Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by stateWhat for?
by area of lawAll areas of law
- Data protection €1.2bn 58 % · 9 cases
- Consumer protection and online retail €430.9m 21 % · 4 cases
- Environment and sustainability €191m 9 % · 5 cases
- Money laundering and terrorist financing €147.8m 7 % · 6 cases
- Capital markets and financial supervision €43.6m 2 % · 1 case
- Information security and cyber €24.3m 1 % · 11 cases
- Health and safety and employment law €16.3m 1 % · 10 cases
- AI and digital regulation – 0 % · 1 case
Who?
by sectorAll sectors
- Telecoms, IT and software €1.19bn 58 % · 1 case
- Other €433.9m 21 % · 6 cases
- Financial services and insurance €208.9m 10 % · 16 cases
- Automotive €171.3m 8 % · 3 cases
- Manufacturing and mechanical engineering €20.2m 1 % · 2 cases
- Retail and e-commerce €12.4m 1 % · 7 cases
- Food and agriculture €8.67m 0 % · 5 cases
- Media and online platforms €4.84m 0 % · 3 cases
- Healthcare €612,121 0 % · 2 cases
- Steel and metals €180,168 0 % · 1 case
- 1 more€0
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 1 | €4.58m |
| 2023 | 7 | €481.7m |
| 2024 | 10 | €61.9m |
| 2025 | 20 | €1.28bn |
| 2026 | 9 | €225.9m |
47 cases
5 Aug 2026 Order Express, Inc.NYDFS: $250,000 against money transmitter Order Express over cyber deficiencies €216,375
The licensed money transmitter had no adequate policies for system updates and insufficient risk assessments under New York's cybersecurity regulation, as found by the New York State Department of Financial Services (NYDFS). The company has already remedied the deficiencies.
Even small financial service providers must keep documented patch policies and regular risk assessments.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- Because of its low turnover, the company was exempt from many Part 500 obligations; deficiencies already remedied.
- Published
- 5 Aug 2026
Original amount 250,000 USD, converted at the ECB reference rate of 5 Aug 2026.
- New York State Department of Financial Services Secures Cybersecurity Settlement with Order Express, Inc. Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
21 Jul 2026 1-800-Flowers.com, Inc.New York: 1-800-Flowers pays 375,000 USD over concealed subscription renewals €328,429
According to the Attorney General's office, the company sold an annual shipping subscription ("Celebrations Passport") whose terms between February 2021 and June 2022 appeared only in small print, in linked terms or in pop-up boxes; a post-purchase acknowledgement and a notice before automatic renewal were missing. In the Assurance of Discontinuance it undertakes to pay 375,000 USD in penalties, fees and costs, to refund subscribers and to change its subscription processes. The authority allegedly made the findings set out here; this account is not based on a final judgment.
Automatically renewing subscriptions need clear terms before purchase, a purchase acknowledgement and a reminder before renewal.
Transparent subscription models with automatic renewal
- Authority / court
- Office of the New York State Attorney General
- Area of law
- Consumer protection and online retail · Information duties in online retail
- Legal basis
- New York General Business Law §§ 349, 527-a; Executive Law § 63(12); Restore Online Shoppers' Confidence Act (15 U.S.C. § 8403)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Retail and e-commerce
- Published
- 22 Jul 2026
Original amount 375,000 USD, converted at the ECB reference rate of 21 Jul 2026.
- NY Attorney General press release: $375,000 from 1-800-Flowers for Deceiving Consumers About Automatic Subscription Renewals Press release of an authority
- Assurance of Discontinuance, 1-800-Flowers.com, Inc. (2026) Decision of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
16 Jul 2026 Swedbank AB (publ) (mit New York Branch)NYDFS: USD 50 million against Swedbank for withholding information €43.6m
The NYDFS imposed a penalty of USD 50 million on Swedbank AB (publ) and its New York branch. In response to several requests by the regulator under section 37 of the New York Banking Law concerning links between its Baltic subsidiaries and the law firm Mossack Fonseca (Panama Papers) and the status of European investigations, the bank did not provide the requested information, in breach of section 125(3) of the New York Banking Law. The authority allegedly made the findings set out here; this account is not based on a final judgment.
