U.S. Privacy Regulators Nearly Double Fine Totals as State Enforcement Enters a New Phase

State privacy regulators across the United States issued an estimated $3.425 billion in privacy‑related fines in 2025, nearly doubling the $1.827 billion recorded the previous year. The figures, compiled by Gartner, reflect a decisive shift from early awareness‑building toward sustained, penalty‑driven enforcement as state privacy laws mature and expand.

Gartner’s estimate aggregates state and federal enforcement actions along with statutory private rights of action tied to privacy statutes. Analysts say the jump marks a turning point: regulators are no longer focused on education but on direct accountability, particularly around automated decision‑making technologies. According to Gartner VP Analyst Nader Henein, new amendments across multiple states are increasingly aimed at governing AI‑driven systems and the personal data used to train them.

The enforcement surge comes as the U.S. privacy landscape continues to widen. Twenty‑two states now have comprehensive consumer privacy laws covering more than half the U.S. population, and another 24 are expected to pass similar legislation within five years. Only a handful of states—Kansas, Idaho, South Dakota, and Wyoming—remain outside the trend, opting for narrower rules focused on areas like children’s data and genetic information. Gartner notes the pattern mirrors the gradual nationwide adoption of breach‑notification laws between 2003 and 2018.

Parallel research published this month helps explain the rising totals. A cross‑jurisdictional study of web tracking found that privacy laws deliver measurable results only where regulators actively enforce them. EU authorities, for example, have issued more than 800 fines totaling €3.01 billion for unlawful data processing, with Germany and Spain leading in enforcement intensity. California, Canada, Australia, and South Korea were categorized as medium‑enforcement jurisdictions, where activity often hinges on high‑profile cases.

Recent California actions illustrate the trend. The state attorney general reached a $2.75 million settlement with Disney over failures to honor opt‑out signals, while the California Privacy Protection Agency has brought cases against PlayOn Sports and Ford. These align with Gartner’s assessment that U.S. states have entered a sustained enforcement phase, particularly around advertising trackers and consent‑management failures—areas that account for the majority of observed tracking connections on the web.

Gartner advises CISOs and privacy leaders to prioritize two areas. First, organizations should critically reassess privacy programs built several years ago and left to stagnate, as many U.S.‑only companies now find themselves out of step with current regulatory expectations. Second, improving privacy user experience—especially around consent, notices, and subject‑rights workflows—can mitigate the operational gaps most likely to trigger enforcement.