Privacy, Security & AI
Enforcement Report

We continuously collect and analyze state AG and privacy regulator settlements and classify them by industry, giving organizations a clear, data-driven view of regulators' priorities.

Understanding which sectors are in the crosshairs of regulatory scrutiny is critical for assessing compliance risk and making informed decisions about enforcement response and compliance budgeting.   Our data analysis drills down further into the specific issues regulators are prioritizing by industry and the states that are most active in pursuing them. 

Armed with this intelligence, companies operating in higher-risk industries can develop informed risk-based compliance decisions, strategically plan their operations and product and service offerings,  and navigate regulatory expectations with greater confidence. 

By volume, privacy enforcement has dominated other enforcement categories since 2022, and that trend continued in during the first four months of 2026.  With 23 states now having passed comprehensive consumer privacy laws, state AGs and privacy regulators are now actively reshaping compliance obligations through enforcement across every industry.  The stark reality for all businesses is that privacy regulators are organized, motivated, focused and funded (through large settlements and legislative mandates) for impactful privacy enforcement.  

The picture painted by the data shows a maturing enforcement approach that utilizes a combination of sweeps, investigations and enforcement actions to highlight priorities and drive compliance in the privacy space.  Understands the data and trends is a necessity for companies seeking to deploy risk-based positioning for privacy compliance.  The risk here is more crucial for a multitude of companies seeking to leverage personal information and implement AI-fueled data strategies tied to personal information.

Children's data protection has emerged as a top enforcement priority, with high-profile actions targeting that platforms serving younger audiences face heightened scrutiny and significant legal exposure. At the same time, connected device privacy has emerged as a critical new enforcement vector, illustrating that the regulatory gaze has expanded well beyond traditional app and web ecosystems. Data broker regulation is also taking concrete shape, with meaningful enforcement activity in New York, Alabama, and California establishing the compliance benchmarks that businesses handling consumer data must now meet.  With California's DELETE Act coming online, and new laws like Connecticut's Data Broker Act, we expect to see a material increase in enforcement in this space, including against companies who may not consider themselves traditional data brokers.

Meanwhile, the broadening of consumer rights enforcement - driven by new and revised privacy laws, including Oregon's Global Privacy Control requirements and Alabama's Data Protection Act - means that companies operating across state lines must navigate an increasingly complex and fragmented legal landscape. Taken together, these developments underscore the urgency of proactive privacy compliance strategies and the value of counsel with deep expertise at the intersection of regulatory enforcement and emerging technology.

The era of waiting for a data breach to spark regulatory scrutiny of a company's cybersecurity program is over. For decades, cybersecurity enforcement was a creature of hindsight - state attorneys general descending on companies only after the damage was done. That paradigm is beginning to erode. While regulators still scrutinize data breach response, they increasingly focus on potential security program deficiencies that resulted in a breach.  This is reflected in their investigations, as well as in settlements that include mandates to build appropriate security programs and implement specific controls.  These mandates are accompanied with risk assessment, monitoring and reporting requirements that can span years.  

From a compliance and risk-reduction point of view, companies should re-address "legally defensible" security and ensure the story behind their security program and the choices they made resonates in front of an AG or privacy regulator.  The enforcement focus on the adequacy of an organization's security program (even when a breach has not occurred) is likely to increase.   For example, CCPA regulations require qualifying businesses to complete an annual, independent cybersecurity audit documenting their security program—including any identified gaps or weaknesses. A member of executive management must then certify, under penalty of perjury, that they reviewed and understood the audit, and the business must submit an annual certification of completion to CalPrivacy. The result is a signed, sworn, contemporaneous record that regulators can scrutinize—well before any breach occurs.  These back-end documentation requirements are bound to lead to more information security-related sweeps, investigations and enforcement actions.

The age of AI accountability has arrived, and this time accountability is trying to keep apace. The 57-state coalition targeting a well-known AI company stands as a watershed moment, a thunderclap signal that no AI company - regardless of size, valuation - is beyond the reach of state regulators. Attorneys General across the country are not waiting for the federal government to take the lead. State regulators are wielding traditional civil rights, privacy, and consumer protection statutes as powerful tools. The reach of those tools is remarkable. 

AI regulatory enforcement now cuts across privacy law, antitrust, state licensing regimes, cybersecurity, intellectual property, and national security laws.  A company's use of AI can subject it to the full spectrum of regulatory scrutiny.  