Information requests from the regulator must be answered in full; withholding information is sanctioned in its own right.
Complete and truthful disclosures to the regulator
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Capital markets and financial supervision · Disclosure and reporting obligations
- Legal basis
- New York Banking Law § 125(3) i. V. m. § 37; Sanktion nach Banking Law §§ 39, 44
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Liability of senior managers
- According to the order, the bank has since, among other things, dismissed its then Chief Compliance Officer and its former CEO and parted ways with numerous other employees; the majority of the board has been replaced.
- Published
- 16 Jul 2026
Original amount 50,000,000 USD, converted at the ECB reference rate of 16 Jul 2026.
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
9 Jun 2026 Xponential Fitness, Inc. u. a. (Franchisegesellschaften der Marken AKT, BFT, Club Pilates, CycleBar, Pure Barre, Rumble, StretchLab, YogaSix)New York: Xponential Fitness pays 3.97 million USD over misleading franchise disclosures €3.43m
According to the Attorney General's office, the fitness franchisor stated three to six months until studio opening in the disclosure documents filed in New York, although it took more than 13 months on average and its own SEC reports showed longer periods. The Assurance of Discontinuance requires 3,971,250 USD: 3 million USD for 70 harmed franchisees (of which 300,000 USD is a civil penalty) and 971,250 USD in fee refunds to 25 franchisees who never opened. The authority allegedly made the findings set out here; this account is not based on a final judgment.
Statements in franchise disclosures must match the company's own capital market reports – discrepancies count as evidence of deception.
Realistic statements in franchise disclosure documents
- Authority / court
- Office of the New York State Attorney General (Investor Protection Bureau, Franchise Section)
- Area of law
- Consumer protection and online retail
- Legal basis
- New York Franchise Sales Act (General Business Law §§ 680 ff., insb. § 687); Executive Law § 63(12)
- Action
- Disgorgement of profits
- Status of proceedings
- final
- Sector
- Other
- Published
- 9 Jun 2026
Original amount 3,971,250 USD, converted at the ECB reference rate of 9 Jun 2026.
- NY Attorney General press release: More Than $3.9 Million from Xponential Fitness for Misleading Franchise Owners Press release of an authority
- Assurance of Discontinuance, Xponential Fitness, Inc. et al. (2026) Decision of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
18 May 2026 Volvo Group North America, LLCVolvo Group North America: settlement of around 197 million USD over undisclosed emission control devices €168.7m
Around 10,000 heavy-duty Volvo diesel engines from model years 2010 to 2016 used auxiliary emission control devices (AECDs) that were not disclosed during certification and emitted more NOx than permitted. The settlement with the California Air Resources Board (CARB) comprises 17.5 million USD in penalties and costs, 71 million USD for mitigation measures and 108 million USD for emission reduction projects in California.
Every emissions-relevant control function must be fully disclosed in the certification application; otherwise high settlement payments may follow years later.
- Authority / court
- California Air Resources Board (CARB)
- Area of law
- Environment and sustainability · Emissions and permits
- Legal basis
- Kalifornische Emissions- und Zertifizierungsvorschriften für schwere Nutzfahrzeugmotoren
- Action
- Fine
- Status of proceedings
- final
- Sector
- Automotive
- Employees
- 10,000 or more
- Mitigating circumstances
- Cooperation during the investigation; recall and extended warranty for engines from model years 2014 to 2016.
- Published
- 18 May 2026
Original amount 196,500,000 USD, converted at the ECB reference rate of 18 May 2026.
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
29 Apr 2026 Delta Dental Insurance Company und Delta Dental of New York, Inc.NYDFS: $2.25 million against Delta Dental after MOVEit attack and late notification €1.92m
In 2023, attackers exploited a zero-day vulnerability in MOVEit Transfer to steal files containing social security, driving licence, account and health data. The New York State Department of Financial Services (NYDFS) criticised inadequate retention settings, policies and controls as well as the late notification of the cybersecurity incidents to the supervisory authority.
