Total privacy penalties across U.S. states hit $3.45 billion in 2025. That figure more than doubled the 2024 total. It exceeded the combined fines from the prior five years. California drove much of the surge. Its regulators moved from writing rules to issuing stiff penalties. Businesses took notice. So did their legal teams.
The Kiplinger report captured the shift. Enforcement actions multiplied. Settlements grew larger. Companies from entertainment giants to auto makers and retailers found themselves in the crosshairs. The message came through clearly. Policies on paper no longer suffice. Technical implementation must match.
Early 2026 brought fresh examples. California Attorney General Rob Bonta announced a $2.75 million settlement with Disney and ABC on February 11. It stands as the largest CCPA settlement to date. The Koley Jessen analysis broke down the violations. Disney’s opt-out tools applied only to specific services or devices. Even logged-in users saw requests limited. Global Privacy Control signals received the same narrow treatment. Data sharing continued despite consumer instructions. The company agreed to pay the penalty without admitting liability. It also committed to sweeping changes and regular compliance reports.
But Disney was not alone. The California Privacy Protection Agency hit Ford Motor Company with a $375,703 fine weeks later. PlayOn Sports, a youth sports media platform, faced a $1.1 million penalty. Combined, these three actions topped $4.2 million. They spotlighted one core issue. Opt-out mechanisms must work without friction. They must cover a consumer’s full relationship with the business.
Ford required email verification before honoring opt-out requests from its website and connected vehicles. Regulators called that unnecessary. CCPA rules prohibit adding such steps. The agency demanded Ford simplify its process. It ordered audits of tracking technologies. PlayOn Sports took a different path to trouble. Its sites forced users to click “agree” on tracking banners. No real opt-out existed. The company redirected consumers to industry self-regulatory groups instead of handling requests directly. Its privacy policy was outdated. It failed to disclose rights accurately. The settlement required quarterly website scans, risk assessments, and clear notices.
These cases built on 2025 momentum. The CPPA issued a $1.35 million fine against Tractor Supply Company in September 2025. That remains the agency’s largest single penalty. The retailer allegedly lacked a compliant privacy policy. It failed to notify job applicants of their rights. Data disclosures to third parties lacked proper contracts. Opt-out requests, including those sent through Global Privacy Control, went unheeded. The order forces Tractor Supply to post compliance metrics publicly for five years and certify its practices annually.
Smaller actions added up. Clothing retailer Todd Snyder paid $345,178. American Honda Motor Company settled for $632,500. Data brokers faced special scrutiny. Several received fines for failing to register under California’s Delete Act. One marketing firm paid penalties for selling custom audiences without proper registration. The agency launched sweeps. It formed the Consortium of Privacy Regulators with nine other states. Coordination across borders makes enforcement more efficient. It raises the odds that violations will be caught.
Gartner tracked the broader trend. Its April 2026 research showed U.S. fines reaching $3.45 billion in 2025. “Regulators are shifting their efforts away from awareness to full scale enforcement,” one analyst told CyberScoop. Nader Heinen, a Gartner data protection analyst, pointed to atrophy in corporate privacy programs. Years passed between law passage and active policing. Companies relaxed. Public concern over artificial intelligence changed the equation. Voters worry about job impacts and automated decisions based on personal data. Legislators responded.
California adjusted its penalty levels for inflation effective January 2025. The CPPA announced the updates in December 2024. Civil penalties now reach $2,663 per violation. Intentional violations or those involving minors under 16 can hit $7,988 each. The revenue threshold defining a covered business rose to $26.625 million. Per-consumer damages in private actions increased too. These tweaks give regulators more leverage. They signal seriousness.
Europe offers contrast and context. GDPR fines totaled about €1.2 billion in 2025. Cumulative penalties since 2018 exceed €7.1 billion, according to the DLA Piper GDPR Fines and Data Breach Survey. Ireland’s Data Protection Commission led with a €530 million penalty against a social media company for unlawful data transfers. Yet U.S. state-level totals outpaced Europe last year. Interstate collaboration and AI anxiety fuel the difference.
Enforcement patterns reveal priorities. Opt-out rights top the list. Global Privacy Control signals must be honored across a consumer’s entire account. No cherry-picking devices or services. Third-party tools do not excuse noncompliance. Businesses remain accountable. Risk assessments for data sharing and selling have become standard demands in settlements. Ongoing monitoring, including regular technology inventories, appears frequently.
Student data drew special attention in the PlayOn Sports case. The platform served ticketholders at California schools. Tracking tools collected information later sold for behavioral advertising. Regulators made clear that youth privacy counts. Similar sensitivity applies to health data outside HIPAA coverage. Mental health details, genetic information, and biometrics trigger heightened protections under California rules.
Companies respond in varied ways. Some update policies quickly. Others overhaul systems. The technical side proves hardest. Many privacy notices promise rights that code fails to deliver. That gap invites scrutiny. Auditors now examine not just documents but how consent flows through websites, apps, and connected devices. Frictionless experiences matter. Extra verification steps invite fines.
Forward momentum seems assured. The CPPA continues hiring technologists. It builds expertise to evaluate complex implementations. DROP, the Delete Request and Opt-out Platform, aims to simplify consumer requests while pressuring data brokers. More interstate pacts are likely. AI-related rules will expand. States update statutes to cover automated decision-making and inference.
Legal observers see a new phase. Initial years focused on guidance. That window closed. Full-scale policing arrived. Organizations that treated privacy as a paperwork exercise now pay the price. Those investing in integrated compliance programs gain advantage. They reduce exposure. They build consumer trust.
The numbers tell part of the story. Billions in fines. Dozens of actions. Yet the real impact lies in changed behavior. Companies scan websites more often. They test opt-out flows rigorously. They map data flows with greater care. California’s lead influences other states. Its model spreads. Privacy expectations rise nationwide.
And the pace accelerates. Regulators share intelligence. They target patterns across industries. Auto companies, media platforms, retailers, apparel brands. No sector feels immune. The era of lax enforcement ended. Accountability now arrives with larger checks and tighter oversight. Businesses ignore the signals at their peril.
WebProNews is an iEntry Publication