Luke Lister
Associate Editor
Loyola University Chicago School of Law, JD 2028
Most people click accept on a privacy notice without ever reading it. Meanwhile, the information companies collect about us, such as where we drive, what we watch, and what we search for, is shared and sold by more data brokers than ever. The growing practice of collecting and sharing the personal information of consumers has drawn the attention of state regulators. Specifically, in 2026, California’s Attorney General announced record penalties against Disney and General Motors under the state’s privacy law, the California Consumer Privacy Act (CCPA). As consumers’ personal information continues to be shared at a mounting pace, California’s enforcement of the CCPA shows why strong state enforcement of privacy laws is more important than ever, and why other states should follow its lead.
Regulators step up to protect consumer privacy
The CCPA, enacted in 2018, gave California residents the right to know what personal information is collected by a business and how they handle it. In 2023, the CCPA was amended to allow consumers the right to correct inaccurate personal information and to limit a business’s use of their sensitive personal information. The amendment also required businesses to follow two separate sets of rules: data minimization rules, which require a business to collect only the personal information it needs, and purpose limitation rules, which bar a business from collecting data for one reason and then using it for another.
On May 8, 2026, California Attorney General Rob Bonta announced a $12.75 million settlement with General Motors (GM). This marked the largest penalty ever issued under the CCPA and the state’s first enforcement action under the CCPA’s data minimization rules. The state alleged that GM sold the names, precise locations, and specific driving behavior of hundreds of thousands of Californians to two data brokers, LexisNexis Risk Solutions and Verisk. According to the attorney general, GM did this without adequate notice to or consent from consumers. GM continues to deny selling any data related to consumer driving behavior or location, but it reportedly earned about $20 million from these sales nationwide. Under the settlement terms, GM must stop selling consumer driving data to consumer reporting agencies for five years, delete the driving data it currently holds, and ask the brokers to delete what they received.
Additionally, in February 2026, California announced a $2.75 million settlement with Disney to resolve allegations that it failed to honor consumers’ opt-out rights under the CCPA. California Attorney General Rob Bonta alleged that when consumers used Disney’s opt-out toggle, their request applied only to the streaming service they were watching and often only to the device they were using, so it did not stop Disney from selling or sharing their data through other services and devices connected to their account. Even when a consumer sent a Global Privacy Control signal, a browser setting that tells websites not to sell the user’s data, Disney honored the signal only on that device that sent it, not on other devices logged into the same Disney account. Under the settlement, Disney must implement an opt-out process that allows consumers to fully prevent the sale or sharing of their personal information. In practice, a consumer’s opt-out must now carry over to all Disney streaming services and personal devices tied to their account, not just the service or device they used to initiate the request.
California is not acting alone. In September 2025, California, Colorado, and Connecticut launched a joint investigation into businesses that may be ignoring Global Privacy Control signals. It was the first targeted priority of the Consortium of Privacy Regulators, a group formed in April 2025, with regulators from California, Colorado, Connecticut, Delaware, Indiana, New Jersey, and Oregon. Other states are enforcing their own privacy laws as well. Texas, for example, has taken the largest swing so far, securing a $1.375 billion settlement in 2025 with Google regarding claims that the company unlawfully tracked users’ location, incognito browsing activity, and biometric data.
When your data is used against you
The enforcement actions by California, Texas, and the Consortium of Privacy Regulators are aimed at a much larger market, one in which consumers’ personal information is bought and sold and then used to make decisions about them. In June 2026, California’s registry of data brokers, companies whose business model involves the buying and selling of consumers’ personal information, reached a record 581 registrants, the most since it was created in 2020.
The GM case shows how that market can work against consumers. The two brokers that bought GM’s data intended to use the information to develop a driver-rating product that could assist auto insurers when setting rates. Luckily, California drivers were not subject to the higher rates, unlike drivers in other states, likely because state law bars insurers from using driving data to set rates. Similarly, Texas has made a claim against Allstate, and its subsidiary Arity, for collecting and selling drivers’ precise location data to auto insurers.
A model with room to grow
California’s enforcement of the CCPA shows why strong state enforcement of privacy laws is more important than ever, and why other states should follow its lead. A privacy law only protects people if companies are forced to follow it, and consumers cannot protect themselves from privacy violations on their own. No driver could have known that their speed and braking habits were being sold to data brokers, and GM’s own privacy policy said it did not sell any driving data. Additionally, a right that must be exercised separately on every device and every service is very difficult to follow. California is succeeding where it matters most. The most important parts of these settlements may not be the fines. GM must delete driving data and stop selling it, and Disney must build opt-outs that work. These requirements change what companies do, not just what they pay.
California’s example is not perfect, however. Its privacy agency has warned that fines could become a routine cost of doing business, meaning a company may treat a penalty as an ordinary expense instead of a reason to change its practices, if the fines are not higher. Protection also still depends on where a consumer lives. California drivers avoided higher insurance rates, likely because of California law, while drivers in other states did not. If other states follow California’s lead by pairing strong penalties with real changes in company behavior, state enforcement can turn consumer privacy rights from promises on paper into real protection.