Keep data in transfer tools only for as long as necessary – and report security incidents to the supervisory authority on time.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
- Published
- 30 Apr 2026
Original amount 2,250,000 USD, converted at the ECB reference rate of 29 Apr 2026.
- DFS Secures $2.25 Million Cybersecurity Settlement with Delta Dental Press release of an authority
- Consent Order to Delta Dental 2026 Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
26 Feb 2026 All FAB Precision Sheetmetal, Inc.Sheet metal fabricator: second amputation on the same press brake – Cal/OSHA $212,850 €180,168
In June 2025, an employee in San Jose lost a finger on a press brake without guarding – identical to an accident in June 2024 for which the business had already been fined $43,500. The California Division of Occupational Safety and Health (Cal/OSHA) imposed $212,850 (including a wilful repeat violation); the employer appealed.
After an accident, retrofitting the machine is mandatory – an identical second accident will be treated as wilful.
- Authority / court
- California Division of Occupational Safety and Health (Cal/OSHA)
- Area of law
- Health and safety and employment law · Workplace safety and accidents
- Legal basis
- California Code of Regulations, Title 8 (Maschinenschutz)
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Steel and metals
- Culpability
- intentional
- Repeat case
- yes
- Published
- 26 Feb 2026
Original amount 212,850 USD, converted at the ECB reference rate of 26 Feb 2026.
- Cal/OSHA cites San Jose sheet metal company more than $212,000 following amputation accident (DIR) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
11 Feb 2026 Disney DTC, LLC und ABC Enterprises, Inc. (The Walt Disney Company)California: $2.75 million against Disney over incomplete opt-outs for streaming €2.31m
Disney implemented objections to the sale and sharing of data only for individual services or devices rather than across the whole account, continued to disclose data via embedded ad-tech providers and offered no opt-out in connected TV apps. It was the largest CCPA settlement at the time of the agreement with the Attorney General of California.
An opt-out must take effect across all services, devices and integrated third-party providers of an account.
- Authority / court
- Attorney General of California (California Department of Justice)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 11 Feb 2026
Original amount 2,750,000 USD, converted at the ECB reference rate of 11 Feb 2026.
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
4 Feb 2026 Alco Harvesting LLC dba Bonipak Produce Inc. und verbundene UnternehmenBonipak: $6.175 million for farmworkers over undisclosed paid sick leave €5.22m
Following the COVID death of a farmworker in employer-provided housing, the California Labor Commissioner's Office sued the agricultural business in Santa Maria in 2021: more than 10,000 farmworkers, including H-2A seasonal workers, had not been informed of their entitlement to paid sick leave; in addition, there was unpaid travel time as well as overtime and minimum wage violations. The settlement of $6,175,000 (of which $4.2 million goes directly to workers) includes posting and reporting obligations.
Information obligations towards seasonal workers are not a formality – companies that leave workers in the dark about paid sick leave are liable for the consequences.
- Authority / court
- California Labor Commissioner's Office (Division of Labor Standards Enforcement)
- Area of law
- Health and safety and employment law · Minimum wage and undeclared work
- Legal basis
- California Labor Code (Paid Sick Leave, COVID-19 Supplemental Paid Sick Leave, Mindestlohn, Überstunden)
- Action
- Other
- Status of proceedings
- final
- Sector
- Food and agriculture
- Published
- 4 Feb 2026
Original amount 6,175,000 USD, converted at the ECB reference rate of 4 Feb 2026.
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
30 Dec 2025 Rickenbacher Data LLC (Datamasters)CPPA: $45,000 against data broker Datamasters over failure to register €38,275
Without registering as a data broker, the Texas reseller traded in the names and contact details of millions of people, sorted by illnesses such as Alzheimer's or addiction, by age, presumed ethnicity and political views. In addition to the fine, the California Privacy Protection Agency (CPPA) requires it to stop selling data on all Californians.
Companies that buy or sell address lists for advertising must check registration obligations – health-related lists are particularly risky.
