New data from Gartner estimates that U.S. state privacy fines reached $3.4B in 2025 — more than the prior five years of state privacy fines combined — with continued enforcement growth expected through 2028.
The takeaway is not just the size of the number, but what it reflects about regulatory enforcement trends.
As state privacy laws mature, organizations will likely face increasing scrutiny not only of their policies, but of how privacy choices are implemented in practice — across websites, consent flows, vendor relationships, and internal decision-making.
For many businesses, this is a good time to pause and ask whether their written privacy policies and cybersecurity protocols reflect how they actually operate day to day.
In the U.S., more fines have been levied due to violations of privacy laws in 2025 than the last five years combined.
www.gartner.com/…
[View source.]
