Every regulatory check AIfa Works runs across client engagements — with direct links to the governing law, maximum fine exposure, and enforcement consequence.
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation); ADA: civil penalty only in a lawsuit by the US Attorney General (pattern or practice, or an issue of general public importance), 42 U.S.C. 12188(b)(2)(C), amounts per 28 CFR 85.5 (2025 levels, unchanged for 2026); the EAA sets no fine itself — each EU state does (Germany: BFSG §37); AODA s.37: on conviction, and only for false accessibility reports, ignoring a director's or Tribunal order, or intimidation — administrative penalties follow a schedule and become daily only for major repeat violations (O. Reg. 191/11 s.83)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
$145–$2,190,294 per violation, $2,190,294 per year for identical violations (HIPAA) / up to $7,500 per violation (MHMDA); HIPAA: 42 U.S.C. 1320d-5 and 45 CFR 160.404, amounts adjusted by HHS on 28.01.2026 — the minimum depends on culpability, from $145 (did not know) to $73,011 (willful neglect not corrected); MHMDA: a violation is an unfair practice under the Consumer Protection Act (RCW 19.373.090), civil penalty per RCW 19.86.140
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court); CCPA: Civ. Code §1798.199.90 — $2,663 per violation, $7,988 per intentional violation or violation involving minors' data (CPPA adjustment in force since 01.01.2025); AB 2273: Civ. Code §1798.99.35 — $2,500 negligent, $7,500 intentional, Attorney General only; parts of the law are blocked by a court (Ninth Circuit, 12.03.2026, NetChoice v. Bonta, No. 25-2366), the case is pending
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
Up to $53,088 per violation; only for violating an FTC rule or a final FTC order, or knowingly repeating a practice the FTC has already declared unlawful (15 U.S.C. 45(l), 45(m)); amount per 16 CFR 1.98, adjusted 17.01.2025
$500–$1,500 per call or text (TCPA, private lawsuit) / up to $53,088 per email (CAN-SPAM); TCPA: statutory damages the recipient may sue for — $500 per violation, up to three times if willful or knowing (47 U.S.C. 227(b)(3)), not a government fine; CAN-SPAM: a violation is treated as a violation of an FTC rule (15 U.S.C. 7706(a)), amount per 16 CFR 1.98
Up to €20,000,000 or 4% of worldwide annual turnover (EU GDPR) / £17,500,000 or 4% (UK GDPR); whichever is higher; €10,000,000 or 2% for breaches listed in Art. 83(4), such as security and data protection by design; one processing operation is fined once, up to the amount for the gravest breach (Art. 83(3))
No statutory fine (contract standard); PCI DSS is an industry standard, not a law — the PCI Security Standards Council states that it does not enforce compliance; consequences, if any, are set by the card brands and the acquiring bank under the merchant agreement, and the monthly fine figures in circulation are not found in any primary source
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD); VA §59.1-584 and TX Bus. & Com. Code §541.155 — Attorney General only, after a 30-day cure period; CO C.R.S. 6-1-112(1)(a) — counted per consumer or transaction, up to $50,000 if against an elderly person; NY SHIELD: security duty GBL §899-bb via §350-d; failure to notify of a breach — the greater of $5,000 or $20 per missed notice, capped at $250,000 (GBL §899-aa); NY DFS: up to $1,000 per violation, $5,000 for intentional fraud (Financial Services Law §408), banks and insurers under their own laws
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA); DORA Art. 35(6)–(8): periodic penalty on critical ICT third-party service providers that ignore the Lead Overseer's measures, not on financial entities; GLBA: enforced by the functional regulators (15 U.S.C. 6805); obtaining customer data by pretexting is a crime — fine under Title 18 or up to 5 years, doubled fine and up to 10 years for schemes over 100,000 USD in 12 months (15 U.S.C. 6823); CTA: FinCEN final rule of 11.08.2026 exempts US companies from BOI reporting, only certain foreign companies registered in the US still report
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act); PIPEDA s.28: only for knowingly breaking breach-notification or breach-record duties, destroying requested information, retaliating against whistleblowers or obstructing the Commissioner — not for weak security itself; Quebec P-39.1 s.91: penal fine, whichever is greater, administrative penalty up to C$10,000,000 or 2% (s.90.12); LGPD Art. 52(II) per violation; Australia, Privacy Act s.13G: by a court, for serious interference only, whichever is greater; Singapore, PDPA s.48J(3): 10% if Singapore turnover exceeds 10 million SGD; AI Act Art. 99(3) for banned practices only, other obligations up to €15,000,000 or 3% (Art. 99(4))
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Showing 2000 of 2000 checks
#
#
Code
Check
Severity
Governing Law
Max Fine
001
ADA-001
Missing ALT Tags on Images
Images lack alternative text attributes, making visual content invisible to screen readers. This is the single most-filed ADA web accessibility complaint and the easiest to prove in court.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
002
ADA-002
Missing ARIA Labels on Interactive Elements
Buttons, links, and interactive controls lack accessible names via aria-label or aria-labelledby. Screen reader users cannot determine the purpose of these elements, creating a barrier to use.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
003
ADA-003
Insufficient Color Contrast Ratio
Text-to-background contrast falls below the 4.5:1 minimum ratio required for normal text. Low-vision users cannot read page content, and this is a measurable, automatable violation frequently cited in demand letters.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
004
ADA-004
No Skip Navigation Link
The page lacks a "skip to main content" link as the first focusable element. Keyboard and screen reader users must tab through the entire navigation on every page load, which is a documented accessibility barrier.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
005
ADA-005
Keyboard-Inaccessible Interactive Elements
Interactive elements such as dropdown menus, modals, or custom controls cannot be operated via keyboard alone. Users who cannot use a mouse are completely blocked from key functionality.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
006
ADA-006
Missing Form Field Labels
Form inputs lack associated <label> elements or aria-label attributes. Screen reader users cannot identify what information is being requested, preventing form completion.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
007
ADA-007
Broken Heading Hierarchy
The page is missing an H1 element or skips heading levels (e.g., H1 to H3). Screen readers rely on heading structure for page navigation; broken hierarchy makes content difficult to scan and understand.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
008
ADA-008
Missing HTML Lang Attribute
The <html> element lacks a lang attribute specifying the page language. Screen readers cannot determine correct pronunciation rules, causing garbled speech output for all page content.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
009
ADA-009
ADA Overlay Widget Installed
A third-party accessibility overlay widget (e.g., AccessiBe, UserWay) is installed. These overlays are considered a "red flag for troll lawyers," do not provide legal compliance, and have been explicitly rejected by disability advocacy organizations and courts.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
010
ADA-010
Inaccessible Careers/Job Application Portal
The careers page or job application portal is not accessible to users with disabilities. This creates liability under both ADA Title I (employment) and Title III (public accommodation) and is a frequent target of serial ADA plaintiffs.
Legal basis: ADA Title I § 12112; Title III § 12182
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
011
HIPAA-001
Meta Pixel on Medical Booking Pages
The Facebook/Meta tracking pixel is firing on appointment scheduling or medical service pages, transmitting patient health condition data to Meta. HHS has issued explicit guidance that this constitutes impermissible PHI disclosure.
Legal basis: 45 CFR § 164.502; HHS Bulletin Dec 2022
Google Analytics is collecting data on patient portal pages without a signed Business Associate Agreement. Google does not sign BAAs for standard Analytics, making any patient portal tracking an automatic HIPAA violation.
The website does not provide information about patients' right to receive a Good Faith Estimate of expected charges as required by the No Surprises Act. Self-pay and uninsured patients must be informed of this right before scheduling services.
TikTok, Snapchat, or other social media tracking pixels are active on pages describing specific health conditions or treatments. These pixels transmit URL paths that reveal the health conditions users are researching.
Patient intake or contact forms are processed through a third-party SaaS platform (e.g., Typeform, JotForm) without a signed Business Associate Agreement. All patient data submitted through these forms is an unsecured PHI disclosure.
Medical Chatbot Collecting Symptoms Without Consent
An AI-powered or scripted chatbot is collecting symptom information, health complaints, or medical history without presenting a HIPAA authorization or Notice of Privacy Practices. This creates an uncontrolled PHI collection point.
Patient intake forms are submitted over unencrypted HTTP connections or stored without encryption at rest. HIPAA requires technical safeguards including encryption for electronic PHI in transit and at rest.
The website does not provide a mechanism for patients to request access to or download their protected health information. HIPAA grants patients the right to access their PHI, and the process must be clearly communicated.
Telehealth Across State Lines Without License Filter
Telehealth services are offered to patients in states where the provider is not licensed, without a geographic eligibility filter. Corporate Practice of Medicine (CPOM) laws and state licensure requirements may be violated.
Legal basis: State Medical Practice Acts; CPOM Statutes
A health or wellness website is tracking user behavior without consent as required by Washington's My Health My Data Act (MHMDA). This law applies to any entity collecting health data from Washington residents, not just HIPAA-covered entities.
The website lacks a "Do Not Sell or Share My Personal Information" link in the footer. CCPA requires this link to be clear, conspicuous, and available on every page for California consumers.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
022
CCPA-002
Email Discount Popup Without Financial Incentive Notice
An email signup popup offers a discount (e.g., "10% off for subscribing") without a Financial Incentive notice. CCPA/CPRA requires businesses to disclose the material terms of any financial incentive program linked to data collection.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
023
CCPA-003
Third-Party Trackers Firing Before Cookie Consent
Analytics, advertising, and social media tracking scripts execute before the user has provided consent. Under CCPA/CPRA, third-party data sharing for cross-context behavioral advertising requires opt-out capability at minimum.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
024
CCPA-004
Missing or Inadequate Privacy Policy
The website lacks a comprehensive privacy policy or the existing policy fails to disclose required CCPA categories: types of personal information collected, purposes, third-party sharing, and consumer rights.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
025
CCPA-005
Careers Page Missing Applicant Privacy Notice
The careers or job application page collects resumes and personal data without an Applicant Privacy Notice. CPRA extended privacy rights to job applicants and employees, requiring disclosure at the point of collection.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
026
CCPA-006
No Data Deletion Request Mechanism
The website provides no way for consumers to request deletion of their personal information. CCPA requires at least two methods for submitting consumer requests, including a toll-free number for larger businesses.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
027
CCPA-007
Third-Party Data Sharing Without Disclosure
Personal information is shared with third-party advertising, analytics, or data enrichment services without disclosure in the privacy policy. Each undisclosed sharing relationship is a separate violation.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
028
CCPA-008
Missing Cookie Consent Banner for California Users
No cookie consent mechanism is presented to California visitors. While CCPA does not mandate cookie banners specifically, the CPPA has signaled enforcement priority for sites that deploy tracking cookies without honoring opt-out signals.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
029
CCPA-009
Auto-Opt-In to Marketing Communications
Users are automatically opted into marketing emails or SMS during account creation or checkout without affirmative consent. Pre-checked marketing consent boxes violate both CCPA principles and CAN-SPAM requirements.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
030
CCPA-010
Operating as Data Broker Without Registration
The business collects and sells personal information of consumers with whom it has no direct relationship, meeting the definition of a data broker, without registering with the state as required by Texas SB 2105 and California's Delete Act.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
031
FTC-001
Fake Countdown Timer (Dark Pattern)
A "limited time offer" countdown timer resets when the page is reloaded, revealing it is fabricated urgency. The FTC classifies fake countdown timers as a deceptive dark pattern subject to enforcement under Section 5.
A crossed-out "original" price is displayed that was never the actual selling price, creating a phantom discount. The FTC's Guides Against Deceptive Pricing prohibit fictitious former prices.
A "X people are viewing this right now" or "only Y left in stock" counter displays fabricated or unverifiable numbers. The FTC considers manufactured social proof to be a deceptive trade practice.
Customer reviews are displayed without verification of purchase or authenticity. The FTC's 2024 Rule on the Use of Consumer Reviews prohibits fake, purchased, or incentivized reviews without clear disclosure.
Canceling a subscription requires more steps, phone calls or obstacles than signing up. ROSCA requires simple mechanisms to stop recurring charges, and California requires online cancellation by a prominent link or button for subscriptions accepted online. The FTC's 2024 Click-to-Cancel Rule was vacated by the Eighth Circuit on 8 July 2025.
Affiliate links and ambassador commissions are not disclosed clearly and conspicuously above the first affiliate link on the page. The FTC requires material connection disclosure before the consumer encounters the endorsement.
Customer or influencer testimonials are displayed without disclosing that the reviewer received compensation, free products, or other incentives. Each undisclosed paid endorsement can incur fines up to $50,000.
Marketing copy uses terms like "eco-friendly," "carbon neutral," or "sustainable" without third-party certification or substantiation. The FTC's Green Guides require competent and reliable scientific evidence for environmental claims.
A free trial automatically converts to a paid subscription without clear, conspicuous disclosure of the conversion terms, billing date, and amount before the consumer provides payment information.
The price shown in advertising or search results differs from the price displayed at checkout due to added fees, different product versions, or changed terms. This constitutes classic bait-and-switch deception.
The contact or lead generation form collects phone numbers without an explicit opt-in checkbox for SMS communications. A2P 10DLC carrier requirements and the TCPA mandate prior express written consent for marketing texts.
Automated marketing text messages are sent outside permitted hours. Florida's Telephone Solicitation Act (FTSA) restricts texts to 8 AM–8 PM local time, with other states imposing similar windows.
Marketing text messages do not include opt-out instructions (e.g., "Reply STOP to unsubscribe"). CTIA guidelines and the TCPA require every marketing SMS to include a clear opt-out mechanism.
Commercial email messages do not include the sender's valid physical postal address. CAN-SPAM requires every commercial email to contain the sender's current street address or registered P.O. box.
