The FTC's maximum civil penalty for a knowing violation of one of its rules is $53,088 per violation in 2025, and it stays there for 2026, according to the Federal Trade Commission's notice published in the Federal Register on 15 September 2026. The ceiling was $40,000 when it was reset on 1 August 2016. It applies to the rules behind COPPA, CAN-SPAM and the Health Breach Notification Rule.
What is the FTC's maximum penalty per violation in 2026?
It is $53,088 for knowing violations of FTC rules on unfair or deceptive practices (15 U.S.C. 45(m)(1)(A)). The same figure applies to knowing violations of certain cease and desist orders and to violations of final FTC orders. On 15 September 2026 the FTC said that, following Office of Management and Budget guidance, its civil penalty amounts remain unchanged during 2026 and the 2025 levels continue to apply.
| Year | Ceiling per violation | Change from prior year |
|---|---|---|
| 2016 (from 1 August) | $40,000 | One-time catch-up |
| 2023 | $50,120 | 7.7% |
| 2024 | $51,744 | 3.2% |
| 2025 and 2026 | $53,088 | 2.6%, then unchanged |
Source: Federal Trade Commission, civil penalty adjustment notices in the Federal Register, 2016 to 2026.
The statute itself, as printed in the U.S. Code, still reads "not more than $10,000 for each violation." The higher figure comes from the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, which requires agencies to adjust penalties for inflation.
The number you see quoted in FTC cases is the inflation-adjusted figure, and it is a per-violation ceiling, not a typical fine.
How has the ceiling changed since 2016?
It rose from $16,000 to $40,000 in one step on 1 August 2016, then climbed every January until 2025. The 2016 step was a one-time "catch-up" adjustment that Congress capped at 150 percent of the existing amount, and $16,000 plus 150 percent is $40,000. From 2018 to 2025 the ceiling went from $41,484 to $53,088.
Figure 1: FTC maximum civil penalty per violation for knowing rule violations, 2018 to 2025. Source: Federal Trade Commission, Federal Register notices of civil penalty adjustments, 2018 to 2025.
The yearly increases follow the October consumer price index. Most years the multiplier sat near 1.02, but 2022 and 2023 saw 6.2% and 7.7% increases, the two largest on record in this series.
Figure 2: Annual percentage increase in the ceiling, 2018 to 2025, calculated from the adjustment multipliers in each year's notice. Source: Federal Trade Commission, Federal Register notices, 2018 to 2025.
Compared with the $16,000 in force before August 2016, the 2025 ceiling is 3.3 times higher.
Figure 3: Milestones in the FTC's per-violation ceiling. Source: Federal Trade Commission, Federal Register notices of 30 June 2016, 24 January 2017, 11 January 2023, 17 January 2025 and 15 September 2026.
Which privacy rules does the ceiling cover?
Three that matter to site owners. COPPA says a violation of its regulation is treated as a violation of an FTC rule on unfair or deceptive practices (15 U.S.C. 6502(c)). CAN-SPAM says it is enforced as if a violation were such a rule violation (15 U.S.C. 7706(a)). The Health Breach Notification Rule says any violation is treated as a rule violation subject to civil penalties as adjusted for inflation (16 CFR 318.7).
Figure 4: How a rule violation reaches the per-violation ceiling, as set out in 15 U.S.C. 45(m)(1) and the statutes above. A summary of statute text, not legal advice.
The penalty applies only if the business acted with actual knowledge, or knowledge "fairly implied on the basis of objective circumstances," that the act was unfair or deceptive and prohibited by the rule. For how recent children's privacy cases played out, see our COPPA penalty records and COPPA fines and settlements.
The ceiling reaches children's privacy, email marketing and health data breaches through the same statute.
How do other FTC penalty amounts compare?
The same 2025 table lists several other ceilings. Violations of Clayton Act cease and desist orders carry $28,205. Knowing violations of the Fair Credit Reporting Act carry $4,983. Failure to file required reports under the FTC Act carries $698. Premerger filing violations and violations of final FTC orders sit at the same $53,088 as rule violations.
Figure 5: Maximum civil penalties set in the FTC's 2025 adjustment, by type of violation. Source: Federal Trade Commission, Federal Register notice of 17 January 2025, calculation table.
