USA Trends and Developments Contributed by: Paul Lanois, Fieldfisher
Privacy Enforcement Actions California remained one of the most active US privacy enforcers in 2025, and two recent actions underscore why global organisations should pay close attention. In July 2025, the California Attorney General announced what was, at the time, the largest CCPA enforcement action to date: a USD1.55 million set - tlement with website publisher Healthline, resolving allegations that its use of online tracking technology on its health information website violated the Califor- nia Consumer Privacy Act (CCPA). According to the Attorney General, an investigation by the California Department of Justice found that the company failed to allow consumers to opt out of targeted advertising and shared data with third parties without CCPA-man - dated privacy protections, including data suggesting that a person may have a serious health condition. The settlement also prohibits the company from shar - ing article titles that reveal that a consumer may have already been diagnosed with a medical condition, effectively banning the company from engaging in these types of data transmissions. As of the date of this article, the largest CCPA enforce - ment action was announced in February 2026 against the Walt Disney Company, whereby the company was required to pay USD2.75 million and implement opt- out methods that fully stop the company’s sale or sharing of consumers’ personal information and fully giving effect to requests for opt-out of the sale or shar - ing of data across all devices and streaming services associated with such consumers’ accounts. In March 2025, the California Privacy Protection Agen - cy (CPPA) announced its decision against American Honda Motor Co., imposing a USD632,500 penalty for failing to honour opt‑out preference signals and for allegedly creating unnecessary friction in the con - sumer request process. As part of the settlement, the company was required to certify its compliance, train its employees, and consult a user experience (UX) designer to evaluate its methods for submitting privacy requests. The company was also required to change its contracting process to ensure appropriate mechanisms are in place to protect personal informa - tion.
In September 2025, the CPPA announced its decision requiring Tractor Supply Company, the nation’s largest rural lifestyle retailer, to change its business practices and pay a USD1.35 million fine after the CPPA deter - mined that its privacy notices were insufficient and its opt‑out mechanisms ineffective. Notably, this is the first enforcement action involving employment-related data, which is protected under the CCPA (unlike most other state privacy laws), highlighting the importance of privacy notices and privacy rights of job applicants under the CPPA. California is not the only state that has been active in enforcing privacy laws. In fact, Texas secured a USD1.4 billion settlement (which is one of the largest data privacy-related settlements reached by a single US state) in connection with alleged violations of the Texas Deceptive Trade Practices Act (DTPA) and the Texas’ Capture or Use of Biometric Identifier (CUBI) Act. But Texas did not stop there. In December 2024, the Texas Attorney General (which, in a press release, described Texas as leading the nation in privacy enforcement) brought suits against 14 organisations for alleged violations of the Texas Data Privacy and Security Act (TDPSA) and the Texas Securing Children Online Through Parental Involve - ment (SCOPE) Act, among other laws. In January 2025, Texas filed the first-ever privacy lawsuit under a state comprehensive privacy law: the lawsuit alleged that a car insurance company developed a software development kit (SDK) which could collect a user’s geolocation and movement data. More recently, the Texas Attorney General announced in December 2025 that it has initiated lawsuits against Sony, Samsung, LG, as well as Hisense and TCL for allegedly collecting personal data unlawfully through Automated Content Recognition (ACR) technology included in Smart TVs. Cybersecurity Remains a Priority for Regulators In November 2025, amendments to New York Depart - ment of Financial Services (NYDFS) Part 500 took effect with enhanced requirements for data security for nearly all covered financial services entities, includ - ing multifactor authentication (MFA), asset inventory and data retention.
563 CHAMBERS.COM
Powered by FlippingBook