Enforcement Watch: the full case index
Summary
This is every privacy and consent enforcement action we track, most recent first. Each row names who brought it (typed exactly, because a regulator action and a private lawsuit are different events), the company, the mechanism, and the amount, and links to a full breakdown.
How to read this index
A regulator action and a private lawsuit are different events, so each row is typed by who actually brought it: the FTC, CalPrivacy (the CPPA), a named state Attorney General, a national data protection authority (such as the CNIL or the AEPD), the OAIC, or private class-action plaintiffs. Amounts are the reported fine or settlement. Where an amount is pending or there is no fine, the row says so. Status verbs (under appeal, proposed settlement, final approval) are kept exact on each case page.
Regulator: FTCRegulator: CalPrivacy (CPPA)Regulator: California Attorney GeneralRegulator: CNIL (France)Regulator: OAIC (Australia)Private litigation
The index
| Date | Enforcer (typed) | Company | Mechanism | Amount | Case page |
|---|---|---|---|---|---|
| 2026 | |||||
| Jul 29, 2026 (filed) | Regulator: FTC, with Utah and California | Hims & Hers | Alleged sharing of health data (ED, mental health) with ad platforms, not clearly disclosed | Pending | Hims & Hers |
| Jul 20, 2026 (order) | Private litigation (CIPA) | CIPA serial-filer wave (Shah) | Serial CIPA filer declared vexatious (at least 29 proceedings since 2021) | No amount (prefiling order) | Serial-filer wave |
| Jul 14, 2026 (final approval) | Private litigation | Kaiser Permanente | Quantum Metric, X, Adobe, Bing, Google trackers (alleged) | about $47.5M (motion pending) | Kaiser Permanente |
| Jun 26, 2026 (final approval) | Private litigation (CIPA) | Los Angeles Times | Three ad trackers, pen-register theory (alleged) | $3.85M, under appeal | LA Times |
| Jun 11, 2026 (determinations) | Regulator: OAIC (Australia) | Medmate and Monash IVF | Health pixels sending data to ad platforms | Breach findings, no fine | OAIC health pixels |
| Mar 5, 2026 | Regulator: CalPrivacy (CPPA) | Ford Motor Company | Email-verification friction added to opt-out | $375,703 | Ford |
| Mar 3, 2026 | Regulator: CalPrivacy (CPPA) | PlayOn Sports (GoFan) | Tracking required to use a ticket; opt-out signals ignored | $1.1M | PlayOn Sports |
| Feb 11, 2026 | Regulator: California Attorney General | Disney (Disney+, Hulu, ESPN+) | Opt-out not carried across devices and services | $2.75M settlement | Disney |
| 2026 (prelim approval, final Nov 2026) | Private litigation (PA WESCA) | Penn Medicine | Five trackers incl. TikTok (alleged); two-year conditional ad-tech limit | Up to $9.25M (proposed) | Penn Medicine |
| 2026 (proposed, final hearing Oct 2026) | Private litigation | LifeStance Health | Meta and Google tracking; mental-health data (alleged); 5-year limit on non-HIPAA-compliant pixels | $3.03M (proposed) | LifeStance |
| 2026 (prelim approval, final hearing Sep 30 2026) | Private litigation (Florida) | European Wax Center | Tracking tools allegedly disclosed visitor data to third parties | Up to $5M (proposed) | European Wax Center |
| 2025 | |||||
| Nov 27, 2025 | Regulator: CNIL (France) | American Express Carte France | Cookies before, and despite, refusal | €1.5M | American Express |
| Nov 20, 2025 | Regulator: CNIL (France) | Condé Nast (vanityfair.fr) | Cookies on arrival; “reject” did not stop tracking | €750,000 | Condé Nast |
| Nov 14, 2025 (paid) | Regulator: AEPD (Spain) | Tiger Media | Ad cookies without consent; no EU representative (GDPR) | €72,000 | Tiger Media |
| Sep 30, 2025 | Regulator: CalPrivacy (CPPA) | Tractor Supply | Opt-out webform did not stop trackers; GPC not honored until Jul 2024 | $1.35M | Tractor Supply |
| Sep 1, 2025 | Regulator: CNIL (France) | Google LLC and Google Ireland | Cookies steered during signup; Gmail inbox ads | €325M | |
| Sep 1, 2025 | Regulator: CNIL (France) | Shein (Infinite Styles Services) | Cookies before the banner; kept after “refuse all” | €150M | Shein |
| Jul 1, 2025 | Regulator: California Attorney General | Healthline Media | Banner did not disable tracking cookies; diagnosis-suggesting titles shared | $1.55M settlement | Healthline |
| May 6, 2025 | Regulator: CalPrivacy (CPPA) | Todd Snyder | Opt-outs not processed for 40 days; ID verification required | $345,178 | Todd Snyder |
| Mar 12, 2025 | Regulator: CalPrivacy (CPPA) | American Honda | Asymmetric opt-out; excessive verification | $632,500 | American Honda |
| 2025 (prelim approval; no final approval entered) | Private litigation | Aspen Dental | Meta Pixel and Google Analytics on appointment site (alleged) | Up to ~$18.47M (proposed) | Aspen Dental |
| 2022 | |||||
| Aug 24, 2022 | Regulator: California Attorney General | Sephora | Sale not disclosed; GPC opt-out ignored | $1.2M settlement | Sephora |
30-day free trial
See what your tags send before it becomes a case
DataTrue runs real journeys on your site in each consent state and reads what each tag sends, field by field. A tag sending what it should not shows up in a test.
What DataTrue checks
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
Also in the full platform
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
Start a free 30-day trial ★★★★★ 4.6/5 on G2
The full platform, every feature, free for 30 days.
A scheduled daily coverage scan in DataTrue