State attorneys general are on pace for roughly 130 privacy, cybersecurity, and AI enforcement actions in 2026, according to Troutman Pepper Locke's Privacy, Security + AI Enforcement Report, which tracked 43 such activities in just the first four months of the year. That would be more than quadruple the 31 actions recorded in 2022, confirming that state AGs, not federal regulators, have become the primary force setting the practical boundaries of U.S. privacy law.
The activity is not evenly spread. A handful of states file most of the actions, a small number of mega-settlements produce nearly all the settlement dollars, and the underlying legal theories are shifting fast, from data-broker registration sweeps to driving-data lawsuits to a new wave of AI enforcement. Below is what the two most detailed trackers of this activity show: which states lead, what the biggest settlements actually paid, and how 2026 compares to the years before it.
How many state AG privacy enforcement actions happened in 2026?
Troutman Pepper Locke's inaugural enforcement report, covering activity from 2020 through April 2026, counted 307 total tracked enforcement activities, including regulatory investigations, lawsuits, settlements, coordinated multi-state sweeps, and formal enforcement priority announcements. Of those, 43 were filed or announced in the first four months of 2026 alone, a pace that projects to roughly 130 for the full year if it holds.
That would continue a run of consistent, steep growth: total tracked actions rose from 31 in 2022 to 65 in 2024 to 99 in 2025, a 52% year-over-year jump. Privacy-specific actions grew even faster than the overall total, climbing from 41 in 2024 to 65 in 2025, a 59% increase, while AI enforcement actions grew from just 9 in 2024 to 14 in 2025 and had already reached 12 through April 2026, on pace to nearly triple 2025's total.
| Year | Tracked enforcement actions | Year-over-year change |
|---|---|---|
| 2022 | 31 | N/A |
| 2024 | 65 | N/A |
| 2025 | 99 | +52% |
| 2026 (projected) | 130 | +31% |
Figure 1: Total state AG privacy, security, and AI enforcement activities tracked by year, 2022 to a projected 2026. Source: Troutman Pepper Locke Privacy, Security + AI Enforcement Report, January to April 2026 edition.
The Future of Privacy Forum's separate February 2026 retrospective on 2025 enforcement found a parallel trend specific to comprehensive state privacy laws: only three public enforcement actions had been brought under those laws combined between their effective dates and the end of 2024, despite most having been in force for months or years. In 2025 alone, that number jumped to 15 new public enforcement actions, filed, announced, or settled, as California and Texas led the charge and Utah, Florida, and Connecticut each announced first lawsuits or settlements under their own comprehensive privacy statutes.
Which states bring the most privacy enforcement actions?
California has initiated more privacy, cybersecurity, and AI enforcement activity than any other state since 2020, with 32 tracked actions as lead state, per Troutman Pepper Locke's ranking. New York (26) and North Carolina (24) round out the top three, followed by Texas (19) and a cluster of states tied around a dozen actions each.
| State | Tracked actions (2020 to April 2026) |
|---|---|
| California | 32 |
| New York | 26 |
| North Carolina | 24 |
| Texas | 19 |
| Connecticut | 11 |
| Oregon | 11 |
| West Virginia | 11 |
Figure 2: The seven most active state AG offices by number of tracked enforcement activities initiated as lead state, 2020 through April 2026. Source: Troutman Pepper Locke Privacy, Security + AI Enforcement Report.
Volume and dollar value do not track each other. California brings the most actions by count, largely through the California Department of Justice and the California Privacy Protection Agency (CalPrivacy) working the CCPA in parallel, but Texas holds the two largest settlements ever obtained, discussed below. Every state comprehensive privacy law now enacted, 19 as of the Future of Privacy Forum's count published in February 2026, is in effect as of January 2026, and our full state-by-state privacy law tracker covers what each one requires and when it took effect.
Nine states plus CalPrivacy, California, Colorado, Connecticut, Delaware, Indiana, New Hampshire, New Jersey, Minnesota, and Oregon, formed a bipartisan "Consortium of Privacy Regulators" in 2025 to share investigative resources and coordinate multi-state enforcement, a structural signal that cross-border privacy investigations will keep growing regardless of any single state's caseload.
What is the biggest state AG privacy settlement ever?
Texas's Attorney General holds both of the two largest state privacy settlements on record. On July 30, 2024, Texas announced a $1.4 billion settlement with Meta over the company's unauthorized capture of Texans' facial biometric data under the state's Capture or Use of Biometric Identifier Act (CUBI), to be paid over five years. It was the first lawsuit and first settlement obtained under CUBI since the law passed in 2009, and it remains the largest privacy settlement ever obtained by a single state.
