--- title: "United States — Enforcement & Redress | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/united-states/enforcement-and-redress/ source_html: /jurisdictions/united-states/enforcement-and-redress/index.html description: "United States — Enforcement & Redress: enforcement_and_redress Enforcement & Redress 6 sub-modules 11 claims Amber ▾ # Enforcement capacity and activity are high and rising, but remain distributed across an uncoordinate" generated_at: 2026-10-25T04:46:50Z content_sha256: 52b53aeb30bf7edd3f7b961ceeef17cfe7f8a1267c750edb196828461367c674 generator: "fe-fleet/md-twin@1.0" --- # United States — Enforcement & Redress | Data Protection Monitor ### D10Enforcement & Redress6 sub-modules11 claimsAmber▾# Enforcement capacity and activity are high and rising, but remain distributed across an uncoordinated multi-regulator structure rather than a single empowered supervisory authority. Primary framework FTC Act Section 5; PADFAA; CCPA; Illinois BIPA Supervisory authority [Federal Trade Commission (FTC)](https://www.ftc.gov) Traffic-light rationale — Amber Enforcement capacity and activity are high and rising, but remain distributed across an uncoordinated multi-regulator structure rather than a single empowered supervisory authority. #### Sub-modules (6) #### Regulator Powers And PenaltiesAmber PADFAA authorizes FTC civil penalties of up to $53,088 per violation; CCPA authorizes CalPrivacy and the AG to impose administrative fines and injunctive relief, recently escalating into eight-figure settlements. Claims (2): - PADFAA violations may result in FTC enforcement actions carrying civil penalties of up to $53,088 per violation. - CalPrivacy Deputy Director of Enforcement Michael Macko has publicly stated CCPA fines could become 'a cost of doing business if they're not higher,' signaling an agency push toward higher penalty levels. #### Enforcement Activity IndexAmber 2026 has seen a marked uptick in FTC and state enforcement: Kochava (May 2026), Match/OkCupid (March 2026), PADFAA warning letters to 13 data brokers (February 2026), and multiple CalPrivacy data-broker actions (January 2026). Claims (2): - The FTC sent letters to 13 data brokers in February 2026 warning them of their obligations under PADFAA. - CalPrivacy issued decisions in January 2026 fining Rickenbacher Data LLC (d/b/a Datamasters) $45,000 and S&P Global $62,600 for failing to register as data brokers. #### Regulator Funding And CapacityAmber CalPrivacy has publicly signaled intent to escalate fine levels and has grown its Enforcement Division (Data Broker Enforcement Strike Force); no comparable federal FTC capacity data was identified in this pass. Claims (1): - CalPrivacy has launched a dedicated Data Broker Enforcement Strike Force within its Enforcement Division to pursue data-broker registration and compliance cases. #### Collective Redress And Class ActionsAmber State AGs and CalPrivacy operate a bipartisan multi-state 'Consortium of Privacy Regulators' for coordinated enforcement; BIPA class actions remain the dominant collective-redress vehicle nationally. Claims (2): - CalPrivacy has launched a bipartisan Consortium of Privacy Regulators to collaborate with other states on implementing and enforcing privacy laws nationwide. - Illinois's BIPA, in effect since 2008, prohibits collection of biometric identifiers or information absent specified conditions and includes a private right of action that produced a $650 million Facebook settlement in March 2021. #### Private Right Of ActionAmber BIPA contains a broad private right of action with liquidated damages ($1,000 negligent / $5,000 intentional per violation); CCPA's private right of action is narrower, limited chiefly to data-breach scenarios. Claims (2): - BIPA's private right of action allows an aggrieved person to sue for liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation. - Federal comprehensive-privacy negotiations have referenced a California-style provision letting consumers sue organizations directly when affected by a data breach, reflecting CCPA's existing narrow private right of action for breaches. #### Recent Developments 180DAmber Within the last 180 days (Feb-Jul 2026): FTC began enforcing the TAKE IT DOWN Act (19 May 2026); FTC issued its COPPA age-verification policy statement (25 Feb 2026); FTC settled with Kochava (4 May 2026) and acted against Match/OkCupid (30 Mar 2026); FTC sent PADFAA warning letters to 13 data brokers (9 Feb 2026); CalPrivacy issued Datamasters/S&P Global data-broker fines (Jan 2026); Illinois advanced SB 315 AI-transparency legislation and Connecticut advanced SB 4 data-broker registration (2026 session). Claims (3): - The FTC began enforcing Section 3 of the TAKE IT DOWN Act on 19 May 2026, requiring covered platforms to establish a 48-hour process for removing nonconsensual intimate content upon victim request. - The FTC took action against Match and OkCupid on 30 March 2026 for deceiving users by sharing personal data with a third party. - Connecticut advanced SB 4, a data-broker statute prohibiting brokers from processing state residents' data without annual registration beginning 1 January 2027. Category narrative 92 words US enforcement is multi-layered and