Lindy Ochoa
Associate Editor
Loyola University Chicago School of Law, JD 2028
All state privacy laws differ in their enforcement requirements, but recently, five states have also differentiated themselves by giving their attorney generals the discretion to decide when a business will be allowed an opportunity to cure a violation. Which businesses receive an opportunity to cure and what actions are required to cure a violation also differ from state to state. In fact, not all enforcement actions require companies to correct the underlying conduct that caused a violation. Regardless, Texas’s quintessential Consumer Data Protection Law guarantees a cure process and requires businesses to demonstrate that they’ve corrected the violation. States should consider uniformly adopting this approach while allowing additional corrective measures and financial remedies to be enforced when a violation harms consumers.
The problem with inconsistent consumer privacy regulations
Both inconsistent state-by-state cure requirements and states granting their attorney generals the sole power in determining a business’ path to cure can leave an unlawful practice uncorrected, causing the same conduct to persist and further harm to consumers. A 2026 comparison found that 10 states guarantee a cure period, while 11 leave the decision to their attorney general. However, five states recently moved from guaranteed to discretionary cure periods. Nevertheless, it should be noted that attorney generals are not necessarily impartial. Like with other policies, their enforcement of consumer protection laws is shaped by their priorities, which may differ across state lines.
Those differences in enforcement priorities can affect whether a business receives an opportunity to correct a violation before facing repercussions. For example, an attorney general may choose to impose a penalty because that provides a more visible enforcement response, signaling they are taking the consumer issue seriously, while a cure may receive less public attention, even if it better addresses the underlying conduct.
Additionally, inconsistent cure requirements across states make it difficult to determine whether a business corrected the conduct that caused a violation. State privacy laws vary in what businesses must show to prove they cured a violation. Some require more detailed documentation of the correction, while others require only a written assurance that the violation was cured. The Connecticut Attorney General’s 2025 enforcement action against TicketNetwork shows why this distinction matters. After the attorney general notified TicketNetwork of deficiencies in its privacy practices, the company repeatedly represented that it had corrected them. However, the attorney general found that the deficiencies had persisted for over a year after the violation. Without documentation showing what changed, an enforcement action may resolve the immediate violation without addressing the practice that caused it, setting up consumers to be harmed again.
Texas’s law should be the base upon which all state consumer privacy laws are built
Under Texas’s Consumer Data Protection Law, the attorney general must identify the specific statutory provisions a business allegedly violated and give it 30 days to cure the violation. The business must then provide a written statement showing how its violation was cured, notify the affected consumers, provide supporting documentation to the attorney general of which underlying policy was corrected and how, and make internal policy changes if necessary to prevent further violations. If the business fails to do so, the attorney general can proceed with enforcement and seek both civil penalties and injunctive relief. This approach makes correction part of the enforcement process rather than treating it as something that happens only after a penalty. Other states could adopt a similar process, giving businesses an opportunity to comply while requiring them to show they addressed the conduct that caused the violation.
The Texas model’s defined cure period removes the uncertainty surrounding a business’s opportunity to correct a violation before enforcement. In fact, the statute establishes that opportunity in advance, making enforcement less dependent on an attorney general’s discretion. Additionally, by requiring businesses to provide a written statement outlining how they cured a violation and supporting documentation, the second problem—getting a business to identify and correct the underlying conduct that caused the violation—is resolved.
Where a violation requires more extensive correction than a standard cure period can provide, states should still use the Texas model as the base of their statute but allow for flexibility in their enforcement. When these instances arise, states should be allowed to decide whether to grant negotiated corrective agreements, enforce penalties against noncompliant businesses, or require restitution be given to harmed consumers. In particular, negotiated agreements could address more complicated violations by setting out the specific changes a business must make and any compensation it must pay to affected consumers. Including negotiated agreements and other types of remedies in a consumer privacy statute gives attorney generals the flexibility to respond to more serious violations while providing businesses with directions on how to comply.
Ultimately, Texas’s Consumer Data Protection Law provides a baseline model for effective enforcement by identifying what caused a violation, requiring correction, and preserving penalties when correction is not enough. States should additionally allow corrective measures and financial remedies to be enforced when a violation harms consumers.