Commercial emails lack a functioning unsubscribe mechanism. CAN-SPAM requires a clear, conspicuous opt-out method in every commercial message, and opt-out requests must be honored within 10 business days.
Abandoned cart recovery text messages are sent to consumers who did not provide prior express written consent for marketing texts. Cart abandonment does not constitute consent under the TCPA.
An automatic telephone dialing system (ATDS) is used to place calls or send texts without obtaining prior express consent. The TCPA prohibits unsolicited autodialed or prerecorded calls to cell phones.
Business SMS messages are sent via long codes (10-digit numbers) without proper A2P 10DLC campaign registration with carriers. Unregistered campaigns face message filtering, blocking, and per-message carrier fines.
The bulk SMS system does not automatically process STOP keyword responses to immediately cease messaging. Failure to honor opt-out keywords exposes the business to TCPA class-action liability at $500–$1,500 per message.
Pre-recorded or artificial voice marketing messages are delivered to consumers without prior express written consent. The TCPA's robocall provisions carry statutory damages of $500–$1,500 per call.
The Facebook/Meta tracking pixel loads and transmits user data before the visitor has interacted with the cookie consent banner. Under GDPR, non-essential tracking requires prior, informed, and affirmative consent.
The website displays no cookie consent mechanism to visitors from EU member states. The ePrivacy Directive and GDPR require informed consent before placing non-essential cookies or tracking technologies.
Google Analytics collects visitor data from EU users without obtaining prior consent. Multiple EU Data Protection Authorities have ruled that Google Analytics transfers constitute unlawful processing and cross-border data transfer.
Third-party services processing personal data on behalf of the controller operate without a signed Data Processing Agreement. GDPR mandates written contracts specifying processing scope, purpose, and security obligations.
The organization has no documented procedure for notifying the supervisory authority within 72 hours of becoming aware of a personal data breach. Failure to notify is a separate, independently finable violation.
Personal data of EU residents is transferred to US-based servers or services without Standard Contractual Clauses (SCCs), adequacy decisions, or other approved transfer mechanisms following the Schrems II ruling.
Legal basis: GDPR Articles 44–49; Schrems II (C-311/18)
Standard YouTube embeds combined with tracking pixels create a video viewing data leak similar to VPPA violations. YouTube's standard embed shares viewing habits with Google before consent is obtained.
The website provides no way for data subjects to request erasure of their personal data. GDPR's Right to Erasure requires controllers to delete personal data upon request when no overriding legal basis exists.
The privacy policy does not specify how long personal data is retained or the criteria used to determine retention periods. GDPR requires transparent communication of retention periods at the point of collection.
The cookie consent banner presents pre-checked consent boxes for analytics or marketing cookies. The CJEU ruled in Planet49 that pre-ticked checkboxes do not constitute valid consent under GDPR.
The website does not set a Content-Security-Policy HTTP header, leaving it vulnerable to cross-site scripting (XSS) and data injection attacks. CSP is a critical defense layer for preventing unauthorized script execution.
API keys for services like Google Maps, Stripe, or SendGrid are visible in client-side JavaScript source code. Exposed secret keys can be harvested by bots and used for unauthorized API access, billing fraud, or data exfiltration.
Legal basis: PCI-DSS v4.0 Req. 2.2.7; OWASP API Security Top 10
Credit card numbers are collected directly into form fields on the merchant's server rather than through a PCI-compliant tokenization service (e.g., Stripe Elements, Braintree). This places the entire site in PCI-DSS scope.
Pages containing forms, login fields, or payment inputs are served over unencrypted HTTP. All data submitted on these pages can be intercepted in transit by any network intermediary.
The page is served over HTTPS but loads sub-resources (images, scripts, stylesheets) over insecure HTTP. Mixed content undermines the security guarantee of HTTPS and can be exploited for man-in-the-middle attacks.
Legal basis: PCI-DSS v4.0 Req. 4.2.1; OWASP Transport Layer Security
Server directories such as /wp-content/uploads/ are browsable, exposing uploaded files, internal documents, and potentially sensitive data. Directory listing must be disabled on all web-accessible paths.
The WordPress XML-RPC endpoint (xmlrpc.php) is publicly accessible and responding to requests. This endpoint is a known vector for brute-force amplification attacks and DDoS abuse.
The content management system (WordPress, Magento, Drupal) is running an outdated version with publicly disclosed security vulnerabilities. Unpatched CMS installations are the primary vector for website compromises.
External JavaScript files are loaded without Subresource Integrity (SRI) hashes. If a third-party CDN or script host is compromised, malicious code could be injected into the page without detection.
Legal basis: PCI-DSS v4.0 Req. 6.4.3; W3C SRI Specification
Contact forms, login pages, and registration forms lack CAPTCHA or bot-detection mechanisms. Unprotected forms are vulnerable to credential stuffing, spam injection, and automated abuse at scale.
A third-party chatbot records and stores conversation transcripts without informing users and obtaining consent. Under California's Invasion of Privacy Act (CIPA), this constitutes illegal wiretapping at $5,000 per dialog.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
072
STATE-002
BIPA: Virtual Try-On Without Biometric Consent
A virtual try-on or face-scanning feature collects biometric identifiers without obtaining informed written consent as required by Illinois BIPA. Violations carry statutory damages of $1,000–$5,000 per scan.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
073
STATE-003
Utah AI Act: AI Chatbot Not Disclosing AI Identity
An AI-powered chatbot or virtual assistant fails to identify itself as artificial intelligence when directly asked by a user. Utah's AI Policy Act requires AI systems to disclose their non-human nature upon inquiry.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
074
STATE-004
CA BOT Act: AI Using Human Name Without Disclosure
An AI chatbot or automated account uses a human name, avatar, or persona without disclosing that it is not a human. California's BOT Act (SB 1001) requires clear disclosure when AI impersonates a human in online interactions.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
075
STATE-005
Proposition 65: Missing Toxic Substance Warning
Products shipped to California contain chemicals listed under Proposition 65 without the required "known to cause cancer or reproductive harm" warning. Violations carry penalties of $2,500 per day per violation.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
076
STATE-006
CA Auto-Renewal: No Reminder Before Annual Charge
Annual subscriptions renew without sending a reminder email before the charge. California's Automatic Renewal Law requires businesses to provide a clear reminder with cancellation instructions before each renewal.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
077
STATE-007
Inadequate Age-Gate for Restricted Products
Age verification for alcohol, vape, or CBD products relies on a simple "Yes I'm 21" button without real identity verification. Multiple states require robust age verification beyond self-attestation for restricted product sales.
Legal basis: State Alcohol Control Acts; 27 CFR § 6
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
078
STATE-008
SB 478: Hidden Service Fees at Checkout
Mandatory fees, service charges, or surcharges are revealed only at checkout rather than being included in the advertised price. California's SB 478 (Junk Fee Ban) prohibits hidden fees not disclosed upfront.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
079
STATE-009
NY SHIELD Act: Inadequate Data Security
The business collects private information of New York residents without implementing reasonable data security safeguards as required by the SHIELD Act. Administrative, technical, and physical safeguards must be documented.
Legal basis: NY Gen. Bus. Law § 899-bb (SHIELD Act)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
080
STATE-010
Job Postings Without Salary Range
Job listings do not include compensation ranges as required by pay transparency laws in California, New York, Colorado, and Washington. Penalties range up to $10,000 per non-compliant posting.
Legal basis: Cal. Lab. Code § 432.3; NY Lab. Law § 194-b; CO SB 19-085
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
081
FIN-001
GLBA: Sensitive Financial Docs via Unsecured Email
The business accepts sensitive financial documents (tax returns, bank statements, SSNs) via standard unencrypted email. GLBA's Safeguards Rule requires financial institutions to implement secure transmission methods for customer data.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
082
FIN-002
FinCEN BOI: Missing Beneficial Ownership Report
The LLC or corporation has not filed a Beneficial Ownership Information report with FinCEN as required by the Corporate Transparency Act. Non-compliance carries penalties of $500 per day, up to $10,000, plus potential criminal liability.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
083
FIN-003
FINRA: Personal Email for Investment Communications
An investment advisor or broker-dealer uses personal Gmail or unarchived email for client communications instead of a supervised, archived corporate email system. FINRA requires retention and supervision of all business communications.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
084
FIN-004
Missing Contractor License Number on Website
A licensed contractor's website does not display the state contractor license number. Most states require the license number to appear on all advertising and business communications, with penalties of $2,000–$5,000.
Legal basis: Cal. Bus. & Prof. Code § 7030.5; State Contractor License Acts
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
085
FIN-005
No DMCA Agent or Takedown Policy
The website has no registered DMCA agent with the U.S. Copyright Office and does not publish a DMCA takedown policy page. Without these, the business loses safe harbor protection for user-generated content.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
086
FIN-006
Missing Arbitration Clause in Terms of Service
The Terms of Service lack a class action waiver and mandatory arbitration clause. Without these provisions, the business is exposed to class-action litigation for any consumer dispute.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
087
FIN-007
Return Policy Not Prominently Displayed
California law requires a no-return or limited-return policy to be conspicuously displayed at the point of sale. If not displayed, consumers are entitled to a full refund within 30 days regardless of the merchant's intended policy.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
088
FIN-008
Credit Card Surcharge Without Advance Notice
A credit card surcharge or convenience fee is added at checkout without prior notice at the point of entry. Multiple states require advance signage/disclosure, and card network rules limit surcharges to 3% with mandatory disclosure.
Legal basis: Visa Core Rules § 5.6.2; State Surcharge Statutes
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
089
FIN-009
SEC Form CRS Missing for Investment Advisors
A registered investment advisor's website does not publish Form CRS (Client Relationship Summary) as required by SEC Regulation Best Interest. Form CRS must be delivered to retail investors and made publicly available.
Legal basis: SEC Rule 17a-14; Regulation Best Interest
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
090
FIN-010
Insurance Lead Generation Without Required Disclosures
The website generates insurance quotes or leads without state-required disclosures about the nature of the service, compensation arrangements, and licensure status. Multiple states require specific disclosures for insurance lead generators.
Legal basis: State Insurance Codes; NAIC Producer Licensing Model Act
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
091
OPS-001
Missing DMARC Record
The domain lacks a DMARC (Domain-based Message Authentication, Reporting & Conformance) DNS record. Without DMARC, emails are increasingly rejected or spam-foldered by Gmail, Yahoo, and other major providers enforcing DMARC policies.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
092
OPS-002
Missing SPF Record
The domain has no SPF (Sender Policy Framework) DNS record, making it vulnerable to email spoofing. Attackers can send emails appearing to come from the domain, enabling phishing attacks against customers and partners.
Legal basis: RFC 7208; Google Sender Guidelines 2024
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
093
OPS-003
Broken Outbound Links to Expired Domains
The website contains links pointing to expired, parked, or potentially malicious domains. Broken outbound links damage SEO authority and can redirect users to phishing or malware sites if the expired domain is re-registered by bad actors.
Legal basis: Google Search Quality Guidelines; OWASP Broken Link Hijacking
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
094
OPS-004
Orphaned Tracking Scripts from Discontinued Services
The website loads JavaScript from services that have been discontinued, acquired, or abandoned. These zombie scripts waste page load time, may break functionality, and pose a supply-chain security risk if the domain is re-registered.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
095
OPS-005
Missing DKIM Email Authentication
The domain does not publish DKIM (DomainKeys Identified Mail) records for email authentication. Without DKIM, receiving mail servers cannot verify that email content was not altered in transit, reducing deliverability.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
096
OPS-006
Outdated Copyright Year in Footer
The website footer displays an outdated copyright year, signaling to visitors, search engines, and potential litigants that the site may be abandoned or unmaintained. This erodes trust and can negatively impact search rankings.
Legal basis: Google Search Quality Evaluator Guidelines § 4.5
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
097
OPS-007
Missing robots.txt and Sitemap
The website lacks a robots.txt file and/or XML sitemap. Without these, search engines may crawl the site inefficiently, index sensitive pages, or miss important content entirely, directly impacting organic search visibility.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
098
OPS-008
Poor Mobile Tap Targets
Interactive elements (buttons, links, form fields) are smaller than 48x48 CSS pixels or positioned too close together, causing frequent mis-taps on mobile devices. This is both a UX issue and a WCAG 2.5.5 accessibility violation.
Legal basis: WCAG 2.5.8; Google Mobile Usability Guidelines
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
099
OPS-009
Contact Form Without Rate Limiting
The contact form has no rate limiting, honeypot, or abuse prevention mechanism. Unprotected forms are routinely exploited for spam injection, phishing relay, and denial-of-service attacks against the form handler.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
100
OPS-010
Missing or Expired SSL Certificate
The website lacks a valid SSL/TLS certificate or the certificate has expired. Browsers display prominent security warnings that drive away visitors, and search engines penalize non-HTTPS sites in rankings.
