Skip to content
Start for free

See which privacy mistakes bring fines and lawsuits, and fix yours first

The Enforcement library holds 169 regulator actions and lawsuits from 2019 to 2026. Each case shows how far it got and links its source. Pick an issue to see the check for your own systems.

Start for free

Free includes a one-page, one-region Website audit preview of your site.

How to read a caseRead a full case: Disney

The newest cases

New Mexico v. Meta: USD 25 billion for telling users they controlled their data

Judgment

Stage: Judgment entered 21 October 2026; injunctive relief reserved pending briefing; Meta says it will appeal

A Santa Fe jury found Facebook made 26 willfully deceptive statements about users' control of their data, third-party app access, its post-Cambridge Analytica app investigation and content moderation. The judge imposed a USD 25 billion civil penalty under the Unfair Practices Act.

USD 25,000,000,000Civil penalty in trial-court judgment; appeal expected; not paid

, US

Also: Breach notices not sent, Notice, consent scope and assent

New Mexico Attorney General (First Judicial District Court, Santa Fe County), New Mexico, US

Findings of Fact, Conclusions of Law and Judgment (opens in a new tab)

Every case

Filter the library

How to read a case

Stage
How far the case got. An allegation is not a finding. A settlement does not establish that the allegations are true. A tentative ruling can change at the hearing.
Title
The party, then Inth’s lesson from the case. The lesson is Inth’s view. It is not the holding of a court or a regulator.
Date
The day of the event that the label names. The case shows that day, not a live docket. Some sources give no event date. Inth then dates the case by the day that Inth reviewed the source. Inth labels these cases “Source reviewed” and lists them last.
Issues
Inth assigns the issue labels and writes the checks. The library is a reference, not legal advice.
Amount

The figure that the source states, in its own currency. Inth does not confirm that anyone paid it. 60 cases record an amount.

Regulatory fines, summed by Inth from each case’s source
EUR 3,653,636,000
in 18 cases
USD 25,026,093,871
in 15 cases
NOK 92,000,000
in 1 case
GBP 28,070,090
in 5 cases
SEK 15,000,000
in 1 case

The totals count civil penalties and administrative fines only. They leave out settlements, refunds, proposals and damages claims. 15 of the 35 US dollar amounts are fines, so the US total is small.

169 cases · 125 US · 33 Europe · 11 UK

  7. Shah v. Politico: a cookie toggle has to switch off every vendor behind it

    Order

    Stage: Motions to dismiss granted in part; Shah's CIPA claims dismissed with prejudice as time-barred; amended complaint filed 16 October 2026

    , US

    Also: Failed opt-out controls

    US District Court, Northern District of California, California, US

    Order on motion to dismiss the first amended complaint (ECF No. 131) (opens in a new tab)

Showing 12 of the 166 older cases