Less than a year later, on May 9, 2025, Texas topped its own record with a $1.375 billion settlement with Google, resolving three separate 2022 lawsuits alleging unlawful collection of Texans' location data, biometric identifiers, and browsing activity captured through Google's Incognito mode. That figure exceeded the $391 million a 40-state coalition had previously obtained from Google for similar conduct by nearly a billion dollars.
| Company | State | Year | Settlement amount |
|---|---|---|---|
| Meta | Texas | 2024 | $1.4 billion |
| Texas | 2025 | $1.375 billion | |
| Roblox | Alabama | 2026 | $12.2 million |
| General Motors | California | 2026 | $12.75 million |
Figure 3: The four largest named state AG privacy or child-safety settlements from 2024 through mid-2026, in millions of dollars. Note the scale gap between the two billion-dollar Texas settlements and every other case on record. Sources: Texas Attorney General press releases (2024, 2025); Alabama Attorney General press release (April 2026).
Both Texas settlements dwarf every other privacy case brought by any state. The next tier down still runs into eight figures: Alabama's Attorney General announced a $12.2 million settlement with Roblox on April 21, 2026, requiring facial-recognition or government-ID age verification before minors can access chat features, after alleging the platform's design exposed children to contact from unknown adults. Generate a privacy policy that reflects your actual data-sharing practices before a regulator's sweep finds the gap between your policy text and your product, since a mismatch between stated and actual practices is the specific allegation behind several of the largest cases on this list, including both Texas settlements and California's record GM settlement below.
How much are companies actually paying to settle state AG privacy cases?
Total settlement dollars across all tracked state AG privacy, security, and AI actions reached $5.52 billion since 2020, but that headline number is almost entirely driven by outliers. Just 12 settlements of $40 million or more account for 96% of the total, $5.32 billion, while the other 51 resolved actions produced a combined $195.8 million, a baseline that is a far more realistic planning number for most companies than the billion-dollar cases suggest.
The gap between average and median settlement size makes the skew explicit. Across all 63 resolved actions, the average settlement is $87.5 million but the median is just $1.2 million, a 73-times gap driven entirely by the dozen outlier cases. Excluding those outliers, the average drops to $3.8 million and the median to $530,000.
| Metric | All settlements (n=63) | Excluding 12 outliers (n=51) |
|---|---|---|
| Total | $5.52 billion | $195.8 million |
| Average | $87.5 million | $3.8 million |
| Median | $1.2 million | $530,000 |
Figure 4: Share of total tracked settlement dollars produced by the 12 largest cases versus every other resolved action, in millions of dollars. Source: Troutman Pepper Locke Privacy, Security + AI Enforcement Report, settlement analysis section.
Only 63 of 259 tracked investigations and actions, 24.3%, resulted in a monetary settlement at all; the remaining 76% closed with no payment, typically through injunctive relief, a consent order, or a cure notice that resolved the underlying complaint without a fine. That matters for compliance planning: most state AG privacy matters end without money changing hands, and among those that do, a five- or six-figure settlement is far more typical than a headline-grabbing one.
What state privacy laws are AGs actually enforcing?
Every enacted state comprehensive privacy law was in effect as of January 2026, and 2025 was the year enforcement under those laws actually began at scale. California and Texas led, and four more states brought their first-ever comprehensive-privacy-law action during the year, per the Future of Privacy Forum's February 2026 retrospective.
Figure 5: States that brought their first public enforcement action under a comprehensive state privacy law, by year. Source: Future of Privacy Forum, "U.S. Privacy Enforcement in 2025," February 2026.
California's own enforcement more than doubled year over year: the California DOJ and CalPrivacy jointly reached six CCPA settlements in 2025, exactly double the combined total from 2022 through 2024. Notable 2025 cases included a $1.55 million DOJ settlement with publisher Healthline Media over failure to honor do-not-sell opt-outs, and a $632,500 CalPrivacy settlement with Honda over asymmetrical, hard-to-use opt-out mechanisms. CalPrivacy separately reached four settlements under the state's Delete Act, targeting businesses that failed to register as data brokers, and opened 2026 with two more data-broker non-registration settlements in January. Readers tracking how each state's law differs on registration, cure periods, and private rights can cross-reference our federal privacy bill tracker for how Congress's stalled comprehensive proposals compare to the state patchwork AGs are actually enforcing today.
California then opened 2026 with its largest CCPA settlement to date: a $12.75 million agreement with General Motors, announced May 8, 2026, over GM's sale of OnStar customers' precise location and driving-behavior data, including hard-braking and seat-belt-usage signals, to data brokers Verisk Analytics and LexisNexis Risk Solutions between 2020 and 2024. Regulators alleged GM's privacy policy said it would not sell that data for insurance purposes while its actual opt-out mechanism had no real effect on the broker pipeline. The GM settlement was nearly five times the previous record, a $2.75 million settlement with Disney and ABC announced February 11, 2026 over similar cross-device opt-out failures, itself the second public settlement to come out of a 2024 investigative sweep of streaming services.
What is driving the increase in state AG privacy enforcement?
Three forces explain most of the growth: driving and location data, children's online safety, and now artificial intelligence. Regulators expanded their location-data enforcement strategy in 2025 beyond third-party data brokers to first-party collectors, most visibly automakers and insurers. Texas sued General Motors in late 2024 and Allstate and its data-broker subsidiary Arity in January 2025 over driving-data collection and sale; Arkansas, Indiana, and Nebraska each filed similar suits against GM shortly after, and California opened its own investigative sweep of the location-data industry in March 2025.