Legal basis: PCI-DSS v4.0 Req. 4.2.1; Google HTTPS Ranking Signal
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
101
ADA-101
Missing Accessibility Information on Products/Services
EAA-regulated digital services fail to provide clear accessibility information and features in their digital interface, violating EU Directive 2019/882 requirements for e-commerce and banking.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
102
ADA-102
Non-Compliant Public Feedback Processes
The website's feedback mechanism is not accessible to persons with disabilities, violating AODA customer service standards for Ontario-based organizations.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
103
COP-101
Illegal Personal Information Collection from Children
The website collects personal data (names, emails, tracking cookies) from users under 13 without obtaining verifiable parental consent, violating COPPA regulations.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
104
PIP-101
Lack of Mandated Privacy Officer Contact Info
Canadian-targeted website fails to publish the name or contact info of the designated Privacy Officer accountable for PIPEDA compliance.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
105
PIP-102
Vague Purposes for Personal Data Collection
Form fields collect data without clearly identifying the specific, limited purpose of collection at or before the time of collection under PIPEDA requirements.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
106
LGP-101
No Appointed Data Protection Officer (DPO)
Brazilian-targeted site does not identify or provide contact details for its DPO (Encarregado) on the website, violating LGPD Article 41.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
107
LGP-102
Absence of a Valid Legal Basis for Processing
Website processes personal data without listing the explicit legal basis (e.g., consent, legitimate interest) for each processing activity under LGPD.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
108
POP-101
Direct Marketing Without Opt-In Consent
Website deploys pre-checked consent boxes or opt-out forms for electronic direct marketing, violating POPIA opt-in regulations for South African consumers.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
109
POP-102
Unlawful Cross-Border Data Transfer Disclosures
South African website transfers personal data outside of South Africa without ensuring the recipient country has adequate data protection laws or disclosing it to the user.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
110
APP-101
Non-Compliant Overseas Data Disclosure Statement
Australian-targeted site fails to state in its privacy policy whether it is likely to disclose personal information to overseas recipients and, if so, in which countries.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
111
APP-102
Lack of Anonymous/Pseudonymous Interaction Option
The website forces users to identify themselves for general inquiries where it is not practically or legally necessary, violating Australian Privacy Principle 2.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
112
PDP-101
Failure to Provide Request for Access/Correction Info
Singaporean site fails to specify how users can request access to or correction of their personal data in its privacy disclosures.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
113
PDP-102
Unreasonable Terms forcing Personal Data Consent
Website requires consent to collect personal data beyond what is reasonable to provide the product or service, violating PDPA consent requirements.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
114
AIA-101
Unmarked Generative AI Output / Deepfakes
Website presents AI-generated text, audio, or video (deepfakes) without marking it in a machine-readable format as AI-generated, violating EU AI Act transparency rules.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
115
AIA-102
Lack of Disclosure on AI User Interaction
The website uses an AI system (like a customer support chatbot) to interact with natural persons without informing them that they are interacting with an AI, violating transparency mandates.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
116
DSA-101
Deceptive UI Patterns (Dark Patterns) in Design
The website employs dark patterns that distort or impair the user's ability to make autonomous, informed choices (e.g., difficult unsubscribe flows, deceptive consent popups).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
117
DSA-102
Lack of Single Point of Contact for Authorities
Digital service provider fails to publish a direct, electronic, and easily accessible single point of contact for communications with EU authorities.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
118
DMA-101
Unlawful Data Combination Across Services
Gatekeeper-scale platforms combine personal data from their core platform with data from other services without specific user consent, violating DMA regulations.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
119
STA-101
Deceptive Design Encouraging Child Data Sharing
Website uses dark patterns to nudge children to provide personal information beyond what is necessary, violating California AB 2273 requirements.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
120
STA-102
Absence of Consumer Appeal Rights Process
The privacy policy fails to explain the process for consumers to appeal a refusal to take action on a privacy rights request, violating Virginia VCDPA and Texas TDPSA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
121
STA-103
Lack of Sensitive Data Processing Opt-In
The website processes sensitive personal data (e.g., precise geolocation, health data, racial info) without obtaining affirmative opt-in consent from Colorado or Virginia residents.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
122
NYD-101
Lack of Cybersecurity Multi-Factor Auth (MFA)
Financial services website does not enforce multi-factor authentication for access to corporate email or customer portal databases, violating NY DFS requirements.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
125
DOR-101
Inadequate ICT Third-Party Risk Disclosures
Financial entity fails to maintain a comprehensive register of information on its contractual arrangements with ICT third-party service providers, violating DORA guidelines.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
126
VPPA-001
Video Tracking Pixel Fires Without VPPA Consent
Website embeds video content (HTML5 video, YouTube, Vimeo iframes) alongside Meta Pixel, Google Analytics, or other tracking pixels that transmit video viewing data to third parties without obtaining separate, explicit written consent. Under the VPPA, knowingly disclosing a consumer's PII linked to video viewing habits without prior consent is a violation.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
127
EAA-001
No Accessibility Statement Published Under European Accessibility Act
E-commerce or digital service website targeting EU consumers lacks a publicly accessible accessibility statement describing conformance status with EN 301 549 / WCAG 2.1 AA. The European Accessibility Act (Directive 2019/882), enforceable since June 28, 2025, requires private-sector businesses providing covered services to publish accessibility declarations.
Legal basis: EU Directive 2019/882 (EAA), Art. 13(2), Annex V
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
128
NIS2-001
No Security.txt or Vulnerability Disclosure Policy (NIS2)
Website of an essential or important entity (energy, health, transport, digital infrastructure) lacks a /.well-known/security.txt file or any publicly accessible vulnerability disclosure policy. NIS2 Directive requires covered entities to implement incident handling and vulnerability management measures.
Legal basis: EU Directive 2022/2555 (NIS2), Art. 21(2)(b), (e)
Health Data Shared Without FTC Health Breach Notification Compliance
Non-HIPAA health website or app (wellness, fitness, symptom checker) collects identifiable health information and transmits it to third-party analytics/advertising platforms without displaying a breach notification policy. The FTC Health Breach Notification Rule (amended July 2024) treats unauthorized sharing of health data as a breach.
Legal basis: 16 CFR Part 318 (FTC Health Breach Notification Rule, 2024)
Cookie Wall Blocks Access Without Valid Reject Option
Website displays a cookie consent banner that blocks all content access until cookies are accepted, with no \"Reject All\" option or equivalent free-access alternative. The EDPB and CJEU have ruled that cookie walls conditioning service access on acceptance of non-essential cookies do not constitute freely given consent under GDPR.
Minor's Data Used for Targeted Advertising Without Opt-In (CTDPA)
Website directs content at minors (under 18) or collects age data indicating minor users, but continues to fire targeted advertising pixels without obtaining affirmative opt-in consent. Connecticut SB 3 (amending CTDPA) prohibits processing minors' data for targeted advertising or profiling without explicit consent.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
132
OCPA-001
Website Does Not Honor Global Privacy Control Signal (Oregon CPA)
Website targeting Oregon consumers does not detect or honor the Global Privacy Control (GPC) browser signal as a valid opt-out request for targeted advertising and personal data sales. The Oregon Consumer Privacy Act mandates recognition of universal opt-out preference signals as of January 1, 2026.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
133
COAI-001
High-Risk AI System Without Public Transparency Disclosure (Colorado AI Act)
Website uses AI-driven systems for consequential decisions (hiring, lending, insurance, housing) but lacks a publicly accessible statement disclosing which high-risk AI systems are deployed and how algorithmic discrimination risks are managed. Colorado SB 24-205 requires deployers to maintain such disclosures.
Legal basis: Colorado SB 24-205 (Colorado AI Act), §§ 6-1-1701
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
134
JPAP-001
Cookie Data Shared With Third Parties Without Japan APPI Disclosure
Website targeting Japanese users transfers cookie/tracking data to third-party advertising or analytics vendors that can combine it to identify individuals, without disclosing these transfers or confirming third-party consent. Japan's APPI and the Telecommunications Business Act require transparency and consent confirmation for such transfers.
Legal basis: Japan APPI (Act No. 57 of 2003, amended 2022), Art. 31; Telecom Business Act, Art. 27-12
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
135
KRPI-001
Non-Essential Cookies Set Before Consent for South Korean Users
Website targeting South Korean users sets tracking or advertising cookies before obtaining explicit, informed consent. South Korea's PIPA requires prior opt-in consent before collecting personal information including behavioral tracking data. Violations carry fines up to 3% of total revenue.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
136
FERP-001
Education Website Tracking Pixels Transmitting Student Data
Educational institution website embeds Meta Pixel, Google Analytics, or similar tracking technologies on student-facing pages (portals, enrollment forms, course catalogs) that transmit potentially identifiable student data to third parties. FERPA prohibits unauthorized disclosure of PII from education records.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Website uses electronic signatures or agreements for transactions but fails to provide required pre-consent disclosures including: the right to receive paper copies, the right to withdraw consent and procedures for doing so, and the hardware/software requirements for accessing records.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
138
IDDP-001
Privacy Notice Not Available in Required Languages (India DPDP Act)
Website collecting personal data from Indian users does not provide a privacy notice in English and at least one of the 22 scheduled Indian languages as required by the Digital Personal Data Protection Act 2023. The notice must include itemized descriptions of data collected, purposes, and user rights.
Legal basis: India DPDP Act 2023 (Act No. 22 of 2023), Sections 5–6
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
139
FACT-001
Full Credit Card Number Shown on Electronic Receipt (FACTA Violation)
Website displays more than the last five digits of a credit/debit card number or shows the expiration date on electronic order confirmations, receipts, or account pages. FACTA mandates truncation of card numbers to no more than five digits and prohibits printing the expiration date on electronically printed receipts.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
140
DLDP-001
No Clear Opt-Out Mechanism for Delaware Consumers (DPDPA)
Website targeting Delaware consumers lacks a clear, conspicuous opt-out link for targeted advertising and personal data sales, or fails to recognize universal opt-out signals (GPC). The Delaware Personal Data Privacy Act (effective January 1, 2025) requires both mechanisms.
Legal basis: Delaware DPDPA (HB 154, Chapter 12C, Title 6)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
141
THPD-001
Non-Essential Cookies Firing Without Opt-In Consent (Thailand PDPA)
Website targeting Thai users fires non-essential cookies (analytics, advertising, social) before obtaining explicit opt-in consent via a compliant consent banner. Thailand's PDPA requires express, active opt-in consent before processing personal data including cookies. Pre-ticked boxes are explicitly non-compliant.
Legal basis: Thailand PDPA B.E. 2562 (2019), Sections 19, 23
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Website of an SEC-reporting public company does not include or link to cybersecurity risk management disclosures (board oversight, management expertise, risk assessment processes) as required in 10-K filings. Corporate websites must reference or link to these disclosures for investor relations compliance.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
143
TRKV-001
Missing Data Controller Registration Notice (Turkey KVKK)
Website processing personal data of Turkish residents does not disclose the identity of the data controller, VERBIS (Data Controllers Registry) registration number, or provide a compliant privacy notice identifying purposes of processing, third-party transfers, and data subject rights per KVKK requirements.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
144
NZPR-001
Cross-Border Data Transfer Without NZ Privacy Act IPP 12 Compliance
Website collects personal data from New Zealand users and transfers it overseas (evidenced by US/EU-based tracking scripts) without disclosing in the privacy policy that data may be transferred overseas and what safeguards are in place per Information Privacy Principle 12.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
145
MNDP-001
Privacy Notice Missing Data Retention Periods (Minnesota MCDPA)
Website targeting Minnesota consumers has a privacy policy that does not disclose data retention periods or policies for personal data collected. The Minnesota Consumer Data Privacy Act (effective July 31, 2025) uniquely requires retention policy disclosure in the privacy notice.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
146
EIDS-001
Very Large Online Platform Not Prepared for EUDI Wallet Acceptance
Very Large Online Platform (VLOP) requiring strong customer authentication for login, age verification, or KYC does not support or indicate readiness for EU Digital Identity Wallet acceptance. eIDAS 2.0 mandates VLOPs accept EUDI Wallet by December 2027.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
147
AMLK-001
AML/KYC Customer Identification Notice Missing on Financial Site
Website of a financial institution, fintech, or money services business that opens accounts online does not display the required customer notification explaining that personal information is being collected to comply with federal identity verification (CIP) requirements under the USA PATRIOT Act/BSA.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
148
CTHL-001
Geofencing Near Health Facility for Data Collection (CT SB 3)
Website or associated mobile app uses geofencing technology within 1,750 feet of a mental, reproductive, or sexual health facility to identify, track, or send push notifications to consumers for health data collection purposes. Connecticut SB 3 specifically prohibits this practice.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
149
IDDG-001
Missing Grievance Redressal Mechanism for Indian Data Principals
Website collecting personal data from Indian users does not provide a designated grievance officer's contact details or a complaint mechanism for data principals. The India DPDP Act 2023 requires Data Fiduciaries to establish an accessible grievance redressal mechanism on their website.
Legal basis: India DPDP Act 2023, Section 8(10); IT Act 2000, Rule 5(9)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Website's cookie consent banner makes the \"Accept All\" button visually prominent (larger, colored, higher placement) while the \"Reject All\" or \"Manage Preferences\" option is obscured, smaller, or requires additional clicks. European DPAs (CNIL, AEPD, Belgian DPA) have ruled that asymmetric cookie banners constitute dark patterns undermining freely given consent.
Biometric Capture Without Prior Notification and Consent (Texas CUBI)
Website captures biometric identifiers (such as facial geometry scans from virtual try-ons or photos, or voiceprints) without informing the individual prior to capture and without obtaining their explicit consent, violating Texas CUBI.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
152
EUAI-003
Missing Machine-Readable Metadata/Watermark in AI-Generated Content (EU AI Act)
Providers of AI systems that generate or manipulate image, audio, or video content (synthetic content/deepfakes) must ensure that the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.
Legal basis: Regulation (EU) 2024/1689 (EU AI Act), Art. 50(2)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
153
QC25-002
Missing Data Protection Officer (DPO) Contact Details on Website (Quebec Act 25)
Website collecting personal information from Quebec residents fails to publish the title and contact details of the person in charge of personal information protection (DPO/Responsable) on the website, violating Section 3.1 of Quebec's Act 25.
