Sign in Subscribe

Topic

Regulatory Enforcement

Regulatory Enforcement is a category used by The De La Torre Review for analysis of enforcement actions by privacy, consumer protection, data protection, and AI regulators in the U.S. and EU. It covers agency investigations, complaints, administrative actions, consent orders, fines, penalties, and regulatory settlements, highlighting enforcement priorities and practical compliance lessons. Court decisions are covered separately under the Case Analysis tag.

Alabama Subpoenas OpenAI After Autonomous AI Agent Escapes Testing Environment and Hacks Hugging Face

Alabama subpoenas OpenAI after an autonomous AI agent escaped a testing environment and hacked Hugging Face. The investigation offers an early look at how existing consumer protection law may regulate AI safety, agentic behavior, and governance.

In the Matter of Cybba, Inc.

A practical analysis of CalPrivacy’s Cybba decision, addressing data broker registration under the Delete Act, targeted advertising and audience segmentation, and the growing importance of DROP in California’s data broker enforcement framework.

In the Matter of LocateSmarter, LLC

A practical analysis of CalPrivacy’s LocateSmarter decision, addressing data broker registration, the CCPA’s data minimization principle, and why businesses cannot require consumers to provide sensitive personal information to exercise the right to opt out of sale or sharing.

The CAN-SPAM Act Explained: A Practical Guide to U.S. Email Marketing Compliance

The CAN-SPAM Act establishes the federal rules governing commercial email in the United States. This practical guide explains who the law applies to, the seven core compliance requirements, FTC enforcement trends, penalties, and best practices for building a compliant email marketing program.

In the Matter of Disney DTC, LLC and ABC Enterprises, Inc.

The Disney CCPA settlement signals a shift from formal compliance to architectural compliance. Learn why opt-out rights must function across accounts, devices, services, and ad-tech ecosystems—not just exist on paper.

In the Matter of ROR Partners, LLC

A practical analysis of CalPrivacy's ROR Partners decision, explaining why custom audiences, inferred profiles, and behavioral segments can constitute the sale of personal information and trigger California's data broker registration requirements.

In the Matter of Tractor Supply Company

California's first major CCPA enforcement action against Tractor Supply signals a new era of operational privacy compliance. This article examines the CPPA's findings, the extension of CCPA obligations to job applicants, and the practical lessons for businesses.

California v. Delta Air Lines: Why a Website Privacy Policy May Not Cover a Mobile App

California’s lawsuit against Delta Airlines shows why mobile apps need privacy policies that clearly address their data practices—and how federal preemption can limit state enforcement even when an app allegedly fails to comply with CalOPPA.

When “Aggregated” Isn’t Anonymous: The New York Attorney General Pushes the Boundaries of App Data Disclosures

The New York Attorney General’s Matis case shows that “aggregated” data is not necessarily anonymous. If a third party can de-aggregate and re-identify individuals, the sharing should be disclosed—and contracts should expressly prohibit re-identification.