US states issued $3.45 billion in privacy-related fines to companies in 2025—exceeding the total from the previous five years combined. The surge reflects enforcement of new state privacy laws and increased scrutiny of AI and automation practices.
Privacy enforcement in the United States reached a record high in 2025, with state regulators imposing $3.45 billion in fines on companies, according to Gartner data cited by CyberScoop.
The figure dwarfs cumulative penalties from 2020 through 2024, signaling a dramatic shift in how aggressively states are policing data practices. The surge stems from several converging factors:
Stronger State Laws
Powerful privacy statutes in California and other states have given regulators the legal teeth to pursue meaningful penalties. These laws establish clearer standards for data handling and provide enforcement mechanisms with substantial financial consequences.
Interstate Coordination
New partnerships between state attorneys general have amplified enforcement efforts. Coordinated actions allow states to pool resources and target companies operating across multiple jurisdictions simultaneously, increasing pressure on national players.
AI and Automation Focus
Regulators have sharpened their focus on privacy impacts tied to artificial intelligence and automated decision-making. As companies deploy AI systems more widely, states are scrutinizing how these technologies handle consumer data and make decisions affecting individuals.
Market Context
The 2025 numbers reflect a maturation of the privacy enforcement landscape. After years of fragmented state regulations and relatively modest penalties, the US is moving toward a more stringent enforcement regime comparable to Europe's General Data Protection Regulation.
Companies now face mounting financial exposure across state lines. The $3.45 billion in fines represents not just penalties but also a clear signal that privacy violations carry material business risk. Organizations lacking robust data governance and AI oversight programs face particular vulnerability to enforcement actions.
The trend underscores a broader regulatory shift: privacy is no longer treated as a compliance afterthought but as a core business risk requiring executive-level attention and investment.
Manchester Airports Group disclosed a breach affecting Manchester, Stansted, and East Midlands airports. Hackers accessed data from approximately 8.7 million customers.
A lawsuit alleges that Elon Musk's xAI trained its Grok language models using child sexual abuse material, including both real and AI-generated imagery.
The ShinyHunters extortion group has published sensitive data from nearly 13 million Carhartt customer accounts stolen earlier this month, according to data breach notification service Have I Been Pwned.
A Russian-speaking ransomware gang called Aur0ra exploited SpaceX's Cursor AI coding assistant to breach at least seven companies between mid-April and late May, according to security firm Gambit Security.