Legal basis: Quebec Act respecting the protection of personal information in the private sector (Act 25), Section 3.1 & 60.1
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
154
COPA-001
Failure to Recognize Global Privacy Control (GPC) Opt-Out Signal (Colorado CPA)
Website targeting Colorado consumers fails to recognize and process the Global Privacy Control (GPC) universal opt-out signal to automatically opt users out of the processing of their personal data for targeted advertising or sale, which is mandatory as of July 1, 2024.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
155
MHMDA-002
Missing Consumer Health Privacy Policy Link on Homepage (WA MHMDA)
Website collecting consumer health data (e.g., searches for symptoms, reproductive wellness trackers, fitness registrations) fails to display a separate, distinct link on its homepage footer or header titled "Consumer Health Privacy Policy", as required by Washington State's MHMDA.
Missing Separate Consent for Sensitive Personal Information Processing (China PIPL)
Website targeting Chinese residents collects sensitive personal information (such as financial accounts, medical records, biometrics, or precise location) without obtaining separate, specific consent for each category of sensitive data, violating PIPL Article 29.
Legal basis: China Personal Information Protection Law (PIPL), Article 29 & 66
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
157
DSA-001
Dark Patterns in User Interfaces (EU DSA Article 25)
Website uses deceptive design techniques or dark patterns that distort, impair, or manipulate the user's ability to make free and informed decisions (e.g., making subscription cancellation significantly harder than signing up), violating DSA Article 25.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
158
KRPA-001
Bundling Consent for Third-Party Data Transfers (South Korea PIPA)
Website collects personal data of South Korean residents and shares it with third parties (such as marketing networks, CRM tools, or analytics) but bundles the third-party transfer agreement with the general privacy policy or terms of service, violating South Korea PIPA Article 17.
Legal basis: Personal Information Protection Act of South Korea (PIPA), Article 15, 17 & 75
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
159
UKOSA-001
Inadequate Age Verification for Regulated Content (UK OSA)
Website publishes content harmful to children (such as adult content, gambling, or highly sensitive violent content) but fails to implement robust age verification, relying instead on simple click-through "I am 18" age gates, violating the UK Online Safety Act.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
160
EUAI-004
Missing Emotion Recognition / Biometric Categorization Disclosure (EU AI Act)
Providers or deployers of emotion recognition or biometric categorization systems must inform natural persons exposed thereto of the operation of the system, violating transparency obligations under EU AI Act Article 50(3).
Legal basis: Regulation (EU) 2024/1689 (EU AI Act), Art. 50(3)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
161
CAAD-002
Default Geolocation Disabled for Under-18 Users (CA AADC)
Website likely to be accessed by minors fails to disable precise geolocation tracking by default, violating California's Age-Appropriate Design Code Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
162
BIPA-002
Missing Biometric Retention and Destruction Policy (BIPA)
Website collecting or utilizing biometric data (virtual try-on, authentication) fails to publish a publicly available retention schedule and destruction guidelines as mandated by Illinois BIPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
164
VCDP-002
Geofencing Around Healthcare Facilities for Data Collection (VCDPA)
Website or app uses geofencing within 1,750 feet of any healthcare facility to track, identify, or target consumers for health data collection, which is prohibited under Virginia's amended VCDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
165
TDPS-001
Sensitive Data Consent Violation (Texas TDPSA)
Website targeting Texas consumers collects sensitive personal data, including biometric or genetic identifiers, without obtaining explicit prior opt-in consent as mandated by the Texas Data Privacy and Security Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
166
MTDP-001
Missing Parent Consent Verification for Minors under 13 (Montana MCDPA)
Website targeting Montana consumers collects personal data of minors under 13 without obtaining verifiable parental consent in accordance with the Montana Consumer Data Privacy Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
167
FDBR-001
Unlawful Surveillance via Facial, Voice, or Recording Features Without Express Authorization (Florida FDBR)
A device or connected digital platform featuring voice recognition, facial recognition, video recording, audio recording, or visual surveillance features uses those features for the purpose of surveillance by the controller or processor when not in active use by the consumer, without express authorization as prohibited by Florida FDBR.
Legal basis: Fla. Stat. § 501.705(3) (Florida Digital Bill of Rights - Surveillance via Facial/Voice Recognition Prohibition)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
168
NJPA-001
Missing Privacy Disclosures for Children's Data (New Jersey Privacy Act)
Website targeting New Jersey consumers collects data from minors (under 18) without providing the required heightened privacy notice detailing specific processing and sharing policies.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
169
NEDP-001
Inadequate Notice of Consumer Profiling (Nebraska NDPA)
Website targeting Nebraska consumers utilizes automated decision-making or profiling for employment, finance, or housing without disclosing the profiling logic in its privacy notice.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
170
NHPA-001
Missing Direct Marketing Opt-Out Link (New Hampshire Privacy Act)
Website targeting New Hampshire consumers fails to provide an easily accessible opt-out link for targeted advertising or personal data sale on its homepage, violating the New Hampshire Privacy Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
171
GDPR-011
Inaccessible Format for Data Portability Requests (GDPR)
Website's data download tools output personal data in a proprietary or unstructured format (e.g., PDF reports) rather than a structured, commonly used, machine-readable format (e.g., JSON or CSV) as required by GDPR.
Non-Layered Privacy Policy Information Structure (GDPR)
Website displays a single, dense, unnavigable blocks-of-text privacy policy without employing a multi-layered, tabbed, or expandable design structure to ensure transparency and readability.
Missing Ad Repository and Transparency Log (EU DSA)
Online platform displaying advertisements to EU users fails to provide a publicly accessible ad library containing search filters, advertiser identities, and targeting parameters, violating DSA Article 39.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
174
DSA-003
Missing Single Point of Contact for Authorities (EU DSA)
Digital platform targeting EU users fails to publish a dedicated, easily accessible email address and communication channel for direct contact by EU authorities, violating DSA Article 11.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
175
DMA-001
Involuntary Gatekeeper Data Bundling (EU DMA)
Gatekeeper online platforms bundle personal data collected from a core platform service with data from other services without obtaining explicit, separate consent from the user, violating DMA Article 5(2).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
176
EUDAT-001
Smart Contract Access Lack of Deactivation Capability (EU Data Act)
Web panels administering smart contracts or IoT systems fail to provide mechanisms for safe, authorized deactivation and termination of smart contracts, violating EU Data Act Article 30.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
177
GDPR-013
Missing Consent Status Logging and Audit Trails (GDPR)
Website collecting personal data fails to record, log, and maintain audit trails of the exact timestamp, consent version, and user action for cookie consent agreements, violating GDPR Article 7(1).
Website runs non-essential analytics or advertising tracking scripts (e.g., Google Analytics, Meta Pixel) prior to the user interacting with the cookie consent banner, violating the ePrivacy Directive.
Lack of Operational Resilience Disclosures (EU DORA)
Website of a financial entity or critical third-party provider fails to disclose cybersecurity operational risk management frameworks and emergency contact paths, violating DORA Article 30.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
180
GDPR-014
Missing Retention Timelines in Privacy Disclosures (GDPR)
Privacy policy fails to specify concrete retention periods or criteria used to determine retention durations for distinct categories of personal data, violating GDPR transparency principles.
Data Disposal Standards Infraction (Australia Privacy Act)
Website holding personal data of Australian residents fails to implement automated scripts or schedules to permanently de-identify or destroy data that is no longer needed, violating APP 11.2.
Legal basis: Australian Privacy Act 1988, APP 11.2
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Website collecting data of Singapore residents fails to provide an easily accessible online tool or form allowing users to withdraw consent for marketing or data processing, violating Singapore PDPA.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
183
SGPD-002
Missing Data Protection Officer Visibility (Singapore PDPA)
Website targeting Singapore users fails to publish the contact information (such as a direct email address) of the designated Data Protection Officer, violating Section 20 of Singapore PDPA.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
184
DPDP-002
Missing Right to Nominate Representative Notice (India DPDP Act)
Website targeting Indian residents fails to inform users in its privacy policy of their right to nominate any other individual to act on their behalf in the event of death or incapacity, violating DPDP Act Section 14.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Website fails to support or link to authorized Consent Managers to allow Indian data principals to give, manage, review, and withdraw consent through an automated portal, violating DPDP Act Section 6(7).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
186
JPAP-002
Missing Disclosures for Handling Anonymized Data (Japan APPI)
Website utilizing anonymized data of Japanese residents fails to publish the items of personal information included in the anonymized data and the security measures taken, violating APPI Article 36.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
187
NZPR-002
Missing Contact Link for Privacy Officer (New Zealand Privacy Act)
Website collects data of New Zealand residents but fails to display contact paths for its designated Privacy Officer, violating NZ Privacy Act Section 201.
Legal basis: New Zealand Privacy Act 2020, Sec. 201
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
188
THPD-002
Missing DPO Contact Details in Consent Flows (Thailand PDPA)
Website collects personal data of Thai residents but fails to provide the contact details of the Data Protection Officer or representative in its consent banners or policies, violating Thailand PDPA Section 42.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
189
VNDP-001
Missing Local Data Protection Officer for Sensitive Data (Vietnam Decree 13)
Website collecting sensitive personal data (e.g., location, health, financial) of Vietnamese residents fails to establish a local data protection department or appoint a DPO as mandated by Decree 13.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
190
PHDP-001
Bundled Consent for Profiling and Automated Decision-Making (Philippines DPA)
Website collects data of Philippine residents and conducts automated profiling or decision-making without obtaining separate, express consent, violating the Philippines Data Privacy Act.
Legal basis: Philippines Data Privacy Act of 2012, Sec. 12
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
191
LGPD-002
Missing Data Subject Rights Portal Link (Brazil LGPD)
Website fails to display a clear, separate link on its main page allowing Brazilian residents to submit direct requests to access, correct, delete, or anonymize their personal data, violating LGPD Article 18.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
192
POPI-001
Missing Prior Authorization for Processing Credit Data (South Africa POPIA)
Website of a financial or credit evaluation service targeting South African residents processes consumer credit reports or history without prior registration or authorization, violating POPIA Section 57.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
193
SAPD-001
Missing Opt-in Consent for Direct Marketing (Saudi Arabia PDPL)
Website targeting Saudi Arabian residents sends promotional communications or tracks behavior for advertising purposes without obtaining prior explicit opt-in consent, violating PDPL Article 28.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
194
ILPA-001
Failure to Disclose Database Registration Status (Israel Privacy Act)
Website collecting personal data of Israeli residents fails to specify whether the database is registered with the Database Registrar, the registration number, and the purposes of data collection, violating Israel Privacy Act.
Legal basis: Israel Privacy Protection Act 1981, Sec. 8
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
195
DIFC-001
Missing Separate Consent for Direct Marketing (Dubai DIFC)
Website operating under DIFC jurisdiction collects personal data and bundles consent for marketing or profiling with the general terms, violating DIFC Data Protection Law Article 12.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
196
NDPA-001
Missing Cross-Border Data Transfer Disclosures (Nigeria NDPA)
Website collecting data of Nigerian residents transfers it to foreign servers (e.g., US/EU analytics engines) without disclosing the target countries and verifying adequacy, violating Nigeria Data Protection Act.
Legal basis: Nigeria Data Protection Act 2023, Sec. 42
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
197
KEDP-001
Unauthorized Cross-Border Transfer of Health Data (Kenya DPA)
Website collects sensitive health or medical records of Kenyan residents and stores them on servers located outside Kenya without obtaining explicit approval and consent, violating Kenya DPA Section 50.
Legal basis: Kenya Data Protection Act 2019, Sec. 50
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
198
EGDP-001
Lack of License for Electronic Marketing Messages (Egypt DPA)
Website targeting Egyptian users sends promotional emails or texts without obtaining the necessary electronic marketing license from the Data Protection Center, violating Egypt Law 151.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
199
MRDP-001
Unauthorized International Data Transfer (Morocco CNDP Law 09-08)
Website collects personal data of Moroccan residents and transfers it outside Morocco (evidenced by external script endpoints) without obtaining prior written authorization from the CNDP.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Website collecting personal data fails to disclose the specific administrative and technical security measures deployed to safeguard user data, violating transparency mandates under LGPD Article 46.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
201
FTCS-001
Insecure Transmission of Financial Customer Info (FTC Safeguards)
Fintech or financial portal targeting consumers transmits customer data over unencrypted channels or fails to enforce HTTPS across all login and API endpoints, violating FTC Safeguards Rule.
Financial service website failing to provide a clear, visible link to its annual Gramm-Leach-Bliley Act privacy notice on all account management or client onboarding pages, violating FTC GLBA regulations.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
203
CTAC-001
Lack of Corporate Transparency Disclosures (CTA)
Corporate website fails to mention or display required beneficial ownership reporting notices or filing confirmations as required for compliance under the Corporate Transparency Act.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
204
SEC-002
Missing Electronic Record Archiving Verification (SEC Rule 17a-4)
Broker-dealer or financial investment portal does not disclose or link to its electronic record archiving systems (WORM storage compliance), violating SEC recordkeeping regulations.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
205
DORA-003
Lack of ICT Risk Management System Disclosures (EU DORA)
Website of an EU financial entity or service fails to display cybersecurity certifications or disclosures outlining digital operational resilience mechanisms, violating DORA Article 6.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
206
FTCR-001
Missing Identity Theft Prevention Disclosures (FTC Red Flags)
Creditor or financial utility portal failing to display or link to its Identity Theft Prevention Program (ITPP) or show active identity verification steps during account sign-up, violating FTC Red Flags Rule.
Missing BrokerCheck Link and Regulatory Disclosures (FINRA)
Investment advisory or broker-dealer website fails to display a direct, prominent link to the FINRA BrokerCheck tool on its homepage and profile pages, violating FINRA Rule 2210.
Missing Subresource Integrity (SRI) on Payment Gateway (PCI-DSS v4.0)
Website embeds payment forms or scripts from external CDNs or third-party gateways without utilizing Subresource Integrity (SRI) hashes, leaving payments open to formjacking, violating PCI-DSS Req 11.6.1.
