{"page":"/blog/us-state-privacy-laws-tracker","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Date","Enforcer","Target","What happened","Source"],"rows":[["13 January 2025","Texas Attorney General","Allstate and Arity","First suit under a state comprehensive privacy law, over driving and location data collected through an app SDK","WilmerHale (secondary); status n/d"],["12 March 2025","CPPA","American Honda Motor Co.","$632,500; excessive verification for opt-outs, asymmetric choices, ad tech contracts","CPPA"],["16 April 2025","Eight regulators","Consortium of Privacy Regulators formed","Bipartisan coordination on enforcement","CPPA"],["6 May 2025","CPPA","Todd Snyder, Inc.","$345,178; opt-out portal failed for 40 days; identity checks before opt-out","CPPA"],["1 July 2025","California Attorney General","Healthline Media","$1.55 million; targeted advertising opt-out and purpose limitation","CA AG enforcement list"],["9 September 2025","CPPA with California, Colorado and Connecticut AGs","Businesses ignoring GPC","Joint investigative sweep","CPPA"],["30 September 2025","CPPA","Tractor Supply Company","$1.35 million; opt-out mechanism including GPC, notices, contracts","CPPA"],["30 October 2025","California Attorney General","Sling TV","$530,000; opt-out of sale in connection with targeted advertising","CA AG enforcement list"],["21 November 2025","California Attorney General","Jam City","$1.4 million; no opt-out of sale in mobile games","CA AG enforcement list"],["3 December 2025","CalPrivacy","ROR Partners LLC","$56,600; sold custom audiences without registering as a data broker","CalPrivacy"],["2025 (reported early 2026)","Connecticut Attorney General","TicketNetwork, Inc.","$85,000; first CTDPA settlement, after a missed cure deadline","CT AG 2025 report"],["11 February 2026","California Attorney General","The Walt Disney Company","$2.75 million; opt-outs not applied across Disney+, Hulu and ESPN+","CA AG enforcement list"],["3 March 2026","CalPrivacy","PlayOn Sports","$1.10 million; tracking and targeted ads on school ticketing without a sufficient opt-out","CalPrivacy"],["5 March 2026","CalPrivacy","Ford Motor Company","$375,703; email verification before opt-out","CalPrivacy"],["8 May 2026","California Attorney General and four district attorneys","General Motors","$12.75 million; sale of driving and location data to data brokers; first data minimisation case","CalPrivacy"]],"sourceUrls":[["https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250121-texas-ag-brings-first-ever-lawsuit-under-a-state-comprehensive-privacy-law"],["https://cppa.ca.gov/announcements/2025/20250312.html"],["https://cppa.ca.gov/announcements/2025/20250416.html"],["https://cppa.ca.gov/announcements/2025/20250506.html"],["https://oag.ca.gov/privacy/privacy-enforcement-actions"],["https://cppa.ca.gov/announcements/2025/20250909.html"],["https://cppa.ca.gov/announcements/2025/20250930.html"],["https://oag.ca.gov/privacy/privacy-enforcement-actions"],["https://oag.ca.gov/privacy/privacy-enforcement-actions"],["https://privacy.ca.gov/2025/12/calprivacy-fines-marketing-firm-for-selling-custom-audiences-without-data-broker-registration/"],["https://portal.ct.gov/-/media/ag/reports/ctdpaenforcementreportcy2025.pdf"],["https://oag.ca.gov/privacy/privacy-enforcement-actions"],["https://privacy.ca.gov/2026/03/youth-sports-media-company-to-pay-1-1-million-fine-change-practices-over-privacy-violations/"],["https://privacy.ca.gov/2026/03/ford-to-change-practices-pay-fine-for-adding-unnecessary-friction-to-opt-out-process/"],["https://privacy.ca.gov/2026/05/when-it-comes-to-data-privacy-consumers-must-be-in-the-drivers-seat-attorney-general-bonta-partners-secure-12-75-million-general-motors-privacy-settlement/"]]}