- Authority / court
- California Privacy Protection Agency (CPPA)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- California Delete Act (Registrierungspflicht für Datenhändler)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Other
- Published
- 8 Jan 2026
Original amount 45,000 USD, converted at the ECB reference rate of 30 Dec 2025.
- CalPrivacy Data Broker Enforcement Strike Force: enforcement actions Press release of an authority
- CPPA Order of Decision: Rickenbacher Data LLC d/b/a Datamasters (ENF25-172-D-DA) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
21 Nov 2025 Jam City, Inc.Jam City: 1.4 million USD in California over missing opt-outs in 21 gaming apps €1.22m
On a complaint by the California Attorney General, the Superior Court in Los Angeles entered a stipulated judgment against the mobile game developer Jam City. According to the investigation, none of Jam City's 21 apps offered a way, as required by the California Consumer Privacy Act (CCPA), to opt out of the sale or sharing of personal data for personalised advertising, and some games passed on data of teenagers aged between 13 and 16 without their affirmative consent. Jam City pays 1,400,000 USD, must offer opt-out options within the apps, may only sell or share data of under-16s on an opt-in basis and must instruct recipients to delete such data. The authority allegedly made the findings set out here; this account is not based on a final judgment.
A business that shares data for advertising through apps must enable the opt-out where the data is collected – directly in the app.
Right to opt out of data sales in apps; protecting minors in advertising tracking
- Authority / court
- Superior Court of California, County of Los Angeles, auf Klage des Attorney General of California (California Department of Justice)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- California Consumer Privacy Act (CCPA), Cal. Civ. Code § 1798.100 ff.; Zahlung nach Cal. Civ. Code § 1798.199.90
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Published
- 21 Nov 2025
Original amount 1,400,000 USD, converted at the ECB reference rate of 21 Nov 2025.
- People v. Jam City, Inc., Case No. 25STCV34029, Superior Court Los Angeles, Final Judgment and Permanent Injunction (21.11.2025) Court decision
- California DOJ, Pressemitteilung: Attorney General Bonta Secures $1.4 Million Settlement with Mobile App Gaming Company (21.11.2025) Press release of an authority
- California DOJ: Privacy Enforcement Actions (Übersicht) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
20 Nov 2025 Caesars Entertainment, Inc. / Desert Palace, LLC (Caesars Palace)Nevada: 7.8 million USD against Caesars over gambling by an illegal bookmaker €6.77m
On 13 November 2025, the Nevada Gaming Control Board (NGCB) filed a disciplinary complaint for unsuitable methods of operation in connection with an illegal bookmaker and at the same time concluded a settlement of 7.8 million USD with conditions attached to the gaming licences. The conditions relate primarily to improving the AML programme and to additional training and awareness-raising for employees; the Nevada Gaming Commission (NGC) adopted the settlement as its order on 20 November 2025 (Case No. 25-03).
Casino staff must recognise high-risk players and unexplained sources of funds – revenue interests must not override AML obligations.
Checking the source of gambling funds, recognising high-risk customers
Missing or inadequate training played a role in the decision.
- Authority / court
- Nevada Gaming Commission (NGC) auf Beschwerde des Nevada Gaming Control Board (NGCB)
- Area of law
- Money laundering and terrorist financing · Customer due diligence
- Legal basis
- Glücksspielrecht Nevada (unsuitable methods of operation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Other
- Employees
- 10,000 or more
- Mitigating circumstances
- Numerous remedial measures already implemented
- Published
- 13 Nov 2025
Original amount 7,800,000 USD, converted at the ECB reference rate of 20 Nov 2025.
- Nevada Gaming Control Board and Caesars Entertainment, Inc. Enter into Proposed Stipulation for Settlement Regarding Disciplinary Complaint Press release of an authority
- Nevada Gaming Commission – Disposition, November 2025 Agenda (20.11.2025) Decision of an authority
Checked against the official source on 27 Sep 2026 · Version 2 · Direct link
Report an error
31 Oct 2025 Google LLCTexas: Google pays $1.375 billion over location, incognito and biometric data €1.19bn
Texas, represented by the Office of the Attorney General, had sued Google for unlawfully collecting location data, activity in incognito mode and biometric identifiers. Google signed a settlement of $1.375 billion, concluding two sets of proceedings.