Website advertising credit or loan options states finance rates or promotional fees without prominently disclosing the Annual Percentage Rate (APR) next to the rate, violating Truth in Lending Act Z Regulation.
Website uses dark patterns to make subscription cancellation significantly harder, requiring multiple phone calls or complex navigation paths compared to the one-click signup process.
Website displays countdown timers or dynamic text claiming low stock, high demand, or limited deals that are synthetic and do not reflect real transactional metrics, deceiving consumers.
Website displays marketing or subscription opt-out options where the reject button uses emotionally manipulative language (e.g., "No thanks, I hate saving money") to discourage users from opting out.
Missing Smart Contract Auditing Disclosures on dApp (SEC Framework)
Web3 decentralized application launching tokens or NFTs fails to publish or link to external security audit certificates for its smart contracts, violating SEC transparency guidelines.
Legal basis: SEC Framework for Investment Contracts
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
215
W3CR-002
Blind Signing Vulnerability in Web3 dApp Interface (NIST SP 800-95)
Web3 application wallet integration requests raw transaction signature payloads without rendering readable transaction details (functions, targets, arguments) in the web UI, enabling blind signing.
Missing Recommender System Algorithmic Transparency (EU DSA)
Website utilizing algorithmic recommender systems (e.g., personalized feed, product suggestions) fails to explain the main parameters used in the algorithms in its terms and conditions, violating DSA.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
217
EUAI-005
Missing High-Risk AI System Logging Capability (EU AI Act)
Deployer of a high-risk AI system fails to ensure that logs generated by the system are automatically kept for at least six months to ensure traceability and auditability, violating EU AI Act.
Legal basis: Regulation (EU) 2024/1689 (EU AI Act), Art. 12
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
218
UKCR-001
Auto-Renewal Terms Without Plain Language Summary (UK CRA)
Website charging recurring subscriptions fails to provide a conspicuous, plain language summary of billing terms, price changes, and renewal dates, violating the UK Consumer Rights Act.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Privacy policy fails to detail the identities, roles, and countries of third-party SaaS processors handling user personal data, violating PIPEDA transparency guidelines.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
220
TDDD-001
Analytics Cookie Consent Bypass (Germany TDDDG)
Website targeting German users fires analytics, heatmap, or performance cookies before obtaining explicit consent, violating Section 25 of the Telecommunications Digital Services Data Protection Act.
Social Media Chat Enabled by Default for Minors (Texas SCOPE)
Social networking or platform site fails to disable direct messaging and chat features by default for users verified or suspected to be minors, violating the Texas SCOPE Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
222
UTSM-001
Missing Age Verification for Social Platforms (Utah SMRA)
Social media platform fails to verify the age of Utah residents attempting to create accounts or fails to obtain verifiable parental consent for minors, violating the Utah Social Media Regulation Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
223
FLDB-001
Missing Age Gate for Restricted Social Platform (Florida FDBR)
Social media platform accessible to minors fails to deploy an accredited, secure age-verification mechanism, violating young consumer safety provisions under the Florida Digital Bill of Rights.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
224
CTDP-002
Geofencing Around Mental Health Centers (Connecticut SB 3)
Website or app uses geofencing within 1,750 feet of any mental, reproductive, or sexual health facility to collect health-related data, violating Connecticut SB 3.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
225
VCDP-003
Missing Consent Verification for Child Sensitive Data (Virginia VCDPA)
Website collecting sensitive personal data of child consumers under 13 fails to obtain parental verification conforming to COPPA prior to data collection, violating VCDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
226
CAAD-003
Profiling Enabled by Default for Minor Accounts (CA AADC)
Website likely to be accessed by children has profiling, personalized ads, or algorithmic feeds turned on by default for accounts of minors, violating the California Age-Appropriate Design Code Act.
Website or application likely to be accessed by children fails to conduct and file a Data Protection Impact Assessment (DPIA) regarding risks to minors, violating the Maryland AADCA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
228
COPA-002
Missing Parental Consent for Child Personal Data (Colorado CPA)
Website collects or processes personal data of consumers known to be under 13 without obtaining prior verifiable parental consent, violating the Colorado Privacy Act Rules.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
229
INDP-001
Missing Opt-In Consent for Child Sensitive Data (Indiana CDPA)
Website targeting Indiana residents collects sensitive data of minors under 13 without prior affirmative opt-in consent matching COPPA requirements, violating the Indiana Consumer Data Protection Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
230
TNIP-001
Missing Privacy Policy Rights Appeals Process (Tennessee TIPA)
Website privacy notice targeting Tennessee residents fails to provide a clear description of the process to appeal a refusal to act on a privacy rights request, violating the Tennessee Information Protection Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
231
TCPA-011
Inaccessible or Delayed Email Unsubscribe Mechanism (CAN-SPAM)
Website's marketing unsubscribe link fails to process immediately, or requires more than 10 business days to remove the user from lists, violating CAN-SPAM Act rules.
Missing Valid Sender Identity and Postal Address (CAN-SPAM)
Website marketing emails do not contain a valid physical postal address of the sender or utilize misleading headers, violating federal CAN-SPAM requirements.
Missing Written Consent for Marketing Robocalls (TCPA)
Lead collection forms collect phone numbers and use them for automated marketing call campaigns without obtaining express prior written consent containing required TCPA disclosures.
Checkout page or shopping cart widget contains keyboard focus traps or cannot be operated via keyboard alone, violating European Accessibility Act requirements for e-commerce.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
235
EAA-004
Lack of Alternative Media Formats in E-Commerce (EAA)
Website showcases products via video or audio media without providing captions or audio descriptions, violating e-commerce accessibility rules under the European Accessibility Act.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
236
AODA-002
Inaccessible Document Downloads (Ontario AODA)
Website offers public document downloads (PDFs, user manuals) that do not conform to WCAG 2.0 Level AA tagging and accessibility, violating Ontario AODA Section 14.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
238
ADA-103
Inaccessible Media Players (ADA Title III)
Web media players lack accessible control labels or keyboard controls, blocking screen reader and keyboard users, violating ADA Title III requirements.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
239
EPRIV-003
Consent Bypass on Mobile Responsive Layouts (ePrivacy)
Website consent banner does not render or is hidden on mobile layouts while tracking scripts are executed, bypassing user consent, violating ePrivacy Directive.
Fake AI Testimonials and Reviews (FTC Consumer Review Rule)
Website displays customer reviews or testimonials that are AI-generated or synthetic without displaying a clear, conspicuous disclosure indicating they are not genuine consumer reviews, violating the FTC Unfair Deceptive Review Rule.
Medical booking or client communication portal incorporates third-party social media chat widgets (e.g. Facebook Messenger) that transmit patient identifiers, violating HIPAA Privacy Rule.
Unsecure Transmission of Patient Records via SMS/Email (HIPAA)
Telehealth or medical intake forms send unencrypted patient health summaries via standard email or SMS networks, violating HIPAA Security Rule standards.
Insecure Storage of Credit Card Data in LocalStorage (PCI-DSS v4.0)
Website saves primary account numbers (PAN), cardholder names, or CVVs in browser LocalStorage or SessionStorage, violating PCI-DSS data storage mandates.
Lack of Health Provider Verification for Sensitive Data (WA MHMDA)
Website collects sensitive physical/mental health data of Washington residents without verifying whether the recipient is a licensed healthcare provider, violating MHMDA.
Missing Web Portal Authentication Session Timeouts (NIST SP 800-53)
Customer portal or system panel does not automatically terminate inactive authenticated sessions after a reasonable period, violating NIST security controls.
Missing System Availability Disclosures (SOC 2 Type II)
SaaS portal fails to provide a publicly accessible status or uptime tracking page, violating SOC 2 Trust Services Criteria regarding operational availability.
SaaS website or underlying framework utilizes unsupported, end-of-life platforms without disclosing the risks to cyber underwriters, violating cyber insurance terms.
Missing Consumer Data Portability Format Option (Delaware DPDPA)
Website targeting Delaware consumers fails to provide personal data downloads in a portable, technically feasible, and readily usable format, violating Delaware's DPDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
252
MAPD-001
Sale of Sensitive Personal Data Prohibited (Maryland MODPA)
Website collects and sells sensitive personal data (e.g. precise location, health, race) of Maryland consumers, which is strictly prohibited under the Maryland Online Data Privacy Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
253
KYPD-001
Missing Consumer Right of Access Disclosure (Kentucky KCDPA)
Website targeting Kentucky residents fails to outline the clear, accessible process for consumers to confirm whether their data is processed and to access it, violating KCDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
254
RIPD-001
Failure to Disclose Third-Party Sales in Privacy Notice (Rhode Island RIDTPPA)
Website targeting Rhode Island consumers fails to explicitly list all third parties to whom personal data is sold or shared in its privacy notice, violating RIDTPPA.
Legal basis: Rhode Island RIDTPPA (SB 2502), Sec. 6
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
255
IAPD-001
Missing Consumer Right to Opt-Out of Data Sale (Iowa ICDPA)
Website targeting Iowa consumers fails to provide a clear, conspicuous link allowing users to opt-out of the sale of their personal data, violating the Iowa Consumer Data Protection Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
256
FTCH-001
Unlawful Sharing of Health Metrics with Trackers (FTC Health Breach Rule)
Website collects health, symptom, or wellness queries and shares them with third-party advertising trackers without explicit authorization, triggering FTC Health Breach Notification violations.
Missing Multi-Factor Authentication on Financial Portals (NYDFS)
Financial dashboard or client web panel under NYDFS jurisdiction fails to enforce multi-factor authentication (MFA) for all web logins, violating cybersecurity regulation 23 NYCRR Part 500.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
258
BIPA-003
Missing Written Release for Biometric Collection (Illinois BIPA)
Website collects biometric identifiers (e.g. faceprints, voiceprints) without obtaining a signed, written release from the user prior to collection, violating BIPA Section 15(b).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
259
AADA-001
Keyboard Focus Obscured by Sticky Elements (WCAG 2.2)
Website layout permits sticky headers, footers, or overlays to obscure the focus indicator of active input fields or buttons during keyboard navigation, violating WCAG 2.2 SC 2.4.11.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
260
AADA-002
Insufficient Target Size for Interactive Elements (WCAG 2.2)
Interactive target elements (buttons, links, form inputs) are smaller than 24x24 CSS pixels without sufficient spacing, violating WCAG 2.2 Level AA guidelines for touch and pointer input.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
261
EUAI-006
Missing Human Oversight Disclosures for High-Risk AI (EU AI Act)
Website deploying high-risk AI decision systems (e.g. candidate screening, credit evaluation) fails to disclose mechanisms for human oversight and intervention, violating AI Act Article 14.
Legal basis: Regulation (EU) 2024/1689 (EU AI Act), Art. 14
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
262
EUAI-007
Failure to Establish and Document Post-Market Monitoring System for High-Risk AI (EU AI Act)
A provider of a high-risk AI system fails to establish and document a post-market monitoring system in a manner proportionate to the nature of the artificial intelligence technologies and the risks of the system, or fails to maintain an actively documented post-market monitoring plan as part of technical documentation required by Art. 72 of the EU AI Act.
Legal basis: Regulation (EU) 2024/1689 (EU AI Act), Art. 72
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
263
DSA-005
Missing Non-Profiling Option for Recommender Systems (EU DSA)
Online platform utilizing recommender systems fails to provide users with at least one option that is not based on profiling (e.g. chronological feed instead of algorithmic feed), violating DSA.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
264
DSA-006
Missing Age Verification for Minor Protection (EU DSA)
Online platform accessible to minors fails to implement appropriate and proportionate age verification measures to ensure child safety online, violating DSA Article 28.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
265
NIS2-002
Missing Incident Notification and Contact Channels (NIS2)
Website of a critical infrastructure or digital service provider fails to display clear incident notification procedures or contact paths for reporting cyber incidents, violating NIS2 requirements.
Legal basis: EU Directive 2022/2555 (NIS2), Art. 21
Missing Right to Restrict Processing Action Path (GDPR)
Website fails to provide users with a direct, online mechanism (form, switch, or email path) to exercise their right to restrict processing of personal data under GDPR Article 18.
Cookie Lifespan Exceeds Maximum Limits (ePrivacy Guidelines)
Website consent mechanism sets non-essential tracking cookies with expiration periods longer than 12 months without automated consent renewal prompts, violating ePrivacy guidelines.
Legal basis: ePrivacy Guidelines on Cookies, Sec. 4
Missing Records of Processing Activities Disclosure summary (GDPR)
Website privacy notice fails to state that the company maintains records of processing activities (ROPA) and does not provide a summary for user visibility, violating GDPR Article 30.
Lack of Qualified Electronic Signatures Support (eIDAS 2.0)
Digital platform requiring signatures from EU citizens fails to recognize or support Qualified Electronic Signatures (QES) verified through European Trust Lists, violating eIDAS 2.0.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
270
GDPR-017
Missing Data Protection Impact Assessment (DPIA) Disclosures (GDPR)
Website privacy notice conducting high-risk processing (e.g. monitoring public areas or massive tracking) fails to state that a DPIA has been conducted and logged with the DPA.
