Who was sanctioned, and for what?

After almost four years of litigation, the federal district court for Idaho entered an order agreed between the FTC and the data broker Kochava. The FTC had alleged that Kochava sold precise location data from hundreds of millions of mobile devices without the knowledge and consent of the people concerned, revealing, for example, visits to health facilities and places of worship. Kochava and its subsidiary Collective Data Solutions, which has taken over the data broker business, may only share sensitive location data with affirmative consent and for services requested by the consumer, and must introduce, among other things, a sensitive-locations programme, checks on their data suppliers, disclosure of recipients and retention limits; no payment is provided for. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. District Court for the District of Idaho auf Klage der Federal Trade Commission (FTC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Section 5 FTC Act, 15 U.S.C. § 45 (unlautere Praktiken); Verfahren nach Section 13(b), 15 U.S.C. § 53(b)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

26 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

According to the complaint by the US Federal Trade Commission (FTC), Illuminate promised schools data security but did not adequately protect its cloud databases, even though a service provider had pointed out vulnerabilities almost two years earlier; a hacker accessed data on 10.1 million students, including health information. The order requires an information security programme, data minimisation and a public deletion schedule, and prohibits misrepresentations about security and notification deadlines.

Authority / court

Federal Trade Commission (FTC)

Area of law

Data protection · Data breaches and data security

Legal basis

FTC Act (Verbot unlauterer und irreführender Praktiken)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

negligent

Published

5 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

From 2012 to 2018, the Guatemalan mobile network operator made monthly cash payments to members of Congress or their security staff in order to obtain legislative support; part of the funds came from laundered drug money. Two-year Deferred Prosecution Agreement with a criminal penalty of 60 million USD and administrative forfeiture of 58,198,343 USD.

Authority / court

U.S. Department of Justice (Criminal Division, Fraud Section; USAO Southern District of Florida)

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

FCPA, 15 U.S.C. § 78dd-3 (Verschwörung, 18 U.S.C. § 371); Deferred Prosecution Agreement

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure by the parent company Millicom in 2015; subsequently extensive cooperation and remediation (including dismissals of staff and an 800 % increase in compliance personnel).

Published

12 Dec 2025

Original amount 118,198,343 USD, converted at the ECB reference rate of 12 Nov 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Texas, represented by the Office of the Attorney General, had sued Google for unlawfully collecting location data, activity in incognito mode and biometric identifiers. Google signed a settlement of $1.375 billion, concluding two sets of proceedings.

Authority / court

Office of the Attorney General of Texas

Area of law

Data protection · Cookies and tracking

Action

Other

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

31 Oct 2025

Original amount 1,375,000,000 USD, converted at the ECB reference rate of 31 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

According to the FTC complaint, the education provider hid the cancellation option for its automatically renewing subscriptions on its website and, since October 2020, continued to charge almost 200,000 customers even after they had cancelled. Under the settlement, Chegg is paying 7.5 million USD for refunds and must offer simple cancellation.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Restore Online Shoppers' Confidence Act (ROSCA); Section 5 FTC Act

Action

Disgorgement of profits

Status of proceedings

final

Sector

Telecoms, IT and software

Repeat case

yes

Published

15 Sep 2025

Original amount 7,500,000 USD, converted at the ECB reference rate of 18 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

From 2015 to 2021, the San José provider of chip design software supplied hardware, software and semiconductor IP at least 59 times to the National University of Defense Technology (NUDT), a military university on the Entity List, disguised under the alias Central South CAD Center. Cadence pleaded guilty before the US Department of Justice to conspiracy to commit export control violations; criminal penalties of almost 118 million USD and civil penalties of more than 95 million USD imposed by the Bureau of Industry and Security (BIS) result, after crediting, in a net total of more than 140 million USD.

Authority / court

U.S. Department of Justice; Bureau of Industry and Security (BIS)

Area of law

Sanctions and export control · Export control and dual-use goods

Legal basis

Export Administration Regulations (Entity List); ECRA; Verschwörung zu Exportkontrollverstößen

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

intentional

Published

28 Jul 2025

Original amount 140,000,000 USD, converted at the ECB reference rate of 28 Jul 2025.

Checked against the official source on 25 Sep 2026 · Direct link

According to the Federal Trade Commission (FTC, the US consumer protection authority), the web host did not use multi-factor authentication for its hosting services, monitored security threats inadequately and did not secure connections to customer data, yet advertised “award-winning security”. The final order prohibits false statements about security and requires a comprehensive information security programme and regular reviews by independent assessors.

Authority / court

Federal Trade Commission (FTC)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Section 5 FTC Act

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

21 May 2025

Checked against the official source on 28 Sep 2026 · Direct link

According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), DoNotPay advertised its AI chatbot as “the world’s first robot lawyer” that could replace a human lawyer, without ever having tested its performance against lawyers or having it reviewed by legal professionals. The final settlement order (5–0 vote) prohibits such claims without evidence and requires 193,000 USD and notification of subscribers from 2021 to 2023 about the limitations of the legal features.