On the legislative front, lawmakers in 45 states have introduced over 1,500 AI-related bills, producing a sprawling, fast-moving patchwork of compliance obligations tailored to healthcare, employment, algorithmic pricing, and child safety. For companies deploying AI in any capacity, the message from state regulators is clear: they are focusing resources on AI enforcement and compliance at a rapidly-increasing cadence (and this is true whether or not AI laws ultimately pass).

Regulatory Intelligence turns regulatory activity from a reactive fire drill into a strategic asset that enables proactive risk assessment and mitigation while enabling organizations to meet their business objectives. By distilling how particular regulators have actually behaved in comparable matters—what they prioritize, how they negotiate, and where they have shown flexibility— companies can approach investigations and supervisory inquiries with a jurisdiction‑specific game plan rather than guesswork. That insight allows businesses to narrow overbroad demands, calibrate a credible negotiation posture using historical metrics, and craft narratives that speak directly to the concerns regulators have already signaled.  

Allowing companies to law the foundation for their strategy in data rather, while leaning on lawyers with deep knowledge and personal relationships with regulators, can materially influence the outcome of an enforcement action or shape a successful compliance campaign.

Just as important, these insights translate into practical, forward‑looking risk reduction. By understanding enforcement patterns and outcomes that are relevant to a company’s privacy, cybersecurity, and AI practices, helps clients understand what regulators care about and they are actually drawing the line—on consent flows, opt‑outs, security controls, breach notification, and automated decision‑making. That gives companies a clear blueprint for where to invest first, how to “pressure‑test” policies and systems before they are under a microscope, and how to build AI governance that anticipates emerging theories of liability.  Most importantly:  in enables our clients' business plans, products and services to succeed while taking on a better-measured and appropriate amount of risk.

In an environment where state enforcement is expanding and expectations are evolving quickly, using the insights derived from the data and our expertise means a company is not simply compliant on paper; it is operationally aligned with what regulators are doing in the real world, strengthening its defenses and reducing regulatory exposure in near real time.

 Understanding the broader regulatory landscape helps a company anticipate when an issue is likely to draw attention from multiple jurisdictions, anticipate multistate activity, and align current defense with global strategic goals aimed at protecting the company from risks lurking around the corner. Regulatory intelligence gives decision-makers a clear, data-backed view of exposure and options.

Regulatory intelligence is also critical to defending against an enforcement action because it closes the information gap between the company and the State AG office by showing how the specific regulators who issued the CID have handled similar issues, industries, and fact patterns in past matters. It informs the initial strategy and response efforts by helping frame what the investigation is really about, guiding triage, and supplying precedent-based arguments to narrow scope, timing, and burden. It also shapes the substantive defense narrative and settlement posture by benchmarking theories of liability, remedies, penalties, and remediation that AGs offices have actually accepted in settlement.

The data we've gathered, organized and aggregated (from hundreds of disparate sources) is largely unavailable in the market.  Its availability is an opportunity:  in house counsel should dive into the data and determine how it can best be deployed to help their companies reduce risk and achieve their business objectives.  The use of AI and data, in conjunction with experienced counsel, provides for new opportunities that weren't available before.

Data privacy, security and AI compliance is complex, ambiguous and a moving target.  Regulator enforcement, litigation and legislative trends all influence and clarify compliance.  Achieving more visibility and insights using AI and data is the nature evolution of risk-based compliance advice.  The key compliance corner takeaway for this edition is to:  determine how detailed AG privacy, security and AI enforcement data can be used to proactively address compliance issues in your organization.

The data we've developed can reduce the guesswork around compliance.  Risk-based advice can be provided based both on a lawyer's experience in the space, but also by the insights tied to AI-fueled data analytics.  This helps company's legal teams craft legal compliance positions (especially in gray zones) while supplying business decision makers with better informed risk assessments.  Data analysis provides stakeholders with greater confidence to pursue business objectives with more certainty as to the risks they are accepting.  

The compliance implications below are drawn directly from patterns in the enforcement data. Each recommendation maps to a specific trend documented in the preceding sections.  Regulatory settlements and injunctive provisions are one of the clearest windows into how enforcement agencies actually interpret and apply the law in practice. State AGs routinely use settlements to spell out what they view as unlawful conduct and what they expect from companies going forward, often in far more detail than statutes or regulations themselves.