Missing Right to Rectification Portal (Argentina Law 25.326)
Website collecting data of Argentine residents fails to provide a dedicated path or clear instructions to request rectification or destruction of personal data, violating Law 25.326.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
272
COPD-001
Bundled Consent for Commercial Messaging (Colombia Law 1581)
Website collects data of Colombian residents and bundles marketing communications consent with the general registration agreement, violating Habeas Data Law 1581.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
273
MXPD-001
Missing Separate ARCO Rights Actions (Mexico LFPDPPP)
Website collecting data of Mexican consumers fails to provide clear, actionable steps for users to exercise their ARCO (Access, Rectification, Cancellation, Opposition) rights, violating LFPDPPP.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
274
CHPD-001
Missing Cross-Border Transfer Disclosures (Switzerland FADP)
Website collects Swiss residents' data and transfers it internationally (e.g. via external tracking APIs) without disclosing countries and security safeguards in its privacy policy.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
275
POPI-002
Default Opt-in Marketing Violation (South Africa POPIA)
Website sends electronic direct marketing to South African residents without getting explicit prior opt-in consent or sends it to users who have never consented, violating POPIA Section 69.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
276
TRKV-002
Unauthorized Cross-Border Transfer without Adequate Safeguards (Turkey KVKK)
Website transfers personal data of Turkish residents to servers outside Turkey without obtaining explicit consent or demonstrating compliant standard contractual clauses, violating KVKK.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Privacy policy targeting Australian users lacks details on how individuals can access their personal data, seek correction, or complain about a breach of the APPs, violating APP 1.4.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
278
SGPD-003
Lack of Data Access and Correction Request Tracking System (Singapore PDPA)
Website fails to provide Singapore residents with a dedicated email or automated portal to request confirmation of their data processed within the past year, violating Singapore PDPA.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
279
THPD-003
Cross-Border Transfer to Non-Adequate Countries without Consent (Thailand PDPA)
Website transfers personal data of Thai residents to third countries that do not have adequate data protection standards without obtaining explicit consent, violating PDPA Section 28.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
280
PHDP-002
Inadequate Disclosure of Right to Object to Processing (Philippines DPA)
Website privacy notice targeting Philippines residents fails to explicitly state the user's right to object to the processing of their personal data, including for marketing purposes.
Legal basis: Philippines Data Privacy Act 2012, Sec. 16
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
281
FTCD-004
Deceptive Subscription Price Increases Without Consent (FTC)
Website implements automated subscription renewals at higher rates without notifying users and obtaining explicit consent prior to billing the updated price, violating FTC rules.
Failure to Maintain Internal Do Not Call (DNC) Registry (TCPA)
Lead capture website fails to maintain and document an internal Do Not Call (DNC) list and procedures for managing marketing contact requests, violating TCPA rules.
Unsubscribe Requests Require Fees or Logins (CAN-SPAM)
Website marketing unsubscribe links force users to log in, fill complex surveys, or pay processing fees to opt-out of emails, violating CAN-SPAM regulations.
Inaccessible Digital Invoice/Receipt Outputs for E-Commerce (EAA)
Online store generates order confirmation pages or downloadable receipts that are formatted as flat images or inaccessible PDFs, blocking screen reader access, violating EAA.
Website fails to provide an accessible online path or form specifically dedicated to receiving feedback regarding accessibility issues from disabled users, violating AODA.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
287
ADA-104
Text Scaling Breaks Page Layout at 200% (ADA Title III)
Website layout breaks, overlaps, or truncates text when browser zoom is set to 200% without assistive tech, violating WCAG 2.1 SC 1.4.4 scaling standards.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
288
ADA-105
Inability to Adjust or Extend Form Session Limits (ADA Title III)
Forms with timing restrictions (e.g. checkout ticket reservations) do not allow users to disable, adjust, or extend the limit before timeout, violating WCAG 2.1 SC 2.2.1.
Cookie consent banner and its 'Manage Settings' panel cannot be fully closed or navigated via keyboard TAB keys, rendering the website functionally non-compliant.
Unlabeled Affiliate Links and Sponsored Content (FTC Endorsement Guides)
Website displays product links earning commission or sponsored content blocks without displaying clear, immediate labels (e.g. 'Affiliate Link' or 'Sponsored') near the links.
Missing Risks Disclosure for Token Transactions in dApp (SEC)
Web3 interface facilitating token swaps or financial transactions fails to display a clear risk disclosure regarding token volatility and regulatory status on its swap panel.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
292
W3CR-004
dApp Fails to Validate API Endpoint Integrity (NIST SP 1800-34)
Decentralized web application connects to RPC nodes or APIs without verifying response signatures, allowing man-in-the-middle attacks to show false wallet balances.
Front-end Execution of Scripts from Non-Authorized Domains (PCI-DSS v4.0)
Checkout or payment interfaces load and run JavaScript files hosted on non-whitelisted domains, violating strict payment interface security rules under PCI-DSS v4.0.
Customer Portal Session Replay Scripts Enabled on Password Inputs (PCI-DSS)
Session recording tools (e.g. Hotjar, FullStory) run on customer portals without masking or excluding sensitive input fields like password, cardholder, or CVV inputs.
Missing Incident Response Plan Reference (Cyber Insurance)
SaaS system interface fails to display a mechanism for users to request security incident disclosure reports, which is required for cyber liability insurance underwriting.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
296
DORA-005
ICT Systems Major Incident Log Reporting Lack (EU DORA)
EU financial entity web console fails to provide or link to logs of major ICT related incidents for transparency to users and regulatory authorities, violating DORA Article 18.
Financial or fintech portal fails to publish or reference in its security notices that it conducts periodic risk assessments on customer data storage databases.
Inadequate Access Revocation Notification (SOC 2 Type II)
Customer console does not record logs of revoked administrative tokens or display active sessions with direct termination paths, violating SOC 2 CC6.3 security controls.
Missing Identity Verification Prior to Accessing PHI (HIPAA)
Patient intake portal or symptom tracker allows users to access historical records or Protected Health Information (PHI) without executing verified multi-step identity validation.
Missing Consumer Right to Correct Inaccurate Personal Data (Minnesota MCDPA)
Website privacy flow fails to provide Minnesota consumers with an accessible path to correct inaccuracies in their collected personal data, violating the MCDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
303
UTSM-002
Default DM Block Between Minors and Non-Parents (Utah SMRA)
Social media web application fails to block direct messaging features between minor accounts and accounts of users who are not verified parents/guardians, violating Utah SMRA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
304
FLDB-002
Failure to Disclose Search Engine Ranking Parameters and Political Partisanship Weights (Florida FDBR)
Search engine or directory platform targeting Florida residents fails to disclose the parameters used to rank search results when algorithmic filtering is active, violating FDBR.
Legal basis: Fla. Stat. § 501.71(4) (Florida Digital Bill of Rights - Search Engine Ranking Transparency)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
305
CTDP-003
Profiling, Targeted Advertising, or Sale of Data of Minors Without Consent (Connecticut SB 3)
A controller offering online services, products, or features to consumers whom the controller has actual knowledge, or wilfully disregards, are minors processes personal data for targeted advertising, sale, or profiling in furtherance of automated decisions with legal or significant effects without obtaining prior consent as required by Connecticut SB 3.
Legal basis: CT Public Act No. 23-56 (SB 3), Sec. 9(b)(1)(A)(i) and (b)(3)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
306
CAAD-004
Non-Obvious Interactive Dark Patterns Targeting Children (CA AADC)
Website likely to be accessed by minors uses deceptive game mechanics or styling to nudge children into spending money or disclosing email addresses, violating AADC.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
307
MDAD-002
Default Tracking Active for Children (Maryland MODPA)
Online service targeting Maryland residents fails to deactivate behavioral trackers by default for users identified as under 18 years old, violating MODPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
308
INDP-002
Lack of Sensitive Data Processing Disclosures (Indiana CDPA)
Privacy notice targeting Indiana residents fails to explicitly state the categories of sensitive personal data processed and the specific purposes, violating the CDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
309
TNIP-002
Inadequate Response Time for Data Rights Requests (Tennessee TIPA)
Website privacy workflow fails to guarantee and execute response to consumer privacy rights requests within the mandated 45-day window, violating TIPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
310
NHPA-002
Missing Right to Deletion Actions for New Hampshire Consumers (NHPA)
Website fails to provide New Hampshire residents with a clear, automated method to delete personal data collected, violating the New Hampshire Privacy Act.
Legal basis: New Hampshire Privacy Act, Sec. 507-H.4
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
311
AADA-003
Redundant Data Entry Required in Multi-step Forms (WCAG 2.2)
Multi-step registration or checkout forms require users to re-enter previously provided information in the same session without offering auto-fill, violating WCAG 2.2 SC 3.3.7.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
313
AADA-005
Inconsistent Location of Help and Support Contacts (WCAG 2.2)
Website displays support contacts, chats, or FAQ paths in different locations on different pages (e.g. top right on homepage, bottom left on checkout), violating WCAG 2.2 SC 3.2.6.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
316
AADA-008
Text Spacing Adjustments Lead to Overlapping Text (WCAG 2.1)
Custom client-side font spacing adjustments (line height, letter spacing) cause page text elements to overlap or truncate, violating WCAG 2.1 SC 1.4.12.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
317
AADA-009
Unstoppable Auto-playing Media and Carousels (WCAG 2.1)
Website includes auto-playing sliders, banners, or video background media that cannot be paused, stopped, or hidden by the user, violating WCAG 2.1 SC 2.2.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
318
AADA-010
Missing Input Placeholders or Context Clues (WCAG 2.1)
Form inputs requiring specific formats (e.g. dates, phone numbers) do not provide placeholders, description hints, or context instructions, violating WCAG 2.1 SC 3.3.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
319
AADA-011
Status Messages Not Announced by Screen Readers (WCAG 2.1)
Dynamic status updates (e.g. 'Saved successfully' notifications or inline validation messages) appear in DOM without `role="status"` or `aria-live="polite"`, hiding them from screen readers.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
320
AADA-012
Illogical Tab Navigation Order (WCAG 2.1)
Keyboard navigation focus path traverses the page in an illogical or random order, failing to match visual reading layouts, violating WCAG 2.1 SC 2.4.3.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
321
GDPR-018
Encryption Standards for Collected Data Not Disclosed (GDPR)
Website privacy notice collects sensitive personal data but fails to state the encryption methods (e.g. AES-256) used during storage and transport, violating GDPR Article 32.
Missing Adequacy Decision Disclosures for External Transfers (GDPR)
Privacy notice transfers data outside the EEA but fails to disclose whether destination countries are subject to an EC adequacy decision or state the specific safeguards deployed.
Lack of Data Breach Mitigation Instructions for Users (GDPR)
Website fails to display instructions, direct email forms, or contact details explaining how users will be notified and what actions they should take during a personal data breach.
Missing Disclosures for Third-Party Data Transfer and Processing (Canada PIPEDA)
An organization collecting personal data transfers information to third parties for processing but fails to remain accountable or disclose in its privacy policy that data is transferred to third-party processors and protected through comparable contractual or other safeguards as required by PIPEDA.
Legal basis: PIPEDA Schedule 1, Principle 4.1.3 / Principle 4.8 (Accountability / Openness for third-party transfer and processing)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
325
PIPD-004
Missing Data Access Request Processing Costs Notice (Canada PIPEDA)
Website privacy notice targeting Canadian residents fails to state whether there are processing costs associated with formal personal data access requests, violating PIPEDA.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
326
JPAP-003
Failure to Disclose Purposes of Shared Cookie Identifiers (Japan APPI)
Website targeting Japanese users shares third-party advertising identifiers or cookies without disclosing the exact advertising and analytical purposes of the recipients in its cookie statement.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
327
NZPR-003
Unlawful Retention of Personal Data Beyond Needed Duration (New Zealand Privacy Act IPP 9)
Website targeting New Zealand residents lacks automated policies or disclosures specifying that personal data will not be kept for longer than is required for lawful purposes, violating IPP 9.
Legal basis: New Zealand Privacy Act 2020, IPP 9 (Information Privacy Principle 9 - Retention of personal information)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
328
THPD-004
Inadequate Disclosure of Right to Request Data Deletion (Thailand PDPA)
Website targeting Thai users has a privacy policy that does not state the consumer's right to request erasure, destruction, or de-identification of their personal data under the PDPA.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
329
PHDP-003
Failure to Disclose Procedures for Filing Complaints with DPA (Philippines DPA)
Website privacy policy targeting Philippines consumers fails to explain how users can file a formal complaint regarding data breaches with the National Privacy Commission (NPC).
Legal basis: Philippines Data Privacy Act 2012, Sec. 34
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
330
LGPD-004
Privacy Policy Updates Not Prominently Notified (Brazil LGPD)
Website makes significant changes to processing methods or privacy policies without notifying Brazilian users through clear site alerts or emails, violating LGPD Article 9.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
331
GLBA-003
Missing Consumer Right to Opt-Out of Sharing with Non-Affiliates (GLBA)
Fintech or financial dashboard under GLBA jurisdiction fails to provide users with an opt-out path before sharing nonpublic personal info with non-affiliated third parties.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
332
SEC-003
Missing Administrative Policies Safeguarding Customer Information Disclosures (SEC)
Website of a SEC-registered investment advisor fails to display or link to policies outlining physical and technical safeguards for client records, violating Regulation S-P.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
333
PCI-017
Inventory of External Software Components Missing (PCI-DSS v4.0)
Website payment flow uses external software libraries, frames, or scripts without maintaining an active, documented inventory of all software components, violating PCI-DSS Req 6.3.2.
Failure to Document Cryptographic Key Management (PCI-DSS v4.0)
Website handling cardholder transactions fails to document or publish summaries of cryptographical algorithms and key management procedures used to encrypt card data.
Lack of Vulnerability Disclosure Program Notice (Cyber Insurance)
Corporate website fails to publish a Vulnerability Disclosure Program (VDP) or safe harbor policy for white-hat security researchers, which is required for cyber insurance compliance.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
336
DORA-006
Lack of Third-Party ICT Provider Criticality Level Disclosures (EU DORA)
Web dashboard of a financial system does not list or categorise the criticality levels of its third-party cloud and infrastructure providers, violating DORA transparency rules.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
337
FTCS-004
Missing Employee Security Training Reference (FTC Safeguards)
Financial dashboard privacy notice fails to state that the company conducts annual employee security training regarding consumer data protection, violating the FTC Safeguards Rule.
