# Find privacy failures you can check in your own systems

You can compare 10 cases in one place. Each case links the regulator’s account to technical behaviour and checks for your own systems.

## [Disney](/enforcement/disney)

The California DOJ alleged that opt-outs did not reach all devices and services linked to an account.

California DOJ · California, US · CCPA

Announced: 2026-02-11. Settlement and stipulated judgment

USD 2,750,000 · Civil penalties

Technical failure: Ignored opt-out signals; Opt-outs across devices or services

Source reviewed: 2026-10-16

[California DOJ source](https://oag.ca.gov/news/press-releases/california-wont-let-it-go-attorney-general-bonta-announces-275-million)

## [Sling TV](/enforcement/sling)

The California DOJ alleged that some apps lacked opt-outs. It also challenged cookie choices that did not complete the statutory opt-out.

California DOJ · California, US · CCPA

Announced: 2025-10-30. Settlement and stipulated judgment

USD 530,000 · Civil penalties

Technical failure: Unequal choices or identity checks; Failed opt-out controls

Source reviewed: 2026-10-16

[California DOJ source](https://oag.ca.gov/news/press-releases/attorney-general-bonta-secures-530000-settlement-sling-tv-first-enforcement)

## [SHEIN](/enforcement/shein)

CNIL found that the site placed cookies before consent. It also found cookie reads or writes after refusal or withdrawal.

CNIL · France · French Data Protection Act, Article 82

Announced: 2025-09-03. CNIL sanction announced

EUR 150,000,000 · Administrative fine

Technical failure: Cookies before choice or after refusal

Source reviewed: 2026-10-16

[CNIL source](https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil)

## [Healthline](/enforcement/healthline)

The California DOJ alleged that opt-outs failed. It also alleged that disclosed data could suggest a prior medical diagnosis.

California DOJ · California, US · CCPA

Announced: 2025-07-01. Settlement announced

USD 1,550,000 · Civil penalties

Technical failure: Failed opt-out controls; Sensitive context in event data

Source reviewed: 2026-10-16

[California DOJ source](https://www.oag.ca.gov/news/press-releases/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155)

## [Todd Snyder](/enforcement/todd-snyder)

The CPPA alleged that the privacy portal failed to process opt-out requests for 40 days.

CPPA · California, US · CCPA

Announced: 2025-05-06. Stipulated order announced

USD 345,178 · Administrative fine

Technical failure: Unequal choices or identity checks; Failed opt-out controls

Source reviewed: 2026-10-16

[CPPA source](https://www.cppa.ca.gov/announcements/2025/20250506.html)

## [Honda](/enforcement/honda)

The CPPA challenged unequal choices and unnecessary identity checks in Honda’s privacy process.

CPPA · California, US · CCPA

Announced: 2025-03-12. Stipulated order announced

USD 632,500 · Administrative fine

Technical failure: Unequal choices or identity checks

Source reviewed: 2026-10-16

[CPPA source](https://www.cppa.ca.gov/announcements/2025/20250312.html)

## [DoorDash](/enforcement/doordash)

The California DOJ alleged that DoorDash sent customer data to a marketing cooperative without notice or an opt-out.

California DOJ · California, US · CCPA and CalOPPA

Announced: 2024-02-21. Settlement announced

USD 375,000 · Civil penalty in proposed judgment

Technical failure: Undisclosed data exchanges

Source reviewed: 2026-10-16

[California DOJ source](https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-doordash-investigation-finds-company)

## [GoodRx](/enforcement/goodrx)

The FTC alleged that GoodRx disclosed health data for ads and failed to notify consumers of the breach.

US FTC and DOJ · United States (federal) · FTC Act and Health Breach Notification Rule

Announced: 2023-02-01. Court order entered 17 February 2023

USD 1,500,000 · Civil penalty

Technical failure: Sensitive context in event data; Breach notices not sent

Source reviewed: 2026-10-16

[US DOJ source](https://www.justice.gov/archives/opa/pr/digital-healthcare-platform-ordered-pay-civil-penalties-and-take-corrective-action)

## [Microsoft Bing](/enforcement/microsoft-bing)

CNIL found that refusal took more work than acceptance. The case also concerns a cookie with several purposes.

CNIL · France · French Data Protection Act, Article 82

Published: 2022-12-22. Sanction; specific injunction later satisfied

EUR 60,000,000 · Administrative fine

Technical failure: Unequal choices or identity checks; Cookies before choice or after refusal

Source reviewed: 2026-10-16

[CNIL source](https://www.cnil.fr/sites/default/files/atoms/files/lettre_information_cnil_decembre_2022.html)

## [Sephora](/enforcement/sephora)

The California DOJ alleged that Sephora ignored Global Privacy Control (GPC) opt-outs. It also alleged that Sephora did not disclose sales of personal information.

California DOJ · California, US · CCPA

Announced: 2022-08-24. Settlement announced

USD 1,200,000 · Civil penalties

Technical failure: Ignored opt-out signals

Source reviewed: 2026-10-16

[California DOJ source](https://oag.ca.gov/node/556528)