Settings such as location history or incognito mode must deliver what they promise users – otherwise billion-dollar risks loom, even at the level of individual US states.
- Authority / court
- Office of the Attorney General of Texas
- Area of law
- Data protection · Cookies and tracking
- Action
- Other
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Employees
- 10,000 or more
- Published
- 31 Oct 2025
Original amount 1,375,000,000 USD, converted at the ECB reference rate of 31 Oct 2025.
- Attorney General Ken Paxton Finalizes Historic Settlement with Google and Secures $1.375 Billion Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
31 Oct 2025 JBS USA Food Company und JBS USA Food Company HoldingsNew York: JBS USA pays 1.1 million USD over unsubstantiated "Net Zero 2040" claims Other
The Attorney General's office accused the US arm of the meat group JBS of publicly advertising a "net zero by 2040" goal without a viable plan to achieve it. After a first lawsuit had been dismissed without prejudice in January 2025, the parties concluded an Assurance of Discontinuance: JBS USA pays 1.1 million USD to a climate-smart agriculture programme (expressly not a fine), changes its environmental marketing and reports annually for three years. The authority allegedly made the findings set out here; this account is not based on a final judgment.
Net-zero promises are advertising claims and need a verifiable implementation plan, otherwise they are treated as misleading.
Communicating climate targets only with a robust implementation plan
- Authority / court
- Office of the New York State Attorney General
- Area of law
- Environment and sustainability · Misleading environmental and sustainability claims
- Legal basis
- New York General Business Law §§ 349, 350; Executive Law § 63(12), § 63(15)
- Action
- Other
- Status of proceedings
- final
- Sector
- Food and agriculture
- Published
- 3 Nov 2025
- NY Attorney General press release: $1.1 Million for Climate-Smart Agriculture from World's Largest Beef Producer Press release of an authority
- Assurance of Discontinuance, People of the State of New York v. JBS USA Food Company (2025) Decision of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
23 Oct 2025 TFG Holding, Inc.JustFab, ShoeDazzle, FabKids: 4.8 million USD settlement with 33 attorneys general over VIP membership €4.14m
According to the allegations of the attorneys general, the online fashion retailer enrolled buyers in a paid VIP membership programme without their express consent, presented prices in a misleading way and made cancellation difficult. Under the settlement with 32 states and D.C., TFG is providing around 3.8 million USD in automatic refunds and paying 1 million USD to the states; the settlement does not constitute an admission of guilt.
A purchase must not silently trigger a membership with monthly charges.
Subscription models and express consent at checkout
- Authority / court
- Attorney General of Pennsylvania (verhandelt mit Maryland, Texas und D.C.; Vergleich mit 33 Attorneys General)
- Area of law
- Consumer protection and online retail · Information duties in online retail
- Legal basis
- Verbraucherschutzgesetze der beteiligten Bundesstaaten
- Action
- Disgorgement of profits
- Status of proceedings
- final
- Sector
- Retail and e-commerce
- Published
- 23 Oct 2025
Original amount 4,800,000 USD, converted at the ECB reference rate of 23 Oct 2025.
- AG Sunday Secures Settlement Valued at $4.8 Million with Online Clothing Retailer Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
21 Oct 2025 Winsor Maintenance Inc., Main Source Group, Inc. u. a. sowie OptumCare Management LLC (Auftraggeberin)Cleaning companies/OptumCare: 438,204 USD – overtime and missed breaks €377,534
More than 90 cleaners in industrial, laboratory and healthcare facilities often worked beyond scheduled hours without overtime pay, received no compensation for split shifts and travel time and were unable to take breaks because of excessive workloads. A web of companies concealed the employer; the Notice of Final Findings of 21 October 2025 established 438,204 USD, with OptumCare jointly liable as the client.
Clients of cleaning and service providers should check working hours and breaks at the provider – otherwise they are jointly liable.
