Lawsuitsby GlyphPrivacy cases
Data protection decisions and fines: GDPR, transfers, children, biometrics.
CalendarAdd to calendar
United States sued v. 
Cerebral (health data for ads)The FTC alleged the telehealth firm shared sensitive health data with third parties for advertising, failed to secure it and made cancellation difficult.$7 millionJury trialS.D. Fla.filed Apr 2024
Irish Data Protection Commission: GoogleThe Irish Data Protection Commission fines Google 403 000 000 EUR following Inquiry into Google’s processing of location dataIrish DPCIsbell sued v. 
SunoRecording artists including Jason Isbell and David Lowery allege Suno's generator reproduces their voices, names and likenesses without consent, pleading BIPA and state right-of-publicity claims.D. Mass.
Dutch DPA fine: Uber, automated driver deactivationThe Dutch DPA, working with the CNIL on a French drivers' complaint, found Uber used fully automated decisions to temporarily or permanently deactivate drivers over suspected fraud or low ratings and did not properly inform them.EUR 824,990,000Dutch Data Protection Authority (Autoriteit Persoonsgegevens)Texas AG acted against v. 
Meta and WhatsApp: encryption claimsTexas sued Meta and WhatsApp alleging they misled users about end-to-end encryption and the privacy of WhatsApp messages.Texas Attorney GeneralFlowers sued v. 
MicrosoftAlleges Microsoft's Copilot and other voice products captured users' biometric voiceprints without BIPA consent.N.D. Ill.Amer sued v. 
ElevenLabsIllinois plaintiffs allege ElevenLabs captured biometric voiceprints from real voices to build its voice AI without BIPA consent.N.D. Ill.
Dutch DPA fine: Yango (MLU B.V.), transfers to RussiaJoint investigation with the Norwegian and Finnish authorities found the company behind the European Yango taxi app transferred driver and customer data to Russia without adequate protection.EUR 100 millionDutch Data Protection Authority (Autoriteit Persoonsgegevens)
FTC: OkCupid and Match, sharing user photos with a third partyThe FTC alleged OkCupid gave a third party unauthorized access to users' personal data, contrary to its privacy promises.US Federal Trade CommissionKogon sued v. GoogleAlleges Google's AI voice features extract biometric voiceprints without BIPA consent, with a companion copyright claim.N.D. Ill.Doe sued v. 
xAI (Grok deepfakes)Proposed class action alleging Grok's image tools created sexualized deepfakes of real people, pleading product liability, public nuisance and right of publicity claims.N.D. Cal.St. Clair sued v. xAIAshley St. Clair alleges xAI's Grok generated nonconsensual sexually explicit images of her, including images depicting her as a minor.S.D. N.Y.FTC: Sendit app (Iconic Hearts), COPPAThe FTC alleged the anonymous messaging app collected children's data without parental consent, sent messages from fake people and tricked users into paid subscriptions.US Federal Trade CommissionFTC: Apitor, robot toy children's dataThe FTC alleged the robot toy maker let a China-based third party collect children's geolocation data through its app without parental consent.US Federal Trade Commission
FTC: Disney, children's data on YouTubeThe FTC alleged Disney mislabeled kid-directed YouTube videos, allowing children's data to be collected for targeted ads without parental consent.$10 millionUS Federal Trade CommissionCNIL fine: Google, Gmail ads and cookiesFollowing a noyb complaint, the CNIL found Google showed ads styled as emails in Gmail's Promotions and Social tabs without consent and placed cookies at Google account creation without valid consent.EUR 325 millionCNIL (Commission nationale de l'informatique et des libertes)Texas AG acted against v. Google: data privacy settlementSettles Texas suits filed in 2022 alleging Google unlawfully tracked and collected users' geolocation, incognito search and biometric data.$1.375 billionTexas Attorney General
DPC fine: TikTok, transfers to ChinaThe Irish regulator fined TikTok over sending European users data to China and failing to be open about it.EUR 530 millionIrish DPCIn re TikTok Minor Privacy LitigationConsolidated class actions alleging TikTok collected personal data from children under 13 without parental consent, following the 2024 DOJ COPPA suit.C.D. Cal.
