EPIC’s Insights from a Five-Year Retrospective on State Attorneys General Privacy Enforcement and Tools for the Work Ahead

Earlier this month, EPIC published an initial report on State Attorneys General (AG) enforcement actions taken in response to corporate privacy harms. This is part of EPIC’s broader and ongoing effort to strengthen State AG privacy enforcement, especially as new state privacy laws come into effect.

The report covered a five-year span from January 2020 through December 2024 and included within its scope complaints and settlements, as well as letters and investigations. After reviewing the hundreds of enforcement actions that occurred within this time period, the report co-authors developed a taxonomy of six types of privacy harms:

• Unwanted Calls & Texts;
• Data Breach;
• Antitrust;
• Data Privacy;
• Platform Accountability & Governance; and
• Algorithms & Automated Systems.

The report outlines interesting trends within the data—for example, what types of enforcement actions tended to be brought as large multistate efforts, or which invoked specific federal statutes as compared with more flexible state consumer protection law claims. These trends suggest how changes in policy may impact enforcement realities. EPIC intends to publish supplemental analysis following up on this initial report—for example, a deeper dive into how State AGs explicitly or implicitly invoked their unfairness authority to curtail these privacy harms. We welcome collaboration on this project, as well as additional perspectives on our dataset, taxonomy, and methodology. Consumer privacy is necessarily a team effort, especially in the wake of an increasingly derelict federal regime.

Beyond the valuable analysis provided within the report, the compilation of five years of data on State AG privacy enforcement actions is a meaningful contribution on its own, in service of those ready to make progress in protecting our privacy and autonomy from powerful corporate interests. The report extensively documents its methodology and includes multiple appendices containing and further explaining the data it was built upon. Additionally, the report co-authors have separately provided a publicly accessible and sortable database of the enforcement actions included in the report, including PDF files of legal documents where available (preview below). We anticipate that the dataset and report will serve as a useful reference library for State AGs and consumer advocates, as well as law students curious about what consumer privacy regulatory enforcement actually looks like in practice.

You can also view the database here: https://airtable.com/app4cvxMFPTwk9IYt/shrpI3QqsgG7ooqFS

It is our goal that the report and accompanying data will help inform not only future enforcement but also current policymaking, as the historical data may shed light on what seems to have worked most effectively. We are optimistic that the new state privacy laws coming into effect will alleviate some of the resource-intensive work involved in fitting state consumer protection laws to privacy violations. As EPIC Director of Litigation John Davisson notes in the report’s Executive Summary: “[M]ore explicit rules of the road will benefit businesses as well; while more cynical and powerful companies seem to resist any form of regulation, many businesses want to maintain trust with consumers without being left at a disadvantage because their competitors continue to flout the law with impunity.”

Please free to reach out to the report co-authors by emailing: [email protected].