Latest privacy fines, EU and US

First-ever CCPA data-broker action, and first joint CCPA + Delete Act case: didn't register as a data broker and required an SSN or address just to process an opt-out.

Inadequate credential and certificate security let attackers breach systems twice via social engineering, exposing 365,000+ customers.

Lacked credential-stuffing safeguards, rate limiting, or intrusion monitoring, enabling the 2023 breach that exposed genetic data of 6.9 million users.

Third-party ad-tech trackers allegedly collected site-visitor data without consent, in violation of CIPA's pen-register provision.

Repurposed and consolidated over 12 billion traveler records for profiling without a valid legal basis or adequate transparency.

Sold driver geolocation and driving-behavior data to data brokers without adequate consumer consent, the largest CCPA penalty to date and the first centered on data minimization.

First CCPA action centered on students: used tracking technology to sell and share student and family data with ad and analytics partners without an effective opt-out.

Relied on self-declared age only, with no robust age assurance or children's-risk DPIA, letting under-13s onto the platform.

Didn't consistently honor consumer opt-out-of-sale/share requests across devices and streaming services tied to Disney accounts.

Weak VPN authentication and ineffective anomaly detection contributed to a breach exposing 24 million subscriber records, including IBANs.

A 2021/2022 breach via a former employee's credentials exposed unencrypted student records for millions of students nationwide.

Advertising cookies loaded before any consent choice was made, and clicking "Reject all" did not actually stop tracking cookies.

Inserted ads into Gmail inboxes without consent, and placed cookies at account creation without a valid consent choice.

Resolved claims Google tracked user locations despite privacy settings, misrepresented Incognito-mode privacy, and collected biometric identifiers without consent.

Couldn't demonstrate EEA user data accessed by staff in China had protection essentially equivalent to the EU, and didn't disclose that access in its privacy policy.

Collected and sold sensitive location data, including visits to health clinics and places of worship, without informed consent.

Its "Tag Suggestions" facial-recognition feature captured facial geometry from photos without consent, violating Texas's biometric-identifier law.

Transferred EU drivers' location, payment, and in some cases medical or criminal data to the US for over two years without SCCs or another valid transfer mechanism.

Continued transferring Facebook EU/EEA user data to the US via SCCs without adequate supplementary measures after Schrems II, the largest GDPR fine issued to date.