Authority / court

Federal Trade Commission (FTC)

Area of law

AI and digital regulation · AI systems

Legal basis

Section 5 FTC Act (irreführende Geschäftspraktiken)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

11 Feb 2025

Original amount 193,000 USD, converted at the ECB reference rate of 16 Jan 2025.

Checked against the official source on 28 Sep 2026 · Direct link

According to the Securities and Exchange Commission (SEC, the US securities regulator), the restaurant technology company, which was listed at the time, made misleading statements about its voice AI product “Presto Voice” from 2021 to 2023: it concealed that the speech recognition initially belonged to a third party and claimed that the AI eliminated the need for human order-taking, although the vast majority of orders required human intervention. The SEC issued a cease-and-desist order without a fine.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

AI and digital regulation · AI systems

Legal basis

Section 17(a)(2) Securities Act 1933; Section 13(a) Securities Exchange Act 1934

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Mitigating circumstances

No fine owing to cooperation and remedial measures.

Published

14 Jan 2025

Checked against the official source on 28 Sep 2026 · Direct link

According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), the provider of AI facial recognition claimed without sufficient evidence that its software was among the most accurate on the market and performed without gender or skin-colour bias; contrary to its advertising, it had not been trained on millions of faces, and there was no evidence for the claim that it could not be fooled by photos or videos. The final settlement order prohibits false statements on accuracy, demographic performance and spoofing detection, as well as such statements without reliable testing.

Authority / court

Federal Trade Commission (FTC)

Area of law

AI and digital regulation · AI systems

Legal basis

Section 5 FTC Act (irreführende Geschäftspraktiken)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

13 Jan 2025

Checked against the official source on 28 Sep 2026 · Direct link

According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), the AI writing service offered a “Testimonial & Review” feature that generated detailed customer reviews with entirely invented details from brief, generic input; individual users produced hundreds to tens of thousands of reviews with it. With the final settlement order (3–2 vote), the FTC prohibited Rytr from offering any service for generating reviews. On 22 December 2025, the FTC set the order aside again with Rytr’s consent (2–0 vote): the facts alleged in the complaint did not support a violation of Section 5 of the FTC Act, and the order unduly burdened AI innovation, contrary to the Trump Administration’s AI Executive Order and AI Action Plan.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Section 5 FTC Act (Mittel zur Täuschung bereitgestellt)

Action

Order

Status of proceedings

overturned

Sector

Telecoms, IT and software

Published

18 Dec 2024

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Venezuelan subsidiary of Spain's Telefónica S.A. entered into a DPA and pays a penalty of USD 85,260,000. To be allowed to exchange bolívares for US dollars in a state currency auction in 2014, it had two suppliers pay about USD 28.9 million to an intermediary, part of which went to Venezuelan officials, and covered the cost through overpriced equipment purchases from those suppliers. It received more than USD 110 million from the auction, over 65% of the funds awarded. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Department of Justice (Criminal Division, Fraud Section; USAO Southern District of New York)

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Foreign Corrupt Practices Act (FCPA): Verschwörung zum Verstoß gegen die Anti-Bribery-Vorschriften (Criminal Information, Southern District of New York)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Mitigating circumstances

Cooperation (initially diminished by late production of records) and remediation were credited: disciplinary action including dismissals, an independent compliance function with a Chief Compliance Officer, review of all non-standard pricing transactions, tighter third-party controls; 20% reduction.

Published

8 Nov 2024

Original amount 85,260,000 USD, converted at the ECB reference rate of 8 Nov 2024.

Checked against the official source on 3 Oct 2026 · Direct link

As part of a settlement, the Bureau of Industry and Security imposed a civil penalty of USD 500,000 on GlobalFoundries U.S. Inc. and its subsidiary GlobalFoundries U.S. 2 LLC. Between February 2021 and October 2022 the company sent semiconductor wafers worth around USD 17.1 million in 74 shipments without authorisation to SJ Semiconductor, a company on the Entity List; owing to a data entry error, the service provider designated by the customer had not been screened in the screening system. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Department of Commerce, Bureau of Industry and Security (BIS)

Area of law

Sanctions and export control · Export control and dual-use goods

Legal basis

15 C.F.R. § 764.2(a) (Export Administration Regulations)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Mitigating circumstances

According to BIS, voluntary self-disclosure, cooperation and remedial measures led to a significant reduction of the penalty.

Published

1 Nov 2024

Original amount 500,000 USD, converted at the ECB reference rate of 1 Nov 2024.