- Authority / court
- California Labor Commissioner's Office (Division of Labor Standards Enforcement)
- Area of law
- Health and safety and employment law · Working time
- Legal basis
- California Labor Code § 2810.3; Overtime, Split Shift, Meal and Rest Periods, Mindestlohn
- Action
- Other
- Status of proceedings
- unknown
- Sector
- Other
- Liability of senior managers
- Measures against individuals are not reported here.
- Published
- 24 Nov 2025
Original amount 438,204 USD, converted at the ECB reference rate of 21 Oct 2025.
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
14 Oct 2025 Farmers Insurance ExchangeNYDFS: $2.775 million against Farmers over unprotected online quoting tools €2.4m
Attackers harvested driving licence numbers and dates of birth via inadequately secured online quoting tools and agent portals. According to the New York State Department of Financial Services (NYDFS), Farmers infringed the cybersecurity regulation and did not report the incident in time; the penalty is part of a package totalling $19 million against eight motor insurers.
Automatically pre-filled forms containing customer data are a point of entry – scrutinise public-facing applications for the data they disclose.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
- Published
- 14 Oct 2025
Original amount 2,775,000 USD, converted at the ECB reference rate of 14 Oct 2025.
- DFS Secures More than $19 Million from Auto Insurance Companies over Data Breaches Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
14 Oct 2025 Infinity Insurance CompanyInfinity Insurance: 2.25 million USD – data leak via quoting tool reported too late €1.95m
Attackers extracted driver’s licence numbers in plain text via the motor insurer’s instant quote applications. Infinity discovered the anomalies on 9 February 2021 but only reported the cybersecurity event to the New York State Department of Financial Services (NYDFS) on 14 April 2021; the supervisor also criticised the lack of MFA and insecure development practices.
Misuse of publicly accessible customer applications is also a reportable incident – warnings from the supervisor should trigger an immediate reporting assessment.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- 23 NYCRR § 500.17(a), § 500.12(a) u. a.
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
Original amount 2,250,000 USD, converted at the ECB reference rate of 14 Oct 2025.
- NYDFS Consent Order to Infinity Insurance Company (14.10.2025) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
26 Sep 2025 Tractor Supply CompanyCPPA: $1.35 million against Tractor Supply over missing opt-out mechanisms €1.16m
The rural retail giant inadequately informed consumers and job applicants about their rights, offered no effective means of opting out of the sale and sharing of data (including no Global Privacy Control) and passed data on to third parties without the required contracts. An officer must certify compliance annually for four years, as required by the California Privacy Protection Agency (CPPA).
Privacy notices must also cover job applicants, and browser opt-out signals such as GPC must be implemented technically.
- Authority / court
- California Privacy Protection Agency (CPPA)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Retail and e-commerce
- Employees
- 10,000 or more
- Published
- 30 Sep 2025
Original amount 1,350,000 USD, converted at the ECB reference rate of 26 Sep 2025.
- CPPA: Tractor Supply Company enforcement decision Press release of an authority
- CPPA Order of Decision and Stipulated Final Order: Tractor Supply Company (ENF24-M-TR-04) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
4 Sep 2025 Midri, Inc. (Restaurant J BBQ, Los Angeles)Restaurant J BBQ: 680,238 USD – breaks denied, split shifts without premium €584,046
The Koreatown restaurant regularly denied 48 employees meal and rest breaks, required them to remain available for guests even during the lunch break, did not pay split-shift premiums and did not pay all wages. The California Labor Commissioner’s Office imposed 680,238 USD, of which 538,638 USD for the benefit of the employees.
In the restaurant trade, breaks must be actively scheduled and documented – being on call for guests during the break turns it into working time.
Break arrangements in the restaurant trade
- Authority / court
- California Labor Commissioner's Office (Division of Labor Standards Enforcement)
- Area of law
- Health and safety and employment law · Working time
- Legal basis
- California Labor Code (Meal and Rest Periods, Split Shift Premium, Lohnabrechnung)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Food and agriculture
- Liability of senior managers
- Measures against individuals are not reported here.
Original amount 680,238 USD, converted at the ECB reference rate of 4 Sep 2025.
Checked against the official source on 28 Sep 2026 · Version 3 · Direct link