State Attorneys General & Privacy: Enforcement Trends, 2020-2024

As Congress remains gridlocked on comprehensive privacy legislation and federal agencies shift their priorities away from strong enforcement, State AGs play a vital role in protecting consumer privacy.

In October 2025, EPIC published State Attorneys General & Privacy: Enforcement Trends, 2020-2024. As part of EPIC’s ongoing work to support State AG privacy enforcement, EPIC created this report to serve as a reference tool for regulators seeking to protect our digital privacy and autonomy from corporate interests. It outlines, for example, where State AGs (including five U.S. territories and D.C.) have focused their enforcement efforts, how they collaborate, and what sources of legal authority they have invoked in their privacy-related cases and settlements.

The report examines State AG enforcement actions across six areas of privacy harms: Unwanted Calls & Texts, Data Breach, Data Privacy, Antitrust, Platform Accountability & Governance, and Algorithms & Automated Systems.

EPIC’s report catalogs over 220 cases and settlements, 35 letters, and 20 public investigations from January 2020 through December 2024 (see database below), providing a detailed look at the breadth and impact of state-level privacy enforcement. The report’s five-year period represents a base understanding of how State AGs used flexible consumer protection authority and federal authority available to them. Equipped with more specific authority in the coming years, State AGs will build on their impressive body of work to combat ongoing consumer privacy harm in the digital age.

EPIC thanks the 56 State and Territorial Attorneys General for their ongoing efforts to protect Americans’ privacy rights. EPIC will continue tracking privacy-related enforcement actions from AGs and is happy to speak with any AGs about this report or privacy enforcement in general. Please feel free to reach out at [email protected].

How to use the database below

The database below is built from the research used to create the State Attorneys General & Privacy: Enforcement Trends, 2020-2024 report; it is sortable by a number of data points, including State AG, Issue Category, and Claims. Provided within the database are links to PDFs of legal documents (e.g. complaints, settlements, letters) where available.

You may need to click “View Larger Version” in the bottom right in order to make use of the full functionality of the database.

You can also view the database here: https://airtable.com/app4cvxMFPTwk9IYt/shrpI3QqsgG7ooqFS

Methodology Note: In the database above, the number of investigations (as well as the number of states participating in some investigations and letters) will be greater than the counts of actions observed in the report, because the report did not count different stages of the same enforcement action as distinct actions. For example, if States A and B both announced they were investigating Company C but only State B subsequently sued the company, the report would count State A as only investigating and State B as only bringing a lawsuit, whereas the database above will note that State B also investigated Company C.