#
Enforcement capacity and activity are high and rising, but remain distributed across an uncoordinated multi-regulator structure rather than a single empowered supervisory authority.
Sub-modules (6)
Regulator Powers And PenaltiesAmber
PADFAA authorizes FTC civil penalties of up to $53,088 per violation; CCPA authorizes CalPrivacy and the AG to impose administrative fines and injunctive relief, recently escalating into eight-figure settlements.
Claims (2):
- PADFAA violations may result in FTC enforcement actions carrying civil penalties of up to $53,088 per violation.
- CalPrivacy Deputy Director of Enforcement Michael Macko has publicly stated CCPA fines could become 'a cost of doing business if they're not higher,' signaling an agency push toward higher penalty levels.
Enforcement Activity IndexAmber
2026 has seen a marked uptick in FTC and state enforcement: Kochava (May 2026), Match/OkCupid (March 2026), PADFAA warning letters to 13 data brokers (February 2026), and multiple CalPrivacy data-broker actions (January 2026).
Claims (2):
- The FTC sent letters to 13 data brokers in February 2026 warning them of their obligations under PADFAA.
- CalPrivacy issued decisions in January 2026 fining Rickenbacher Data LLC (d/b/a Datamasters) $45,000 and S&P Global $62,600 for failing to register as data brokers.
Regulator Funding And CapacityAmber
CalPrivacy has publicly signaled intent to escalate fine levels and has grown its Enforcement Division (Data Broker Enforcement Strike Force); no comparable federal FTC capacity data was identified in this pass.
Claims (1):
- CalPrivacy has launched a dedicated Data Broker Enforcement Strike Force within its Enforcement Division to pursue data-broker registration and compliance cases.
Collective Redress And Class ActionsAmber
State AGs and CalPrivacy operate a bipartisan multi-state 'Consortium of Privacy Regulators' for coordinated enforcement; BIPA class actions remain the dominant collective-redress vehicle nationally.
Claims (2):
- CalPrivacy has launched a bipartisan Consortium of Privacy Regulators to collaborate with other states on implementing and enforcing privacy laws nationwide.
- Illinois's BIPA, in effect since 2008, prohibits collection of biometric identifiers or information absent specified conditions and includes a private right of action that produced a $650 million Facebook settlement in March 2021.
Private Right Of ActionAmber
BIPA contains a broad private right of action with liquidated damages ($1,000 negligent / $5,000 intentional per violation); CCPA's private right of action is narrower, limited chiefly to data-breach scenarios.
Claims (2):
- BIPA's private right of action allows an aggrieved person to sue for liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation.
- Federal comprehensive-privacy negotiations have referenced a California-style provision letting consumers sue organizations directly when affected by a data breach, reflecting CCPA's existing narrow private right of action for breaches.
Recent Developments 180DAmber
Within the last 180 days (Feb-Jul 2026): FTC began enforcing the TAKE IT DOWN Act (19 May 2026); FTC issued its COPPA age-verification policy statement (25 Feb 2026); FTC settled with Kochava (4 May 2026) and acted against Match/OkCupid (30 Mar 2026); FTC sent PADFAA warning letters to 13 data brokers (9 Feb 2026); CalPrivacy issued Datamasters/S&P Global data-broker fines (Jan 2026); Illinois advanced SB 315 AI-transparency legislation and Connecticut advanced SB 4 data-broker registration (2026 session).
Claims (3):
- The FTC began enforcing Section 3 of the TAKE IT DOWN Act on 19 May 2026, requiring covered platforms to establish a 48-hour process for removing nonconsensual intimate content upon victim request.
- The FTC took action against Match and OkCupid on 30 March 2026 for deceiving users by sharing personal data with a third party.
- Connecticut advanced SB 4, a data-broker statute prohibiting brokers from processing state residents' data without annual registration beginning 1 January 2027.
Enforcement & Redress
The FTC maintained an active enforcement cadence this cycle. It took action against Match Group and OkCupid in March 2026, alleging the companies shared users' personal data, including photos and location information, with an unrelated third party contrary to their stated privacy policies, a deceptive-practices theory under Section 5. The FTC and states are also understood to have acted against Hims & Hers for allegedly deceptive and unlawful privacy practices, announced July 29, 2026, indicating continued joint federal-state enforcement coordination on privacy matters.
Looking forward, the FTC has proposed a policy statement on personalized pricing indicating it intends to enforce Section 5 aggressively against deceptive or unfair personalized pricing practices, including pricing based on data collected without verified consumer consent. This is a proposed policy statement, not yet finalized, but it signals an emerging enforcement priority area connecting data-collection practices directly to pricing-fairness theories under general consumer-protection authority.
Outlook
The FTC's active enforcement cadence across dating-app privacy practices and joint federal-state actions is likely to continue. The proposed personalized-pricing policy statement is the item most likely to open a new enforcement front if it proceeds toward finalization, connecting data-practices scrutiny to pricing-fairness theory for the first time in this evidence base.
Sources and claims (11)
- ProbableFTC — PADFAA violations may result in FTC enforcement actions carrying civil penalties of up to $53,088 per violation.observed
- ProbableIAPP — CalPrivacy Deputy Director of Enforcement Michael Macko has publicly stated CCPA fines could become 'a cost of doing business if they're not higher,' signaling an agency push toward higher penalty levels.observed
- ProbableFTC — The FTC sent letters to 13 data brokers in February 2026 warning them of their obligations under PADFAA.observed
- ProbableCPPA — CalPrivacy issued decisions in January 2026 fining Rickenbacher Data LLC (d/b/a Datamasters) $45,000 and S&P Global $62,600 for failing to register as data brokers.observed
- ProbableCPPA — CalPrivacy has launched a dedicated Data Broker Enforcement Strike Force within its Enforcement Division to pursue data-broker registration and compliance cases.observed
- ProbableCPPA — CalPrivacy has launched a bipartisan Consortium of Privacy Regulators to collaborate with other states on implementing and enforcing privacy laws nationwide.observed
- ProbableIAPP — BIPA's private right of action allows an aggrieved person to sue for liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation.observed
- ProbableIAPP — Federal comprehensive-privacy negotiations have referenced a California-style provision letting consumers sue organizations directly when affected by a data breach, reflecting CCPA's existing narrow private right of action for breaches.observed
- ProbableFTC — The FTC began enforcing Section 3 of the TAKE IT DOWN Act on 19 May 2026, requiring covered platforms to establish a 48-hour process for removing nonconsensual intimate content upon victim request.observed
- ProbableFTC — The FTC took action against Match and OkCupid on 30 March 2026 for deceiving users by sharing personal data with a third party.observed
- ProbableIAPP — Connecticut advanced SB 4, a data-broker statute prohibiting brokers from processing state residents' data without annual registration beginning 1 January 2027.observed