Checked against the official source on 3 Oct 2026 · Direct link

According to the CFPB, Apple in some cases failed to forward Apple Card users' disputes to the issuing bank Goldman Sachs and designed advertising and the checkout process so that customers wrongly assumed device purchases would automatically be split into interest-free instalments (Apple Card Monthly Installments). The order imposed a fine of 25 million USD; in September 2025 the CFPB terminated it early after the fine had been paid. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Consumer Financial Protection Bureau (CFPB)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Consumer Financial Protection Act of 2010, §§ 1031, 1036 (12 U.S.C. §§ 5531, 5536) – unlautere, irreführende und missbräuchliche Praktiken

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

23 Oct 2024

Original amount 25,000,000 USD, converted at the ECB reference rate of 23 Oct 2024.

Checked against the official source on 3 Oct 2026 · Direct link

In mandatory disclosures, Unisys presented cyber risks as hypothetical, although it had suffered two intrusions with data exfiltration connected with the SolarWinds compromise. On the same day, the US Securities and Exchange Commission (SEC) also imposed penalties on Avaya ($1 million), Check Point ($995,000) and Mimecast ($990,000).

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Securities Act of 1933, Securities Exchange Act of 1934 (inkl. Disclosure Controls)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Cooperation in the proceedings and improvement of cybersecurity controls.

Published

22 Oct 2024

Original amount 4,000,000 USD, converted at the ECB reference rate of 22 Oct 2024.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The provider of property management software had employees waive potential awards for reports to authorities in two employment agreements and one settlement agreement; 68 consulting agreements (January 2020 to October 2023) prohibited voluntary disclosures to authorities. As part of a sweep against seven listed companies, the provider paid 692,250 US dollars to the U.S. Securities and Exchange Commission (SEC); the contract templates were amended.

Authority / court

U.S. Securities and Exchange Commission

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

Securities Exchange Act of 1934, Rule 21F-17(a)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Mitigating circumstances

Amendment of the templates after contact by the SEC, information provided to those affected, and cooperation

Published

9 Sep 2024

Original amount 692,250 USD, converted at the ECB reference rate of 9 Sep 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 Sep 2026 · Direct link

The FTC issued its final order against a British software maker, its Czech subsidiary and its former data subsidiary. According to the authority, the software maker collected detailed browsing data through browser extensions and antivirus software, stored it indefinitely and sold it via the data subsidiary to more than 100 third parties without adequate notice and consent, even though the products were marketed as protecting against online tracking. The software maker must pay 16,500,000 USD for consumer redress, may no longer sell or license browsing data for advertising purposes, must delete the data transferred to the data subsidiary together with any products and algorithms derived from it, and must set up a privacy programme.

Authority / court

Federal Trade Commission (FTC)

Area of law

Data protection · Cookies and tracking

Legal basis

Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Telecoms, IT and software

Published

27 Jun 2024

Original amount 16,500,000 USD, converted at the ECB reference rate of 26 Jun 2024.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 26 Jun 2026 · Direct link

According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), an attacker exploited weaknesses in the network of the data services provider for companies and non-profit organisations in early 2020 and stole large amounts of unencrypted data, including Social Security and bank account numbers of millions of people; the attack went undetected for three months, the provider informed its customers only after almost two months and misrepresented the extent. The final order requires a comprehensive security programme, a data retention schedule, deletion of data no longer needed and notification of future reportable incidents to the FTC.

Authority / court

Federal Trade Commission (FTC)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Section 5 FTC Act

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

20 May 2024

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 20 May 2026 · Direct link

The U.S. Forced Labor Enforcement Task Force (FLETF) added the manufacturer and eight subsidiaries to the Uyghur Forced Labor Prevention Act (UFLPA) Entity List because they work with the Xinjiang government on the recruitment, transport or reception of forced labourers. The company's goods are therefore presumed to have been produced with forced labour on import into the US unless the importer rebuts this.

Authority / court

U.S. Department of Homeland Security (Forced Labor Enforcement Task Force)

Area of law

Supply chain and human rights · Forced and child labour

Legal basis

Uyghur Forced Labor Prevention Act, Section 2(d)(2)(B)(ii)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

12 Jun 2023

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Jun 2025 · Direct link

The Bureau of Industry and Security imposed a civil penalty of USD 300 million on a US hard disk drive manufacturer and its international headquarters in Singapore, payable in 20 quarterly instalments of USD 15 million. Between August 2020 and September 2021, the manufacturer supplied around 7.4 million foreign-produced hard disk drives worth about USD 1.1 billion on 429 occasions without authorisation to entities of a Chinese telecommunications group on the Entity List, although these were subject to the foreign direct product rule. The order also provides for three audits of the export compliance programme and a denial order suspended for five years.

Authority / court

U.S. Department of Commerce, Bureau of Industry and Security (BIS)

Area of law

Sanctions and export control · Export control and dual-use goods

Legal basis

15 C.F.R. § 764.2(a) (Export Administration Regulations); Export Control Reform Act of 2018 (50 U.S.C. §§ 4801–4852)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

19 Apr 2023

Original amount 300,000,000 USD, converted at the ECB reference rate of 19 Apr 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 19 Apr 2025 · Direct link