Privacy enforcement issues: the mistakes behind the fines and lawsuits

How the issue pages work

Every case in the library is tagged with one or more of 15 issues: the specific thing that went wrong in the site, app or data flow. Each issue page explains the failure, sets out what regulators and courts found, lists the tagged cases newest first and ends with checks you can run on your own systems.

The issues are Inth's labels, not legal categories. One case often carries several, and the same failure can be argued under different laws. For the statutes themselves, see the law pages.

Consent and cookie banners

What happens before, during and after the visitor's choice.

• Consent before collection: Court rulings on recording or tracking that started before consent was asked, and what each held at its stage. See every case.
• Cookies before choice or after refusal: CNIL cases where cookies were placed before consent or read after refusal or withdrawal, with the fines. See every case.
• Unequal choices or identity checks: Cases where refusing or opting out took more steps or more data than agreeing. See every case.
• Notice, consent scope and assent: Why a privacy notice, terms link or partner's consent may not cover what your product does. See every case.
• Children's privacy defaults: The DPC's TikTok decision on public-by-default child accounts and privacy choice design. See every case.

Opt-outs

When a visitor says no and the systems behind the site keep going.

• Ignored opt-out signals: California cases on ignoring Global Privacy Control and opt-outs that did not follow the account. See every case.
• Failed opt-out controls: Cases where opt-out forms, portals or app settings failed to stop tracking or marketing. See every case.
• Opt-outs across devices or services: Cases where an opt-out or objection did not carry across devices, apps or databases. See every case.

What tags and vendors receive

What a pixel, replay script or chat widget actually sends, and to whom.

• Sensitive context in event data: How page URLs, event names and parameters can reveal health, financial or location data to ad platforms. See every case.
• Session replay and chat recording: How courts treat session replay and chat vendors under wiretap laws. See every case.
• IP addresses and device identifiers: How plaintiffs use IP addresses and device identifiers in pen-register and wiretap claims, and which rulings went each way. See every case.
• Identifying video-viewing disclosures: How the VPPA reaches pixels on video pages, with the settlements and Supreme Court case in the library. See every case.

Sharing, transfers and breaches

Where the data went after collection, and what had to be disclosed.

• Undisclosed data exchanges: Cases where customer, health or lead data reached partners the notice did not describe. See every case.
• International data transfers: GDPR decisions on transfers of EU data to the US and China, covering safeguards, remote access and transparency. See every case.
• Breach notices not sent: How the FTC treated unauthorised sharing of health data for ads as a breach needing notice, in the GoodRx case. See every case.

Sources and limits

The sources for each case are on its case page, and each issue page lists the cases it draws on. Read how to use the library.

Source review: 26 October 2026. This page indexes the issue pages in the Enforcement library. Inth assigns the issue labels and writes the checks. An allegation is not a finding, and a settlement does not establish liability. It is not legal advice.