The Inth enforcement library is open
Regulator decisions, plaintiff claims and private settlements about tracking, side by side, with sources, procedural stages and checks for your own systems.
Founder
The Inth enforcement library is now open at inth.com/enforcement.
It puts regulator decisions, plaintiff claims and private settlements about website and app tracking side by side. Each record states its procedural stage, links its source and suggests checks for your own systems.
We built it because many of these cases come down to code. A tag that fires before the banner or a page URL that names a video turns up in a decision as a finding, a claim or a settlement fund. You can find the same patterns in your own repository and on your own site.
What’s in the library
As of 20 October 2026, the library lists 123 case records you can search and filter. They cover 25 jurisdictions in 10 countries, from California and the US federal courts to France, the United Kingdom and Germany.
Alongside the case records there are two kinds of guide:
- 15 issue pages. Each groups the cases tagged with one recurring failure, such as cookies before choice or after refusal, ignored opt-out signals or session replay and chat recording.
- 15 law pages. Each explains how a statute or rule is used against tracking, such as CIPA §631, the Video Privacy Protection Act or the GDPR and ePrivacy cookie rules.
The hub and each issue page end with short answers to common questions.
What’s in a case page
Most case pages follow the same structure, so you can compare records quickly:
- The problem: what happened, in two or three sentences.
- Case record: court or regulator, case number, parties, laws, stage and amount.
- What was alleged or what the regulator found, claim by claim, with the result for each.
- Technical issue: the tool or vendor, where it ran, what data it sent, when and how it came to light.
- Timeline, outcome and what it cost.
- Why it matters.
- How Inth catches this: which part of Inth would surface the pattern, and its limits.
- Checks for your own systems: in the repository, in the browser and network and with the people responsible.
- Sources and limits: the documents we relied on and the date we reviewed them.
Where the source does not publish code, we show an illustrative pattern and label it as ours, not the defendant’s. A few shorter regulator records keep to the problem, the record, the checks and the sources.
Three examples
AARP. Members alleged that the Meta Pixel on AARP.org sent Meta their Facebook ID and the title of each video they watched. AARP denied the allegations and agreed to a USD 12.5 million settlement, approved on 20 February 2026.
The settlement also limits the Pixel on video pages whose URL identifies a specific video. The case page shows why: the Pixel’s dl parameter carries the full page URL, so a slug can name the video even without a custom event.
Sky Betting and Gaming. The UK Information Commissioner’s Office found that skybet.com set third-party advertising cookies before visitors could make a choice in the consent tool. This ran from 10 January to 3 March 2023. The ICO issued a reprimand on 2 September 2024, not a fine, and noted the company fixed the issue the day after the ICO raised it.
The lesson is plain: having a banner is not the same as respecting it.
Session replay and chat recording. This issue page groups 18 cases. The outcomes split on the facts. In Mikulsky v. Bloomingdale’s, the Ninth Circuit let an aiding claim about real-time replay proceed at the pleading stage. In Gutierrez v. Converse, it found that evidence of what a chat vendor could do did not show it read the messages.
How to use it on your own product
- Find records like yours. Search by company, behaviour or law, or filter by jurisdiction, issue, outcome, currency and amount type.
- Read the stage before the amount. A tentative ruling, a proposed settlement and a final decision answer different questions.
- Read the technical issue. Note the vendor, the page and the request or parameter that carried the data.
- Run the checks. Start in the repository, then open the site in a clean browser profile and compare what loads before a choice, after Reject and after Accept.
- Follow the pattern. Open the issue page and law page linked from the case to see how other records with the same failure turned out.
Where Inth fits
We build Inth around compliance as code: privacy checks that run where the change happens. Most case pages say which part of Inth would catch the pattern, and what it cannot do.
- Code Audit flags a pull request that adds an advertising tag, ad-cookie write or storage write outside the consent check.
- Website Audit records what loaded before a choice and after Reject, with the page, time, region and consent state.
- The consent banner holds optional tags until the visitor chooses under the EU opt-in policy. Tags without a c15t helper still need gating in your own code.
A browser observation cannot establish what a vendor did with data after it arrived. The case pages say so where it matters.
How to read these records
An allegation is not a finding, and a settlement does not establish liability after trial. Tentative rulings are labelled and may change at the hearing.
We assign the issue labels and write the technical checks. They cannot decide which laws apply or prove compliance, and the library is not legal advice. Each record is a dated summary of its sources, so check the stage and review date before you rely on it.
Start with the library
Browse the enforcement library and open a record that looks like your stack.
Then run a free codebase scan: connect GitHub, choose a repository and get one free report showing the files, lines and vendor signals to inspect first.