increasingly coordinated: the FTC uses Section 5, COPPA, PADFAA, and sectoral rules against national targets (Kochava, Match/OkCupid, data brokers), while CalPrivacy and the California AG have driven the largest state-level penalties to date (GM $12.75M, Disney $2.75M CCPA-record, Tractor Supply $1.35M), operating through a bipartisan multi-state 'Consortium of Privacy Regulators.' BIPA's private right of action remains the single largest source of catastrophic exposure (Facebook $650M; White Castle up to $17B potential). Recent-180-day developments (roughly Feb-Jul 2026) show accelerating enforcement tempo across data-broker, location-data, children's-privacy, and AI-transparency fronts. Periodic update · new data 2026-09-28 #### Enforcement & Redress The FTC maintained an active enforcement cadence this cycle. It took action against Match Group and OkCupid in March 2026, alleging the companies shared users' personal data, including photos and location information, with an unrelated third party contrary to their stated privacy policies, a deceptive-practices theory under Section 5. The FTC and states are also understood to have acted against Hims & Hers for allegedly deceptive and unlawful privacy practices, announced July 29, 2026, indicating continued joint federal-state enforcement coordination on privacy matters. Looking forward, the FTC has proposed a policy statement on personalized pricing indicating it intends to enforce Section 5 aggressively against deceptive or unfair personalized pricing practices, including pricing based on data collected without verified consumer consent. This is a proposed policy statement, not yet finalized, but it signals an emerging enforcement priority area connecting data-collection practices directly to pricing-fairness theories under general consumer-protection authority. #### Outlook The FTC's active enforcement cadence across dating-app privacy practices and joint federal-state actions is likely to continue. The proposed personalized-pricing policy statement is the item most likely to open a new enforcement front if it proceeds toward finalization, connecting data-practices scrutiny to pricing-fairness theory for the first time in this evidence base. Evidence 11 Sources and claims (11) - Probable[FTC](https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-reminds-data-brokers-their-obligations-comply-padfaa) — PADFAA violations may result in FTC enforcement actions carrying civil penalties of up to $53,088 per violation.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/california-authorities-announce-largest-ccpa-fine-to-date) — CalPrivacy Deputy Director of Enforcement Michael Macko has publicly stated CCPA fines could become 'a cost of doing business if they're not higher,' signaling an agency push toward higher penalty levels.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-reminds-data-brokers-their-obligations-comply-padfaa) — The FTC sent letters to 13 data brokers in February 2026 warning them of their obligations under PADFAA.observed 2026-07-29 - Probable[CPPA](https://cppa.ca.gov/announcements/2026/20260108.html) — CalPrivacy issued decisions in January 2026 fining Rickenbacher Data LLC (d/b/a Datamasters) $45,000 and S&P Global $62,600 for failing to register as data brokers.observed 2026-07-29 - Probable[CPPA](https://cppa.ca.gov/announcements/2026/20260108.html) — CalPrivacy has launched a dedicated Data Broker Enforcement Strike Force within its Enforcement Division to pursue data-broker registration and compliance cases.observed 2026-07-29 - Probable[CPPA](https://cppa.ca.gov/announcements/2026/20260108.html) — CalPrivacy has launched a bipartisan Consortium of Privacy Regulators to collaborate with other states on implementing and enforcing privacy laws nationwide.observed 2026-07-29 - Probable[IAPP](https://iapp.org/resources/article/bipa-legislation-introduced-in-2021) — BIPA's private right of action allows an aggrieved person to sue for liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/new-draft-bipartisan-us-federal-privacy-bill-unveiled) — Federal comprehensive-privacy negotiations have referenced a California-style provision letting consumers sue organizations directly when affected by a data breach, reflecting CCPA's existing narrow private right of action for breaches.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/system/files/ftc_gov/pdf/p994811-ftc-oversight-testimony-senate-commerce-committee-2026.pdf) — The FTC began enforcing Section 3 of the TAKE IT DOWN Act on 19 May 2026, requiring covered platforms to establish a 48-hour process for removing nonconsensual intimate content upon victim request.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/system/files/ftc_gov/pdf/p994811-ftc-oversight-testimony-senate-commerce-committee-2026.pdf) — The FTC took action against Match and OkCupid on 30 March 2026 for deceiving users by sharing personal data with a third party.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/notable-ai-privacy-bills-hit-finish-line-in-illinois-connecticut-and-new-york) — Connecticut advanced SB 4, a data-broker statute prohibiting brokers from processing state residents' data without annual registration beginning 1 January 2027.observed 2026-07-29