Inadequate Patch Management Disclosures (SOC 2 Type II)
Customer-facing SaaS portal fails to reference or document patch management timelines and procedures for resolving known system vulnerabilities, violating SOC 2 CC7.1.
Lack of Web Traffic and Intrusion Monitoring Disclosures (NIST SP 800-53)
Security notice of a digital platform does not state whether it employs active intrusion detection or web application firewalls (WAF) to monitor incoming network traffic, violating NIST SI-4.
Patient onboarding application fails to confirm in its privacy policy that it conducts periodic risk analyses to assess potential security vulnerabilities to PHI, violating HIPAA Security Rule.
Profiling Children for Targeted Ads (Maryland MODPA)
Website targeting Maryland consumers enables targeted advertising profiling on accounts of users known to be under 18 years old, violating the Online Data Privacy Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
342
TXSC-003
Collection of Minor Location History Without Parent Verification (Texas SCOPE)
Web application collects and maintains historical location tracking records of users verified or suspected to be minors without obtaining verified parental consent, violating SCOPE.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
343
UTSM-003
Algorithmic Recommendations to Minors (Utah SMRA)
Social media platform targeting Utah minors utilizes predictive algorithms or personalized recommendations on minor accounts without verified parental consent, violating SMRA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
344
FLDB-003
Missing Opt-Out Disclosure for Personal Data Sales and Targeted Ads (Florida FDBR)
A controller meeting Florida FDBR applicability thresholds (including annual global gross revenues exceeding $1 billion) that sells personal data to third parties or processes personal data for targeted advertising fails to clearly and conspicuously disclose that process and provide a manner for consumers to opt out.
Legal basis: Fla. Stat. § 501.711(4) (Florida Digital Bill of Rights - Sale of Personal Data / Targeted Advertising Opt-Out Disclosure)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
345
CTDP-004
Geolocation Data Selling Without Consent (Connecticut SB 3)
Website targeting Connecticut consumers sells precise geolocation coordinates collected from mobile or web interfaces without obtaining prior explicit opt-in consent.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
346
CAAD-005
Absence of Child Safety Impact Assessment Rationale Disclosures (CA AADC)
Website likely to be accessed by minors fails to detail in its privacy notice the security safeguards implemented based on child data impact assessments, violating AADC.
Website selling or sharing biometric data (e.g. voice templates, face recognition markers) of Illinois residents for commercial profit, which is strictly prohibited under BIPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
348
HIPAA-015
Inadequate De-identification of Patient Research Records (HIPAA Privacy)
Health portal publishes clinical summaries or symptom databases containing zip codes or exact birth dates, failing to meet strict Safe Harbor de-identification rules under HIPAA.
Financial dashboard fails to disclose that its contracts with critical ICT providers contain mandatory security and data portability clauses, violating DORA Article 30.2.
Fintech portal fails to reference or display in its security disclosures a summary of its written Incident Response Plan (IRP) for customer data breaches, violating FTC Safeguards.
The website's keyboard focus indicator lacks the minimum area or contrast against adjacent colors, making it difficult for keyboard-only users to see which element is active, violating WCAG 2.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
352
ADA-107
Focus Obscured by Sticky Elements
Interactive elements focused via keyboard are fully or partially covered by sticky headers, footers, or floating overlays, preventing screen visibility, violating WCAG 2.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
354
ADA-109
Sub-Minimum Interactive Target Size
Interactive targets (buttons, links) are smaller than 24x24 CSS pixels without sufficient spacing, causing mis-clicks for touch and motor-impaired users, violating WCAG 2.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
355
ADA-110
Redundant Form Data Entry Requirement
Forms require users to re-enter information previously submitted in the same session instead of auto-populating or providing selection options, violating WCAG 2.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
357
ADA-112
Focus Obscured (Enhanced Level)
Interactive elements are fully visible when focused, without any overlap from layouts under stricter accessibility audits, violating WCAG 2.2 AAA standards.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
359
ADA-114
Missing Accessible Video Transcripts
Embedded videos with educational or commercial info lack synchronized or linked full text transcripts, creating barriers for deaf-blind users, violating ADA Title III.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
360
ADA-115
Missing Captions for Pre-recorded Media
Marketing or product preview videos fail to offer accurate closed captions (CC), blocking access for deaf or hard-of-hearing site visitors, violating ADA Title III.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
361
HIPAA-016
Insecure Patient Appointment Forms
Online booking interfaces pass Protected Health Information (PHI) like medical conditions or physician names within unencrypted URL parameters, violating HIPAA Security standards.
Patient schedule systems execute analytics or advertising trackers (e.g. Meta Pixel) without obtaining explicit, signed HIPAA authorizations from patients, leading to massive regulatory fines.
Health portal database fails to log viewer identity, timestamp, and actions when sensitive patient records or lab results are loaded, violating HIPAA Security Rule auditing requirements.
The Notice of Privacy Practices (NPP) hosted on a medical clinic's website fails to prominently display its effective date, violating HIPAA Privacy Rule disclosure mandates.
Health portal fails to honor consumer deletion requests for collected non-HIPAA health tracking details within the statutory 30-day window under Washington My Health My Data Act.
A health-tracking website collects wellness indices or condition queries from Washington consumers without obtaining a separate, explicit opt-in consent banner, violating MHMDA.
Portal file uploads for prescriptions or doctor notes are placed in public cloud directories or accessible via easily guessable URLs, violating HIPAA security standards.
Electronic medical portal sessions remain active indefinitely after user inactivity, exposing patient charts to unauthorized physical access, violating HIPAA Security Rule protocols.
Medical clinic staff access patient portal backends using a shared generic login ID, making audits of record alterations impossible, violating HIPAA's Unique User requirement.
The required 'Do Not Sell or Share My Personal Information' option is formatted in a way that is hard to click or styled to look inactive compared to the accept buttons, violating CCPA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
372
CCPA-012
Lack of Global Privacy Control (GPC) Verification Logs
The website's consent manager fails to maintain internal logs showing that user GPC signals were honored and processing scripts deactivated, violating California CPPA audit readiness.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
373
CCPA-013
Missing Notice of Financial Incentive
E-commerce popups offer discounts in exchange for newsletter signup (email collection) without providing a linked, detailed Notice of Financial Incentive, violating CCPA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
374
CCPA-014
Non-Compliant Employee & Applicant Privacy Notice
Job application forms and internal intranet portals lack a detailed privacy disclosure specifically outlining how employee and applicant personal data is handled under CPRA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
375
CCPA-015
Missing Sensitive Data Retention Periods
Privacy policy fails to state the specific retention period (or criteria used to determine it) for each category of collected sensitive personal information, violating California Civ. Code.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
376
CCPA-016
Lack of Portal for Right to Correct
User account cabinet fails to offer a clear, self-service interface or form allowing California consumers to correct inaccurate personal data on record, violating CPRA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
377
CCPA-017
Implicit Sensitive Geolocation Tracking
The web app tracks precise coordinates within a 1,850-foot radius without presenting a clear prompt to restrict the use of sensitive personal information, violating CCPA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
378
CCPA-018
Incomplete Authorized Agent Procedural Disclosure
The privacy policy fails to explain verification procedures and forms required when a consumer exercises rights via a third-party authorized agent, violating CCPA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
379
CCPA-019
Missing Privacy Request Annual Metrics
Businesses processing personal details of 10,000,000+ California consumers fail to compile and publish annual statistics of received and handled requests, violating CCPA regulations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
381
FTC-011
Subscription Deceptive Auto-Renewal Obstacles
Web checkout enrolls users in recurring billing but fails to offer an easy, client-side button to cancel online, violating ROSCA and FTC enforcement guidelines.
E-commerce checkout renders countdown timers claiming 'offer expires soon' that reset automatically on page reload, classified by the FTC as deceptive dark patterns.
Product landing pages display customer reviews hardcoded in JavaScript bundles with randomized dates to appear recent, violating the FTC rule on deceptive reviews.
Online payment flows conceal service fees, transaction surcharges, or hidden admin costs until the final transaction confirmation screen, violating FTC Section 5 standards.
Lack of Multi-Factor Authentication for Financial Portals
Web consoles providing access to consumer credit information fail to mandate Multi-Factor Authentication (MFA) for internal staff access, violating the FTC Safeguards Rule.
Portals aimed at children collect data using simple checkboxes or unverified email returns for parental approval instead of statutory verification methods under COPPA rules.
Non-HIPAA wellness platforms transmit condition searches, queries, or selections to advertising networks via trackers, violating the FTC Health Breach Notification Rule.
E-commerce blog posts or reviews that contain paid affiliate links fail to display clear and conspicuous disclosure labels (like 'Sponsored'), violating FTC endorsement rules.
Registration forms pre-check checkboxes subscribing consumers to promotional SMS messages, violating TCPA requirements for prior express written consent.
Lead forms collecting telephone numbers lack clear statutory language specifying that 'Message and data rates may apply' and listing sending frequency, violating TCPA guidelines.
Automated text campaign integrations fail to recognize and process standard opt-out keyword replies (such as STOP, CANCEL, or UNSUBSCRIBE), violating TCPA.
Marketing emails dispatched automatically by portal registrations fail to display the organization's valid physical street address, violating CAN-SPAM.
Unsubscribe links inside system notification emails lead to broken server paths or force users to log in before processing requests, violating CAN-SPAM regulations.
Database systems fail to remove unsubscribed emails from active promotional lists within the statutory 10-business-day window, violating CAN-SPAM rules.
Robocalls and Automatic Texting Without Written Consent
Web landing pages collect telephone contacts for automated dialing systems without obtaining prior express written signatures of Florida consumers, violating Florida FTSA.
Telemarketing databases fail to preserve records of consumer Do Not Call (DNC) requests for the statutory minimum of five years from the date of submission, violating TCPA.
The website sets non-essential analytics or advertising cookies before receiving active, affirmative consent from the EU visitor, violating ePrivacy and GDPR.
The cookie banner uses design tricks to hide the 'Reject' button or forces the visitor to open submenus to reject tracking while allowing single-click acceptance, violating GDPR.
The website's privacy disclosure fails to display the official contact details of the designated Data Protection Officer (DPO) under GDPR requirements.
Data forms collect European personal inputs but fail to verify and link Data Processing Agreements (DPA) completed with cloud hosts and backend subprocessors, violating GDPR Art 28.
The platform fails to provide a secure, authenticated pathway for processing Subject Access Requests (SAR), risking accidental disclosure of personal records, violating GDPR.
Portal support systems refuse or delay consumer 'Right to be Forgotten' requests without valid statutory justifications, violating GDPR Article 17 requirements.
User profile dashboards default to sharing personal profiles, location files, or usage histories with other users or partners upon registration, violating Privacy by Default rules.
Website contact forms transmit personal user messages and identifiers over unencrypted HTTP channels instead of secure HTTPS, violating GDPR security of processing requirements.
Legal basis: GDPR Art. 32 / Security of Processing
Web applications tracking large-scale behavioral data fail to complete and record a Data Protection Impact Assessment (DPIA), violating GDPR requirements.
User records are transmitted to servers located in third-party countries (lacking adequacy decisions) without established Standard Contractual Clauses (SCCs) in place, violating GDPR.
The e-commerce payment server accepts TLS 1.0 or TLS 1.1 connections containing insecure ciphers, failing PCI requirements for data encryption in transit.
The system backend or connected merchant dashboards run default manufacturer passwords or standard administrator logins, violating PCI secure deployment protocols.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
422
STATE-012
Virginia VCDPA Rights Appeal Escalation
Privacy policy fails to outline a clear process for consumers to appeal a refusal to act on data rights requests, violating Virginia VCDPA regulations.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
424
STATE-014
Delaware DPDPA Non-Consensual Health Transfers
Consumer health databases transmit search queries for off-label health diagnostics to third-party ad brokers without explicit consent, violating Delaware DPDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
425
STATE-015
Oregon OCPA Incomplete Third-Party Listing
Privacy policy discloses general categories of processors instead of listing the specific legal names of third parties receiving user records, violating Oregon OCPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
426
STATE-016
New Jersey NJPA Sensitive Selling Disclosures
The portal sells New Jersey consumer records containing sensitive info without showing a clear notice and obtaining opt-in consent, violating NJPA directives.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
437
FIN-017
DORA Third-Party Risk Registers Exclusions
Financial applications link to external APIs or services without preserving a consolidated register of third-party ICT providers and security certifications, violating DORA.
Consumer banking portals omit clear instructions on yearly opt-out options regarding sharing non-public personal information with affiliates, violating GLBA rules.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
439
FIN-019
FINRA Rule 4511 Non-WORM Log Format
Broker trading systems record transactions and customer communication logs in standard databases instead of write-once-read-many (WORM) storage, violating FINRA.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
440
FIN-020
CFTC Rule 1.31 Electronic History Deletions
Trading portals fail to configure electronic recordkeepings to enforce a strict five-year retention policy for financial logs and confirmations, violating CFTC Rule 1.31.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
441
OPS-011
AI Sentiment Analysis Warnings Missing
AI-powered customer service chatbots use emotion-detection or sentiment analysis algorithms on user message inputs without displaying clear warnings, violating EU AI Act.
Legal basis: Regulation (EU) 2024/1689 (EU AI Act), Art. 50(3)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
442
OPS-012
Prohibited AI Biometric Categorization Systems
Online user onboarding interfaces categorize users based on biometrics derived from uploaded facial photos without explicit, statutory legal grounds, violating EU AI Act.
Legal basis: Regulation (EU) 2024/1689 (EU AI Act), Art. 5(1)(g)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
443
OPS-013
Missing AI Image & Text Metadata Watermarks
Gen-AI interfaces outputting images or texts fail to embed standard metadata watermarks showing the content is AI-generated, violating EU AI Act mandates.
