Building a company is hard, complying with privacy regulations shouldn’t be

WW International, owner of the Kurbo weight loss app, was fined $1.5 million in 2022, as regulators alleged the company formerly known as Weight Watchers collected children’s personal health information without parental consent. Regulators said the Kurbo app was marketed to children, and that the sign-up process encouraged children to falsely claim they were older than 13 to dodge parental consent requirements. The FTC said hundreds of users who had claimed to be older than 13 when they signed up for the app later changed their birthdates to indicate they were younger than 13, and that they were allowed to continue using the app anyway.

The maker of the free Premom ovulation tracking app now has strict limits on sharing user data, following an FTC complaint that it had deceived users by sharing their personal health information with marketers without notification. The FTC alleged Easy Healthcare’s privacy policy made several false promises regarding how it would share personal data and if users could be identified through that data. Regulators claim the company failed to protect sensitive and private information, such as an individual user’s sexual and reproductive health, and their parental and pregnancy status. Easy Healthcare is now barred from sharing data for advertising, and the firm must collect consent before sharing users’ health information for any other reasons. It is also required to disclose to users how their data will be used.

There are 11 new state privacy laws scheduled to go into effect over the next two years, and dozens more currently under consideration by local legislatures. In July, new requirements in Florida, Oregon, and Texas could result in substantial fines for companies that are behind on data collection and consent requirements in those states. While there are similar elements among the new laws, each has unique provisions; for example, Florida’s law will primarily affect large companies, while the laws in Texas and Oregon may also apply to nonprofit groups and small businesses, respectively. Regulatory changes are coming quickly throughout the U.S., and without a thorough understanding of the new laws, your business is vulnerable to legal challenges. Common Sense Privacy closely monitors new legislation and can alert you when your policies fail to meet new requirements.

This GDPR enforcement tracker shows an up-to-date list of fines and penalties imposed by EU data protection authorities under the GDPR. This tracker only includes fines under the GDPR (including UK GDPR) and excludes those under non-European or non-data protection laws, however, it includes key ePrivacy fines under national laws of EU member states.