FTC: Cognosphere (Genshin Impact), loot boxes and COPPAThe FTC alleged the Genshin Impact developer violated COPPA and deceived players about the odds and real cost of loot box prizes.$20 millionUS Federal Trade Commission
FTC: General Motors and OnStar, driving dataThe FTC alleged GM collected and sold precise geolocation and driving behavior data from millions of vehicles, used to set insurance rates, without adequate notice or consent.US Federal Trade Commission
Garante fine: OpenAI, ChatGPTItaly fined OpenAI over training ChatGPT on personal data without a legal basis and weak age checks. The Court of Rome upheld OpenAI appeal in March 2026.EUR 15 millionItalian Data Protection Authority (Garante)
Dutch DPA fine: Netflix, transparencyThe Dutch DPA found Netflix did not give customers clear and sufficient information about what it did with their personal data between 2018 and 2020.EUR 4.75 millionDutch Data Protection Authority (Autoriteit Persoonsgegevens)Pierce sued v. 
PhotobucketUsers allege Photobucket changed its terms to license their stored photos, including biometric data, for AI training without valid consent.D. Colo.
FTC: Gravy Analytics and Venntel, location dataThe FTC alleged the data brokers unlawfully sold location data tracking consumers to sensitive sites such as health facilities and places of worship.US Federal Trade Commission
FTC: Mobilewalla, location dataThe FTC alleged Mobilewalla collected consumer data from real-time ad auctions and sold sensitive location data without verifying consent.US Federal Trade Commission
DPC fine: LinkedIn, behavioral adsLinkedIn used member data for behavioral analysis and targeted ads without a valid legal basis.EUR 310 millionIrish DPC
Dutch DPA fine: Clearview AIThe Dutch DPA found Clearview built an illegal database of billions of face photos, including of Dutch people, and warned that using its services is also prohibited.EUR 30.5 millionDutch Data Protection Authority (Autoriteit Persoonsgegevens)Vacker sued v. ElevenLabsVoice actors, including the voice of Darth Vader in audiobooks, alleged ElevenLabs trained its voice cloning on their audiobook recordings and sold imitations of their voices.D. Del.Dutch DPA fine: Uber, driver data transfers to the USThe Dutch DPA found Uber transferred European drivers' personal data to the US without appropriate transfer safeguards after the Privacy Shield was struck down.EUR 290 millionDutch Data Protection Authority (Autoriteit Persoonsgegevens)United States sued v. 
ByteDance (TikTok, COPPA)DOJ, on referral from the FTC, alleged TikTok and ByteDance knowingly let millions of children under 13 use TikTok, collected their data without parental consent and violated a 2019 COPPA order.C.D. Cal.Texas AG acted against v. Meta: facial recognition settlementFirst case under Texas's Capture or Use of Biometric Identifier Act, over Facebook's facial recognition capture of Texans' biometric data without consent.$1.4 billionTexas Attorney GeneralIn re Consumer Vehicle Driving Data Tracking LitigationConsolidated suits alleging General Motors collected drivers' driving behavior data and sold it through data brokers including LexisNexis and Verisk to insurers.N.D. Ga.Lehrman sued v. 
LovoVoice actors Paul Lehrman and Linnea Sage allege AI voice startup Lovo cloned and sold their voices after hiring them for what they were told were research recordings.S.D. N.Y.
FTC: Avast, browsing data salesThe FTC alleged Avast sold users' web browsing data through its Jumpshot subsidiary after promising its products would protect users from tracking.$16.5 millionUS Federal Trade Commission
FTC: InMarket, location dataThe FTC alleged InMarket used location data from its apps and SDK for ad targeting without informed consent.US Federal Trade CommissionFTC: X-Mode Social, location dataFirst FTC settlement with a data broker over sale of sensitive location data that could track visits to medical clinics, places of worship and shelters.US Federal Trade CommissionFTC sued v. 
