision from its website.
Companies that train AI models with personal data need a documented legal basis and age verification in advance.
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- DSGVO (Rechtsgrundlage, Transparenz, Meldung von Datenpannen, Schutz Minderjähriger)
- Action
- Fine
- Status of proceedings
- overturned
- Sector
- Telecoms, IT and software
- Published
- 20 Dec 2024
Amount in EUR; no ECB reference rate is available for this currency.
- ChatGPT, il Garante privacy chiude l’istruttoria Press release of an authority
- OpenAI, annullata la sanzione del Garante privacy Additional reference (not official)
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
21 Aug 2024 a US provider of generative AI for hospitalsTexas obliges AI provider for hospitals to give honest accuracy claims Order
The Texas Attorney General's office concluded an Assurance of Voluntary Compliance with a Texas-based provider of generative AI for hospitals and submitted it to the court for approval. The provider had advertised the accuracy of its software, which summarises patient data for hospital staff, including with a 'severe hallucination' rate of less than 1 in 100,000; the authority considered these metrics likely to be inaccurate and misleading. For five years the provider must clearly explain such metrics in its advertising or have them substantiated by an independent auditor, and must disclose to its customers the risks, limitations and appropriate use of its products; the company denies any wrongdoing, and no payment is provided for.
Reliability metrics for AI need a disclosed definition and measurement method – and users must know when they should not rely on the system.
Performance claims for AI systems; limitations and appropriate use of AI in clinical practice
- Authority / court
- Office of the Attorney General of Texas, Consumer Protection Division
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- Texas Deceptive Trade Practices–Consumer Protection Act (DTPA), Tex. Bus. & Com. Code §§ 17.41–17.63; Zusicherung nach § 17.58
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Healthcare
- Published
- 18 Sep 2024
Checked against the official source on 8 Oct 2026 · Company name anonymised since 21 Aug 2026 · Direct link
Report an error
16 May 2024 a US facial recognition providerDutch AP: 30.5 million EUR against facial recognition provider over facial database €30.5m
The provider processes biometric data of people in the Netherlands without a legal basis for a facial recognition database compiled from the internet, did not inform data subjects, did not respond to access requests and did not designate an EU representative. In addition to a fine of 30.5 million EUR, the Dutch data protection authority (Autoriteit Persoonsgegevens, AP) imposed four orders subject to penalty payments.
Publicly accessible photos are no licence for biometric analysis – users of such services risk fines of their own.
- Authority / court
- Autoriteit Persoonsgegevens
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- DSGVO Art. 5 Abs. 1 lit. a, 6 Abs. 1, 9 Abs. 1, 12, 14, 15, 27
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Published
- 3 Sep 2024
- EDSA (EDPB), Nachrichten (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 16 May 2026 · Direct link
Report an error
18 Mar 2024 a US investment adviserSEC ‘AI washing’: investment adviser pays 225,000 US dollars for fabricated AI use €206,574
From 2019 to 2023, the investment adviser claimed to use AI and machine learning to analyse client data for investment decisions but did not have these capabilities. In a settlement with the U.S. Securities and Exchange Commission (SEC) (without admission), the adviser paid 225,000 US dollars.
Statements about the use of AI in marketing and investor information must be technically verifiable.
Permissible advertising claims about AI capabilities
- Authority / court
- U.S. Securities and Exchange Commission
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- Investment Advisers Act of 1940; Marketing Rule
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Published
- 18 Mar 2024
Original amount 225,000 USD, converted at the ECB reference rate of 18 Mar 2024.
- SEC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 18 Mar 2026 · Direct link
Report an error
18 Mar 2024 a US investment adviserSEC ‘AI washing’: investment adviser pays 175,000 US dollars for AI advertising promises €160,668
In 2023, the investment adviser falsely advertised itself as the ‘first regulated AI financial advisor’ offering AI-driven expert forecasts, misrepresented tax-loss harvesting and used impermissible liability clauses. In a settlement with the U.S. Securities and Exchange Commission (SEC), the company paid 175,000 US dollars.
Superlatives such as ‘first AI adviser’ are statements of fact and must be checked before publication.
Permissible advertising claims about AI capabilities
- Authority / court
- U.S. Securities and Exchange Commission
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- Investment Advisers Act of 1940; Marketing Rule
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Published
- 18 Mar 2024
Original amount 175,000 USD, converted at the ECB reference rate of 18 Mar 2024.
- SEC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 18 Mar 2026 · Direct link
Report an error
19 Dec 2023 a US pharmacy chainFTC: five-year ban on AI facial recognition for pharmacy chain after false alerts Order
According to the U.S. Federal Trade Commission (FTC), the pharmacy chain used AI facial recognition in hundreds of stores from 2012 to 2020, which falsely flagged customers – particularly women and people of colour – as shoplifters; accuracy was neither tested in advance nor monitored, and employees were not adequately trained. Under the proposed settlement order (subject to approval by the bankruptcy court and the federal court), the chain may not use the technology for surveillance for five years and must delete images and algorithms developed from them; in addition, the FTC alleges a violation of its 2010 data security order.
AI systems with consequences for people need testing for error rates, ongoing monitoring and trained staff who critically review matches.
Training on handling AI matches and false alerts
Missing or inadequate training played a role in the decision.
- Authority / court
- Federal Trade Commission
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- FTC Act Section 5; Verstoß gegen FTC-Datensicherheitsanordnung von 2010
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Employees
- 10,000 or more
- Repeat case
- yes
- Published
- 19 Dec 2023
- FTC, Pressemitteilungen (Übersicht) (Entscheidung 2023) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 19 Dec 2025 · Direct link