State Privacy Enforcement Tracker: Cases and Lessons

Read as one order: honor GPC without forcing additional steps (Sephora, Honda); make opting out as easy as opting in, symmetric clicks, no forced verification for opt-outs (Honda, Todd Snyder); actually test the consent-management platform, a misconfigured banner is a violation, not a defense (Todd Snyder); treat ad-tech data flows about content readers as sales requiring opt-outs (Healthline, with its 'unique risk of embarrassment' theory for health-adjacent articles); process authorized-agent requests without friction (Honda); and paper ad-tech vendors with contract terms (Healthline).

Litigating for structural stakes rather than settling for process fixes: the GM suit attacks covert telematics collection and sale to insurers; Allstate/Arity attacks SDK-based location harvesting across third-party apps; the Meta CUBI settlement ($1.4B) monetized a dormant 2009 biometric statute. Add sweep letters (data-broker registration, TDPSA notices) and a dedicated privacy unit, and Texas functions as the plaintiff's-side complement to California's administrative model. Nine-figure exposure is now a real state-privacy number.

Since early 2025, a bipartisan group including California, Colorado, Connecticut, Oregon, New Jersey, and others coordinates investigations and shares intelligence. Practically: a violation found by one member's sweep reaches the others; parallel cure notices arrive together; and smaller states without dedicated units borrow the big states' targeting. Single-state compliance postures ('we're fine unless California looks') stopped making sense when the looking became collective.

From the public record: (1) broken or asymmetric opt-out mechanisms, including unprocessed GPC signals, the plurality of every sweep; (2) notice failures, missing disclosures, notices contradicting practice, missing required links; (3) ad-tech sales without opt-out or contracts; (4) ignored or late consumer requests; (5) registration failures (data-broker registries, with the CPPA fining per-day); (6) dark patterns in consent and cancellation flows; (7) sensitive-data processing without consent, rising as the newer laws mature. Items 1-3 are externally testable, which is why they lead.

Before: quarterly self-audits of the visible surface (opt-out links resolve, GPC toggles the flag, notices match the tag manager's reality), evidence files for rights handling, and current assessments. On receipt: preserve everything, assign one owner, verify the claims technically before responding (regulators attach their own test results), respond within the window with facts and fixes, not adjectives. The Honda and Todd Snyder orders both cite discrepancies between claimed and observed behavior, the response is tested against your actual website.