Rite Aid (facial recognition)The FTC alleged Rite Aid deployed AI facial recognition in hundreds of stores without reasonable safeguards, falsely flagging customers, disproportionately women and people of color, as shoplifters.E.D. Pa.DPC fine: TikTok, children's dataOwn-volition inquiry into TikTok's processing of child users' data from July to December 2020, including public-by-default settings and the Family Pairing feature.EUR 345 millionIrish DPCDatatilsynet: temporary ban on Meta behavioural adsDatatilsynet found Meta's surveillance-based behavioural advertising on Facebook and Instagram illegal and ordered a temporary ban in Norway.Norwegian Data Protection Authority (Datatilsynet)FTC: 1Health.io (Vitagene), DNA dataThe FTC alleged the genetic testing company left DNA data unprotected, misled consumers about deletion and changed its privacy policy retroactively.US Federal Trade CommissionUnited States sued v. Microsoft (Xbox, COPPA)The FTC alleged Microsoft collected personal information from children who signed up for Xbox Live without notifying parents or getting consent, and kept it improperly.$20 millionW.D. Wash.FTC sued v. 
Ring (employee access to customer videos)The FTC alleged Amazon's Ring let employees and contractors view customers' private videos and failed to stop hackers from taking over cameras.$5.8 millionD.D.C.United States sued v. 
Amazon (Alexa, COPPA)The FTC and DOJ alleged Amazon kept children's Alexa voice recordings and geolocation data indefinitely and undermined parents' deletion requests, violating COPPA.$25 millionW.D. Wash.DPC fine: Meta, EU to US transfersThe largest GDPR fine: Facebook user data sent to the US without adequate protection.EUR 1.2 billionIrish DPCUnited States sued v. Edmodo (children's data)The FTC alleged the ed tech provider collected children's personal information without parental consent, used it for advertising and outsourced COPPA compliance to schools.N.D. Cal.FTC: Premom (Easy Healthcare), health data sharingThe FTC alleged the ovulation tracking app shared users' sensitive health data with third parties including two China-based firms and violated the Health Breach Notification Rule.US Federal Trade Commission
FTC: BetterHelp, sharing mental health dataThe FTC alleged the online counseling service shared consumers' sensitive mental health information with Facebook, Snapchat and others for ad targeting after promising privacy.$7.8 millionUS Federal Trade CommissionUnited States sued v. 
GoodRx (Health Breach Notification Rule)First FTC action under the Health Breach Notification Rule, alleging GoodRx shared users' health information with Facebook, Google and others without notice.$1.5 millionN.D. Cal.DPC fine: Meta, legal basis for ads (Facebook and Instagram)The DPC found Meta could not rely on its terms of service (contract) as the legal basis for personalised advertising on Facebook and Instagram.EUR 390 millionIrish DPCUnited States sued v. 
Epic Games (Fortnite, COPPA)The FTC alleged Fortnite collected children's data without parental consent, enabled voice and text chat by default for kids, and used dark patterns to trigger unwanted purchases.$520 million total ($275 million penalty, $245 million refunds)E.D. N.C.DPC fine: Facebook, data scrapingInquiry opened in April 2021 after a collated dataset of Facebook user data scraped through contact import features appeared online; the DPC found data protection by design failures.EUR 265 millionIrish DPCDPC fine: Instagram, children's dataInquiry into Instagram's processing of child users' data, including business accounts that published teenagers' contact details and public-by-default settings.EUR 405 millionIrish DPCFTC sued v. 
Kochava (location data)The FTC sued data broker Kochava for selling precise geolocation data from hundreds of millions of devices that could reveal visits to reproductive health clinics, places of worship and shelters.D. IdahoKatz-Lacabe sued v. 
Oracle (data broker tracking)Plaintiffs alleged Oracle built detailed dossiers on hundreds of millions of people from online and offline tracking and sold them through its advertising data business.$115 millionN.D. Cal.In re Meta Pixel Healthcare LitigationPatients allege the Meta Pixel on hospital and health provider websites sent their health information to Meta without consent.N.D. Cal.United States sued v. Twitter (account security data for ads)The FTC and DOJ alleged Twitter used phone numbers and email addresses collected for account security to target ads, violating a 2011 FTC order.$150 millionN.D. Cal.Garante fine: Clearview AIThe Garante found Clearview processed biometric and location data of people in Italy without a legal basis for its facial recognition search engine.EUR 20 millionItalian Data Protection Authority (Garante per la protezione dei dati personali)United States sued v. 
OpenX (children's data)The FTC alleged the ad exchange collected personal information from children under 13 on child-directed apps without parental consent and collected geolocation from users who opted out.$2 millionC.D. Cal.
