US states issued $3.45 billion in privacy-related fines to companies in 2025—exceeding the total from the previous five years combined. The surge reflects enforcement of new state privacy laws and increased scrutiny of AI and automation practices.
Privacy enforcement in the United States reached a record high in 2025, with state regulators imposing $3.45 billion in fines on companies, according to Gartner data cited by CyberScoop.
The figure dwarfs cumulative penalties from 2020 through 2024, signaling a dramatic shift in how aggressively states are policing data practices. The surge stems from several converging factors:
Stronger State Laws
Powerful privacy statutes in California and other states have given regulators the legal teeth to pursue meaningful penalties. These laws establish clearer standards for data handling and provide enforcement mechanisms with substantial financial consequences.
Interstate Coordination
New partnerships between state attorneys general have amplified enforcement efforts. Coordinated actions allow states to pool resources and target companies operating across multiple jurisdictions simultaneously, increasing pressure on national players.
AI and Automation Focus
Regulators have sharpened their focus on privacy impacts tied to artificial intelligence and automated decision-making. As companies deploy AI systems more widely, states are scrutinizing how these technologies handle consumer data and make decisions affecting individuals.
Market Context
The 2025 numbers reflect a maturation of the privacy enforcement landscape. After years of fragmented state regulations and relatively modest penalties, the US is moving toward a more stringent enforcement regime comparable to Europe's General Data Protection Regulation.
Companies now face mounting financial exposure across state lines. The $3.45 billion in fines represents not just penalties but also a clear signal that privacy violations carry material business risk. Organizations lacking robust data governance and AI oversight programs face particular vulnerability to enforcement actions.
The trend underscores a broader regulatory shift: privacy is no longer treated as a compliance afterthought but as a core business risk requiring executive-level attention and investment.
Authorities have arrested two alleged members of TeamPCP, a hacking group responsible for infecting over 1,000 organizations through supply-chain attacks.
A Georgia police officer used Flock surveillance technology to track the movements of his ex-partner and another officer after their affair ended, according to internal investigation records.
McKesson, a major healthcare and pharmaceutical distributor, confirmed a cybersecurity incident involving unauthorized access to third-party applications. Extortion group ShinyHunters claims responsibility for stealing 284 million patient data records.
Fraudsters are exploiting Microsoft Teams and similar enterprise chat apps to deceive Chinese users into sending large sums of money. The trend has sparked a wave of complaints across the region.