United States
The world's most consequential enforcement jurisdiction
FTC + State AGs (California AG / CPPA) + Sectoral Regulators·FTC / CPPA
Enforcement profile
US enforcement is highly fragmented. The FTC leads on general commercial privacy deception; state AGs enforce state privacy laws (CCPA, VCDPA, CPA etc.); HIPAA enforcement falls to HHS OCR; financial data to CFPB. Class actions under BIPA and state privacy laws create additional substantial liability. The lack of a federal law creates a patchwork that requires multi-jurisdictional compliance.
Notable enforcement decisions
Largest consumer privacy fine in US history: Cambridge Analytica and consent order violations.
Unlawful collection of personal data from children on YouTube without parental consent.
Children's data collection and dark patterns used to trick users into purchases.
Using 2FA phone numbers collected for security to serve targeted advertising.
Active regulations
A colossal neoclassical sculpture on Liberty Island — a global symbol of freedom and the rule of law.
Enforcement data is based on publicly available decisions and may not reflect every action, appeal, reduction, or subsequent court ruling. Fine amounts are shown as reported at the time of the decision. This information is for intelligence purposes and does not constitute legal advice.