Datatilsynet fine: GrindrAfter a Norwegian Consumer Council complaint, Datatilsynet found Grindr shared user data, including GPS location and the fact of using the app, with ad partners without valid consent.NOK 65 millionNorwegian Data Protection Authority (Datatilsynet)
DPC fine: WhatsApp, transparencyGDPR transparency inquiry, begun in December 2018, into how WhatsApp informed users and non-users about processing and sharing of their data, including with other Facebook companies.EUR 225 millionIrish DPC
FTC: Flo Health, sharing health dataThe FTC alleged the fertility tracking app shared users' sensitive health data with Facebook, Google and other analytics firms despite promising privacy.US Federal Trade CommissionFTC: Everalbum, facial recognitionThe FTC alleged the photo storage app applied facial recognition to users' photos by default and kept photos of users who deactivated accounts.US Federal Trade CommissionIn re Clearview AI Consumer Privacy LitigationMultidistrict class litigation alleging Clearview AI scraped billions of online photos to build a facial recognition database in violation of Illinois BIPA and other state laws.23% equity stake in Clearview AIN.D. Ill.CNIL fine: Amazon Europe Core, cookiesThe CNIL found amazon.fr placed advertising cookies automatically without prior consent or adequate information.EUR 35 millionCNIL (Commission nationale de l'informatique et des libertes)
FTC: Zoom, security claimsThe FTC alleged Zoom misled users about the level of security, including end-to-end encryption claims, and secretly installed software that bypassed a browser safeguard.US Federal Trade CommissionCalhoun sued v. Google (Chrome sync data)Chrome users who chose not to sync their browsers with Google accounts allege Google still collected their browsing data.N.D. Cal.Rodriguez sued v. Google (Web & App Activity)Users alleged Google kept collecting app activity data through Firebase and other tools even after they turned off the Web & App Activity setting.$425.7 millionN.D. Cal.Brown sued v. Google (Chrome Incognito tracking)Users alleged Google collected their browsing data while they used Chrome's Incognito mode and other private browsing modes.N.D. Cal.In re Zoom Video Communications Privacy LitigationUsers alleged Zoom shared their data with Facebook and others, overstated end-to-end encryption and failed to prevent 'Zoombombing'.$85 millionN.D. Cal.OAIC acted against v. Facebook (Cambridge Analytica, Australia)The Australian Information Commissioner sued Facebook in the Federal Court alleging it disclosed data of about 311,127 Australian users to the This Is Your Digital Life app, exposing it to Cambridge Analytica.Office of the Australian Information CommissionerFTC and New York sued v. Google and YouTube (COPPA)The FTC and New York attorney general alleged YouTube collected persistent identifiers from viewers of child-directed channels to serve targeted ads without parental consent.$170 millionD.D.C.Lopez sued v. 
Apple (Siri recordings)Users alleged Siri was unintentionally activated and recorded private conversations that contractors reviewed and that were shared with third parties.$95 millionN.D. Cal.United States sued v. Facebook (FTC $5 billion privacy order)DOJ, on behalf of the FTC, charged Facebook with deceiving users about their ability to control the privacy of their data, including in the Cambridge Analytica episode, in violation of a 2012 consent order.$5 billionD.D.C.FTC: Musical.ly (TikTok), COPPAThe FTC alleged the app, now TikTok, collected personal information from children without parental consent.$5.7 millionUS Federal Trade CommissionIn re Google Location History LitigationUsers alleged Google kept tracking their location through Web & App Activity after they paused Location History.$62 millionN.D. Cal.In re Facebook Consumer Privacy User Profile Litigation (Cambridge Analytica MDL)Consolidated consumer class actions over Facebook's sharing of user data with third parties including Cambridge Analytica.$725 millionN.D. Cal.In re Facebook Biometric Information Privacy LitigationIllinois users alleged Facebook's Tag Suggestions feature collected and stored face geometry without the notice and written consent required by the Illinois Biometric Information Privacy Act.$650 millionN.D. Cal.
Amazon (Alexa, COPPA)The FTC and DOJ alleged Amazon kept children's Alexa voice recordings and geolocation data indefinitely and undermined parents' deletion requests, violating COPPA.$25 millionW.D. Wash.CNIL fine: Amazon Europe Core, cookiesThe CNIL found amazon.fr placed advertising cookies automatically without prior consent or adequate information.EUR 35 millionCNIL (Commission nationale de l'informatique et des libertes)