U.S. States Issued $3.45 Billion in Privacy Fines in 2025, Gartner Says
Summary
Gartner says U.S. states issued $3.45 billion in privacy fines in 2025, more than the previous five years combined, amid stronger enforcement and AI-related concerns. California’s privacy agency opposes a federal bill that could preempt state protections.
Key points
- Gartner reports that U.S. states issued $3.45 billion in privacy-related fines in 2025, exceeding the total for the previous five years combined.
- The article attributes the increase to stronger state privacy laws, interstate enforcement cooperation, and greater scrutiny of AI and automation’s privacy effects.
- California’s Privacy Protection Agency pursued companies of various sizes and across multiple industries under the CCPA.
- Ten states formed the Consortium of Privacy Regulators to coordinate investigations and enforcement involving common privacy laws.
- Gartner expects fines to rise as states develop legal frameworks addressing privacy harms from AI and automated decision-making.
- California’s privacy agency opposed a federal bill that could preempt tougher state laws, including the CCPA.
Article Details
- Event Type
- Record state-level enforcement of privacy laws, with U.S. companies receiving $3.45 billion in privacy-related fines in 2025.
- Impact
- According to Gartner, the fines exceeded the total for the previous five years combined. California enforcement reached companies of different sizes and across technology, automotive, and consumer-product industries. The article attributes the increase to stronger state laws, interstate enforcement cooperation, and scrutiny of AI-related privacy harms.
People
Nader HeinenGartner data protection and AI analyst and co-author of the research on state privacy fines; he discussed the shift toward enforcement and its effects on companies.Tom KempExecutive director of the California Privacy Protection Agency; he wrote to House Energy and Commerce Chair Brett Guthrie opposing a federal privacy bill that he argued would preempt stronger state protections.