15 enforcement actions brought under state consumer data privacy laws, tracked as they are announced. Data broker and AI law enforcement are not yet included. Last reviewed August 2026.
State
Date
Fine
Status
California
Aug 11, 2026
$116,490
Settled
California Privacy Protection Agency — Data Broker
Required verification for right to opt out of sale/sharing
Violated CCPA's data minimization provision by requiring consumers to provide more information than necessary to submit opt-out request
Impropery selling consumers’ personal information to third parties without disclosing such sales or offering consumers the ability to opt out of such sales
Improperly using and disclosing consumers’ sensitive personal information without offering the required notices or offering consumers the ability to limit such uses or disclosures
Impropery using, retaining, and/or sharing consumers' personal information in a manner that was not reasonably necessary or proportionate to achieve the purposes for which the personal information was collected or processed or for another disclosed purpose that is compatible with the context in which the personal information was collected
California Attorney General — Entertainment Company
Improperly selling and sharing consumers' personal information to third parties despite receiving direction from consumers not to sell or share their data
Failing to treat opt-out preference signal as a valid request to opt-out of sale sharing for known consumers
Failing to provide methods for submitting requests to opt-out of sale/sharing that are easy for consumers to execute and require minimal steps
Failing to provide an easy-to-use method for submitting requests to opt-out of sale/sharing reflecting the manner in which the business primarily interacts with its customers, on app-based devices
California Attorney General — Streaming Services Provider
Failed to provide easy to read and understandable disclosures to consumers, including by using confusing or deceptive elements and adding additional steps and unnecessary burden or friction by combining CCPA opt out with cookie choices in confusing manner
Failed to provide methods for submitting requests to opt-out of sale/sharing that are easy for consumers to execute and require minimal steps
Required logged-in consumers submitting opt-out request to provide more information than necessary
Failed to provide easy-to-use method for submitting opt-out requests in manner in which business primarily interacts with its customers on app-based devices
Sold/shared personal information of consumers with actual knowledge that consumers were less than 16 years of age without obtaining consent
Connecticut Attorney General — Online Ticketing Marketplace
Failed to maintain clear privacy policy that notified consumers of their rights. Privacy policy was largely unreadable, missing key data rights, and contained rights mechanisms that were misconfigured or inoperable.
California Attorney General — Health Website Publisher
Failed to opt consumers out of selling/sharing
Used 'consent banner' that did not disable tracking cookies, despite purporting to do so
Failed to maintain CCPA-required contracts
Violated purpose limitation principle (processing personal information in manner that was not reasonably necessary or proportionate to achieve purposes for which personal information was collected)
California Privacy Protection Agency — Clothing Retailer
Improperly configured consent management platform (banner disappeared immediately), resulting in failure to process requests to opt out of sale/sharing for 40 days
Improperly required verification for opt outs and right to limit
Required more information than necessary to process privacy requests
This page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.
STAUSS
PRIVACY · AI · CYBER
Get analysis of new state privacy, AI, and cyber laws as they’re enacted, straight to your inbox.