The pair above compares the $10,000 baseline in the statute with the $53,088 in force. The 2016 notice lists that baseline as set in 1975 for rule violations, and 53,088 divided by 10,000 is 5.3.
The ceiling for a knowing rule violation is more than ten times the Fair Credit Reporting Act figure.
How big can a total penalty get?
Per violation is the key phrase. The statute counts each day of a continuing failure to comply as a separate violation, and the unit of violation depends on the rule and the case. As pure arithmetic, 10,000 violations at $53,088 would give a theoretical maximum of $530,880,000. That number is a ceiling, not a forecast. The statute directs a court to consider the degree of culpability, any history of prior conduct, ability to pay, the effect on the ability to continue in business and other matters as justice requires.
Treat the arithmetic as a way to see why the per-violation figure matters, and not as a prediction of what any regulator would seek or a court would award.
The Bottom Line
The FTC can seek up to $53,088 per violation for a knowing violation of its rules, up 32.7% from $40,000 in 2016, and it did not change for 2026. COPPA, CAN-SPAM and the Health Breach Notification Rule all route through that ceiling, and each day of a continuing failure can count again. If you collect data from children, email people, or hold health information, the practical step is to know which rules reach your business and to say clearly in your privacy policy what you collect and why. A policy helps you be transparent, but it does not replace compliance with the underlying rules. This article is general information, not legal advice.
Frequently Asked Questions
What is the FTC's maximum civil penalty per violation in 2026? $53,088 per violation for knowing violations of FTC rules. The FTC announced on 15 September 2026 that, following OMB guidance, its civil penalty amounts stay unchanged during 2026, so the 2025 level of $53,088 still applies.
Does the FTC penalty ceiling apply to COPPA and CAN-SPAM? Yes, through the statutes. COPPA (15 U.S.C. 6502(c)) and CAN-SPAM (15 U.S.C. 7706(a)) both say a violation is treated as a violation of an FTC rule on unfair or deceptive practices, and the FTC's Health Breach Notification Rule says the same, so the $53,088 per-violation ceiling applies to a knowing violation.
How fast has the FTC penalty ceiling risen? From $16,000 before August 2016 to $40,000 on 1 August 2016, then to $53,088 by January 2025. That is 32.7% above the 2016 level and 3.3 times the pre-2016 amount.
Is $53,088 the amount companies actually pay? No. It is a per-violation maximum. The statute tells a court to weigh culpability, prior conduct, ability to pay and the effect on the business, and each day of a continuing failure counts as a separate violation.
Where the Numbers Come From
- Federal Trade Commission: Civil Penalty Inflation Adjustments, Federal Register, 15 September 2026. Civil penalty amounts unchanged during 2026; 2025 levels continue.
- Federal Trade Commission: Adjustments to Civil Penalty Amounts, Federal Register, 17 January 2025. 2025 table: $53,088, $28,205, $4,983, $698 and the 1.02598 multiplier. The 2017 to 2024 notices on govinfo.gov give each earlier year's level and multiplier (FR documents 2017-01125, 2018-00979, 2019-02237, 2020-00314, 2021-00483, 2022-00213, 2023-00382, 2024-00301).
- Federal Trade Commission: Adjustment of Civil Monetary Penalty Amounts, Federal Register, 30 June 2016. The $16,000 to $40,000 catch-up, the 150 percent cap, the $10,000 baseline, effective 1 August 2016.
- Legal Information Institute: 15 U.S.C. 45(m), civil penalties for knowing violations. The knowledge standard, "not more than $10,000 for each violation," the continuing-violation rule and the factors a court weighs.
- Legal Information Institute: 15 U.S.C. 6502 (COPPA enforcement) and 15 U.S.C. 7706 (CAN-SPAM enforcement). Each treats a violation as a violation of an FTC rule. The eCFR: 16 CFR 318.7 does the same for the Health Breach Notification Rule.
Note: All figures verified as of November 2026 against the Federal Register notices and the U.S. Code text. Year-over-year percentages are calculated from each notice's adjustment multiplier and rounded to one decimal.
