2026 State Privacy Law Enforcement: Every Fine, Settlement, and Action So Far

State privacy enforcement has crossed a threshold. In 2025 and early 2026, regulators issued over $1.5 billion in fines and settlements — more than the preceding five years combined. Google's $1.37 billion TDPSA settlement redrew the map. California's CPPA launched its first wave of formal investigations. Texas proved it means business. If you're a compliance officer still treating state privacy laws as theoretical risk, this article is your wake-up call.

Every Major 2025–2026 Enforcement Action

The table below covers all significant privacy enforcement actions across US state laws and major cross-border cases affecting US companies in the 2025–2026 period. Amounts in USD unless otherwise noted. Sources include AG press releases, court filings, and DPC decisions.

Which States Are Most Aggressive in 2026

Not all privacy laws are enforced equally. Some AGs treat privacy enforcement as a priority; others have yet to file a single formal action. Here's where the real risk is concentrated:

What's Driving the 2026 Enforcement Surge

Three structural factors explain why 2025–2026 looks so different from the 2022–2023 period of relative enforcement quiet:

1. Cure periods are expiring

When state privacy laws first took effect, most included a "cure period" — a window where companies could fix violations after receiving notice before facing fines. Those windows are closing. California's AG eliminated its cure period. Connecticut's expired in January 2025. Colorado's expired in July 2025. Virginia's is set to expire in 2026. Without a cure period, regulators can move directly to fines the moment they identify a violation — and they are.

2. AG offices are staffing up

California, Texas, and Connecticut have all added dedicated privacy enforcement staff in 2024–2025. The Texas AG's Consumer Protection Division now has a dedicated privacy unit. The California CPPA has regulatory authority independent of the AG, with a growing enforcement bureau. This isn't just political theater — these offices are actively investigating, issuing subpoenas, and negotiating settlements.

3. The federal vacuum is fueling state action

Congress has repeatedly failed to pass a comprehensive federal privacy law (APRA, the American Privacy Rights Act, stalled in 2024). With no federal floor, states are filling the gap aggressively — and competing to be seen as the toughest enforcers. For companies, this means 50+ potentially different compliance regimes, each with its own enforcement posture.

4. Dark patterns are now an explicit enforcement target

The Honda settlement was notable not just for the dollar amount, but for what it targeted: dark patterns in the opt-out flow. Making privacy rights requests unnecessarily difficult — excessive verification steps, confusing UI, buried opt-out links — is now a documented enforcement trigger. The FTC has also issued guidance making dark patterns an explicit violation.

What Compliance Officers Should Audit Right Now

Based on the enforcement actions above, here's the specific audit checklist that maps to documented violation patterns. This isn't theoretical — every item on this list corresponds to something that has triggered a real fine.

The Billion-Dollar Lesson from Google and Texas

Google's $1.37 billion TDPSA settlement deserves special attention because of what it signals to every company processing data on Texas residents. The violations weren't exotic or technical — they were:

• Geolocation tracking without explicit disclosure and opt-out
• Biometric data collection (facial recognition in Google Photos) without specific consent
• Retaining location history after users had deleted it from their accounts
• Absence of an adequate opt-out mechanism for the sale of personal data

These are the same core patterns that appear across almost every enforcement action in the table above. They're not edge cases — they're the baseline compliance floor that regulators are now actively checking. And the dollar amounts suggest that scale matters: the more users you have in a state, the higher the potential exposure.

What Comes Next in 2026

Several developments are worth tracking in the second half of 2026:

The CPPA rulemaking cycle

California's Privacy Protection Agency is finalizing rules on automated decision-making and risk assessments. These rules, expected in mid-2026, will impose new obligations on any company using AI, recommendation systems, or personalization — which is nearly every SaaS product. The CPPA has made clear that enforcement of these rules will begin immediately upon finalization.

Multi-state coordinated investigations

California, Connecticut, Colorado, and Oregon signed a joint enforcement cooperation agreement in late 2025. Expect the first joint action — targeting a company across all four jurisdictions simultaneously — in 2026. This would be a landmark moment: one violation, four AG offices, stacked penalties.

Data minimization enforcement

The next frontier after opt-out enforcement is data minimization — the requirement that companies only collect personal data that's necessary for their stated purpose. Multiple AGs have indicated that 2026 enforcement will increasingly focus on "over-collection" cases, where companies gather data with no disclosed legitimate use.

The biometric surge

Illinois's Biometric Information Privacy Act (BIPA) continues to produce class action litigation — over 1,000 active cases as of Q1 2026. Texas and Washington have their own biometric laws. Google's TDPSA settlement was substantially driven by biometric data claims. If your product touches faces, fingerprints, voiceprints, or retina scans in any way, biometric compliance is no longer optional.

How to Keep Up

The privacy enforcement landscape is moving faster than any compliance calendar can track manually. New AG actions are filed weekly. Multi-state coalitions are forming. New state laws are taking effect every quarter. By the time a violation is documented in a press release, the investigation has typically been running for 12–18 months.

The compliance officers who are getting ahead of this are doing three things: running regular technical audits of their websites (not just policy reviews), maintaining living inventories of their third-party data processors, and treating opt-out and consent infrastructure as product features — not afterthoughts.

If you haven't run a systematic technical audit of your site's compliance posture against all applicable state privacy laws, that's the starting point. Every enforcement action in the table above began with something regulators found on a public website.