Children's online safety has become the single largest enforcement category by volume: 78 of the 307 total tracked actions concern children's or minors' data specifically, more than any other subject-matter tag, per Troutman Pepper Locke's category breakdown. Florida, Kentucky, Minnesota, Texas, and Utah all filed lawsuits in 2025 targeting social media and gaming platforms' online-safety practices, frequently relying on general consumer protection authority rather than a state's comprehensive privacy law, since UDAP claims face fewer of the constitutional challenges that have slowed dedicated online-safety statutes.
Figure 6: The typical path from a state AG privacy investigation to its outcome, based on Troutman Pepper Locke's finding that 76% of investigations and actions close without payment. Source: Troutman Pepper Locke Privacy, Security + AI Enforcement Report, settlement analysis section.
AI enforcement is the newest and fastest-growing category. AI-related actions grew from 9 in 2024 to 14 in 2025, a 56% increase, and had already reached 12 through April 2026, on pace to nearly triple 2025's full-year total. Multistate coordination is accelerating in parallel with the growth in AI cases: actions involving five or more state AGs acting together grew from 3 in 2020 to 31 in 2025, a tenfold increase, and now account for roughly a quarter of all tracked activity.
The Bottom Line
The headline growth number, roughly 130 projected state AG privacy, security, and AI actions for 2026 against 31 in 2022, is real, and so is the shift in where enforcement is concentrated: driving and location data, children's online safety, and a fast-growing AI docket. But the dollar figures that make headlines, Texas's two billion-dollar-plus settlements chief among them, are not what a typical company should plan around. With 76% of investigations closing without payment and a $530,000 median among the settlements that do involve money, the practical exposure for most businesses looks nothing like the outlier cases. What the data does confirm is that state AGs are checking the gap between what a privacy policy says and what a data pipeline actually does, the exact allegation behind the GM, Disney, Meta, and Google cases alike, which is the specific failure mode a current, accurate privacy policy and a working opt-out mechanism are built to close.
Frequently Asked Questions
How many state AG privacy enforcement actions happened in 2026? State attorneys general filed or announced 43 privacy, cybersecurity, and AI enforcement activities between January and April 2026, putting the year on pace for roughly 130 total actions, according to Troutman Pepper Locke's Privacy, Security + AI Enforcement Report. That would be more than quadruple the 31 actions recorded in 2022.
Which state brings the most privacy enforcement actions? California has led every state with 32 tracked enforcement actions as lead state since 2020, ahead of New York's 26, North Carolina's 24, and Texas's 19, per Troutman Pepper Locke's tracker. Texas, however, holds the two largest dollar settlements on record: $1.4 billion from Meta in 2024 and $1.375 billion from Google in 2025.
What is the biggest state AG privacy settlement ever? The largest is Texas's $1.4 billion settlement with Meta, announced July 30, 2024, over unauthorized capture of Texans' facial biometric data under the state's Capture or Use of Biometric Identifier Act. It remains the largest privacy settlement ever obtained by a single state, ahead of Texas's own $1.375 billion Google settlement announced in May 2025.
How much do state AGs typically collect in a privacy settlement? Far less than the billion-dollar headlines suggest. Excluding 12 outlier settlements of $40 million or more, the median state AG privacy, security, and AI settlement is just $530,000, per Troutman Pepper Locke's analysis of 63 resolved actions. Those 12 outliers account for 96% of the $5.52 billion in total settlement dollars tracked since 2020.
Where the Numbers Come From
- Troutman Pepper Locke. "Privacy, Security + AI Enforcement Report." Inaugural bi-monthly edition, covering January through April 2026, 307 total tracked actions since 2020, published June 2026.
- Future of Privacy Forum. "U.S. Privacy Enforcement in 2025." U.S. Legislation and Regulation Retrospective, published February 2026.
- Texas Attorney General. "Attorney General Ken Paxton Secures $1.4 Billion Settlement with Meta." Press release, July 30, 2024.
- Texas Attorney General. "Attorney General Ken Paxton Secures Historic $1.375 Billion Settlement with Google." Press release, May 9, 2025.
- Finnegan. "California Reaches Record $12.75 Million CCPA Settlement with General Motors Over Driver Data." Published June 4, 2026, describing the May 8, 2026 settlement announcement.
- Troutman Pepper Locke. "California AG Announces Largest CCPA Enforcement Settlement to Date." Published February 2026, covering the $2.75 million Disney and ABC settlement announced February 11, 2026.
- Alabama Attorney General. "Attorney General Marshall Announces $12.2 Million Settlement with Roblox to Ensure Child Safety." Press release, April 21, 2026.
- Connecticut Office of the Attorney General. "Attorney General Tong Releases Updated Report on Connecticut Data Privacy Act." Press release, February 5, 2026.
Note: All figures verified as of August 2026. The 2026 full-year totals cited throughout (roughly 130 actions, AI enforcement pacing) are projections based on January through April 2026 run-rate data and may shift as the year progresses; state-by-state action counts reflect Troutman Pepper Locke's dataset through April 2026 and will change as later editions of that tracker are published.