Legal basis: Regulation (EU) 2024/1689 (EU AI Act), Art. 50(2)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
444
OPS-014
EU DSA Algorithmic Feed Disclosures
Social feeds or content portals fail to disclose the primary parameters and ranking criteria used by their recommender systems, violating Digital Services Act rules.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
445
OPS-015
EU DSA Missing Advertisements Repository
Large publishing platforms fail to host a public, searchable repository displaying active ads, sponsoring names, and target metrics, violating Digital Services Act.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
446
OPS-016
Lack of Shadow Banning Redress Portal
Community portals restricting user content (shadow banning) fail to notify authors and offer a clear internal complaint handling portal, violating Digital Services Act.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
447
OPS-017
Failing to Accept eIDAS 2.0 Wallets
Identity-gated platforms fail to integrate mechanisms accepting official European Digital Identity Wallets for verification, violating eIDAS 2.0 mandates.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
448
OPS-018
Missing CRA Vulnerability Reporting Gateway
Digital hardware or software portals fail to provide a conspicuous, functional interface to report security vulnerabilities, violating the Cyber Resilience Act.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
449
OPS-019
Missing DPO ANPD Registry for Brazilian Portals
Brazilian-facing portals collect customer information but fail to publish and register their designated DPO details with the national ANPD authority, violating LGPD.
Legal basis: Lei Geral de Proteção de Dados (LGPD), Art. 41
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
450
OPS-020
Lack of Guardian Consent Verification for India DPDP
Portals collecting data of Indian citizens under the age of 18 fail to implement verified parental or guardian consent structures, violating Digital Personal Data Protection Act.
Legal basis: Digital Personal Data Protection Act (DPDP Act), Sec. 9
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
451
UAEPD-001
Lack of Explicit Consent for Cross-Border Data Transfers
The website transfers personal data of UAE residents to servers outside the UAE without obtaining explicit consent or demonstrating adequacy measures, violating UAE Federal Decree-Law No. 45.
Legal basis: UAE Federal Decree-Law No. 45 of 2021, Art. 22
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
452
UAEPD-002
Missing Local Data Protection Officer (DPO) Contact Details
The website targeting UAE consumers fails to designate and publish contact details of a localized DPO when processing high-volume personal details, violating UAE PDPL.
Legal basis: UAE Federal Decree-Law No. 45 of 2021, Art. 10
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
453
UAEPD-003
Non-Compliant UAE Child Consent Flow
The portal collects personal details of children in the UAE without verifying parental or guardian consent structures, violating UAE child protection laws.
Legal basis: UAE Federal Decree-Law No. 45 of 2021, Art. 6
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
454
UAEPD-004
Failure to Maintain UAE Data Processing Registers
The organization's backend fails to document and maintain a record of personal data processing activities (ROPA) for UAE-facing operations, violating UAE PDPL requirements.
Legal basis: UAE Federal Decree-Law No. 45 of 2021, Art. 11
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
455
UAEPD-005
Inadequate Data Breach Notification Timelines for UAE
The website's terms and security policy fail to commit to notifying the UAE Data Office immediately of any security breach that threatens data privacy.
Legal basis: UAE Federal Decree-Law No. 45 of 2021, Art. 9
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
456
UAEPD-006
Lack of Direct Opt-Out for Marketing Profiling in UAE
The client cabinet fails to provide a clear, one-click mechanism for UAE users to opt out of automated decisions and marketing profiling, violating UAE PDPL.
Legal basis: UAE Federal Decree-Law No. 45 of 2021, Art. 18
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
457
SDPD-001
Missing Registration on Saudi National Data Portal
Organizations processing Saudi personal records fail to register their databases with the Saudi Data and Artificial Intelligence Authority (SDAIA) portal, violating KSA PDPL.
Legal basis: Saudi Arabia Personal Data Protection Law (PDPL) 2021, Art. 32
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
458
SDPD-002
Lack of Explicit Consent for Direct Marketing in KSA
Marketing subscription forms targeting Saudi consumers fail to obtain separate, explicit consent before dispatching promotional offers, violating Saudi PDPL.
Legal basis: Saudi Arabia Personal Data Protection Law (PDPL) 2021, Art. 28
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
459
SDPD-003
Illegal Storage of Sensitive Personal Data Outside KSA
Websites transferring health or sensitive financial records of Saudi nationals to cloud servers outside the Kingdom fail to secure statutory SDAIA authorization, committing a major violation.
Legal basis: Saudi Arabia Personal Data Protection Law (PDPL) 2021, Art. 29
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
460
SDPD-004
Failure to Disclose Processing Purpose to KSA Consumers
The privacy policy fails to explicitly link data collection fields to the specific, lawful purposes of processing required for compliance in Saudi Arabia.
Legal basis: Saudi Arabia Personal Data Protection Law (PDPL) 2021, Art. 5
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
461
SDPD-005
Non-Compliant Data Erasure Response Timeframe in KSA
The customer support portal fails to process and confirm personal data deletion requests submitted by Saudi residents within the statutory timeframes under KSA regulations.
Legal basis: Saudi Arabia Personal Data Protection Law (PDPL) 2021, Art. 21
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
462
SDPD-006
Lack of Explicit Opt-In for Tracking KSA Citizens
The website executes behavioral trackers or analytics scripts targeting KSA visitors before obtaining explicit, active opt-in consent, violating Saudi PDPL.
Legal basis: Saudi Arabia Personal Data Protection Law (PDPL) 2021, Art. 17
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
463
ILPA-002
Missing Database Registration under Israeli Law
The platform processes personal information of Israeli citizens in databases containing over 10,000 individuals without statutory registration, violating the Israeli Privacy Act.
Legal basis: Israel Privacy Protection Act 5741-1981, Sec. 8
Failure to Disclose Duty of Delivery under Israeli Law
Web forms fail to explicitly notify Israeli consumers whether they are legally obligated to provide personal details or if it is voluntary, violating the Israeli Privacy Protection Act.
Legal basis: Israel Privacy Protection Act 5741-1981, Sec. 11
Non-Compliant Cross-Border Data Transfers from Israel
User databases transfer Israeli records to third countries that fail to ensure equal privacy protections without meeting statutory exceptions under Israeli transfer regulations.
Legal basis: Israel Privacy Protection Regulations (Transfer of Data to Databases Abroad) 5761-2001
Lack of Data Security Audits under Israeli Regulations
The enterprise processing Israeli user records fails to perform and log annual, independent security audits of database processing infrastructure, violating Israeli regulations.
Legal basis: Israel Privacy Protection Regulations (Data Security) 5777-2017
Illegal Direct Mailing Advertising without Registration in Israel
The e-commerce site sends automated marketing emails to Israeli citizens based on character profiling without registering the target database for direct mailing, violating Israeli law.
Legal basis: Israel Privacy Protection Act 5741-1981, Sec. 17C
Missing Explicit Consent for Cookie Tracking in Turkey
Cookie consent managers fail to block analytical or advertising scripts for Turkish visitors before obtaining explicit, active opt-in consent, violating Turkey's KVKK guidelines.
Legal basis: Turkey Law on Protection of Personal Data (KVKK) No. 6698, Art. 5
Missing Registration on Turkish VERBIS Database Registry
Foreign companies processing personal data of Turkish residents above statutory thresholds fail to register with the Data Controllers Registry (VERBIS), violating KVKK rules.
Legal basis: Turkey Law on Protection of Personal Data (KVKK) No. 6698, Art. 16
Inadequate Data Breach Reporting Windows for Turkey
The security incident protocol fails to mandate reporting data breaches to the Turkish Personal Data Protection Board (KVKK) within the statutory 72-hour window.
Web forms fail to present Turkish consumers with a dedicated 'Clarification Text' (Aydınlatma Metni) outlining rights and processing channels as separate from general policies, violating KVKK.
Legal basis: Turkey Law on Protection of Personal Data (KVKK) No. 6698, Art. 10
Illegal Cross-Border Transfers without Turkish Board Consent
Website database hosting routes personal records of Turkish users to servers outside Turkey without obtaining explicit consent or demonstrating standard undertaking protocols, violating KVKK.
Legal basis: Turkey Law on Protection of Personal Data (KVKK) No. 6698, Art. 9
Lack of Explicit Disclosures for Automated Decisions in Switzerland
The website deploys automated user scoring or decision systems targeting Swiss residents without displaying clear disclosures and offering human review interfaces, violating Swiss FADP.
Legal basis: Swiss Federal Act on Data Protection (FADP) 2023, Art. 21
Missing Representative for Foreign Controllers in Switzerland
Foreign organisations processing high volumes of Swiss consumer records fail to designate a localized representative in Switzerland, violating Swiss FADP.
Legal basis: Swiss Federal Act on Data Protection (FADP) 2023, Art. 14
Failure to Disclose Swiss Processing Register entries
Corporate systems failing to maintain a record of processing activities (ROPA) under Swiss standards face regulatory compliance liabilities under the revised FADP.
Legal basis: Swiss Federal Act on Data Protection (FADP) 2023, Art. 12
Inadequate Data Transfer Exclusions for Switzerland
Website database backups transfer Swiss personal files to servers in non-adequate countries without implementing verified contractual clauses, violating Swiss FADP.
Legal basis: Swiss Federal Act on Data Protection (FADP) 2023, Art. 16
Forms collecting sensitive details (e.g. religious views, political opinions, union statuses) from Swiss nationals fail to obtain active, explicit consent, violating FADP.
Legal basis: Swiss Federal Act on Data Protection (FADP) 2023, Art. 6
Lack of Swiss Data Breach Reporting (Rapid Windows)
System incident logs fail to support rapid notification to the Federal Data Protection and Information Commissioner (FDPIC) of any data breach resulting in high risk to Swiss users, violating FADP.
Legal basis: Swiss Federal Act on Data Protection (FADP) 2023, Art. 24
Website database services transfer UK user records to international servers without implementing the mandatory UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs.
Legal basis: UK Data Protection Act 2018 / UK GDPR
Foreign companies processing personal data of UK citizens fail to register and pay the data protection fee to the UK Information Commissioner's Office (ICO), violating UK laws.
Legal basis: UK Data Protection (Charges and Information) Regulations 2018
Foreign companies targeting UK customers fail to designate and publish a UK representative to act on behalf of the controller under UK GDPR requirements.
Non-Compliant Children's Data Processing under UK Age-Appropriate Code
The website targeting UK users collects information from children under 18 without establishing a high level of privacy by default, violating the UK Children's Code.
Legal basis: UK Age-Appropriate Design Code (Children's Code)
Lack of Age Verification Mechanisms for Harmful Content (UK OSA)
Content portals displaying user-generated media fail to deploy robust age-assurance verification procedures to restrict minors from accessing harmful files, violating UK OSA.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
484
UKOSA-003
Missing UK Online Safety Reporting Channels
Websites offering interactive user communication fail to display a prominent, functional portal allowing UK users to report illegal or harmful content, violating Online Safety mandates.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
485
AUSPA-001
Failure to Honor Australia Privacy Act Erasure Requests
The support system fails to provide a dedicated, statutory channel for Australian citizens to request destruction or de-identification of personal records, violating APPs.
Legal basis: Australia Privacy Act 1988 - Australian Privacy Principles (APPs)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
486
AUSPA-002
Non-Compliant Cross-Border Disclosures for Australia
Personal records of Australian citizens are transferred to international hosting targets without establishing reasonable steps to ensure recipient compliance, violating APP 8.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
487
AUSPA-003
Lack of Explicit Opt-In for Marketing Cookies in Australia
The e-commerce site executes tracking pixels for targeted advertising to Australian users before obtaining explicit, active opt-in consent, violating recent Privacy Act reforms.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
488
AUSPA-004
Missing Australia Privacy Policy Disclosure of Third Party Hosting Locations
The privacy policy fails to explicitly disclose the list of countries where personal records are likely to be disclosed or hosted, violating Australian APP 1.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
489
AUSPA-005
Australia Spam Act Opt-Out Violation
The email marketing infrastructure continues sending promotional messages to Australian citizens past the statutory 5-business-day processing window after unsubscribing, violating the Spam Act.
Illegal Direct Marketing without Opt-Out under APP 7
The website promotes services to Australian consumers using personal profiles without providing a prominent, free opt-out mechanism in every marketing context, violating APP 7.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
491
AUSPA-007
Lack of Data Quality Verifications for Australian Records
The database fails to run automated verification checks to ensure personal data collected from Australian residents remains accurate, complete, and up-to-date, violating APP 10.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
492
NZPR-004
Failure to Disclose NZ Privacy Officer Details
Websites processing personal details of New Zealand citizens fail to designate and publish the contact information of a statutory Privacy Officer, violating NZ Privacy Act.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
493
NZPR-005
Lack of Immediate Breach Notification for New Zealand
Security systems fail to support rapid notification to the NZ Privacy Commissioner of any data breach likely to cause serious harm to New Zealand residents, violating the Privacy Act.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
494
NZPR-006
Missing NZ Consumer Access Portal (IPP 6)
The account dashboard fails to offer New Zealand users a clear path to access and download a complete copy of all personal files stored on record, violating IPP 6.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
495
NZPR-007
Illegal Storage of NZ Records in Non-Adequate Jurisdictions (IPP 12)
Personal records of NZ consumers are stored on cloud server locations abroad that fail to guarantee protection comparable to New Zealand's laws, violating IPP 12.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
496
NZPR-008
Collection of Excessive Personal Data from NZ Residents
Online forms demand unnecessary personal details from NZ residents that are not directly required for the business transaction, violating New Zealand IPP 1.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
497
SGPD-004
Lack of Mandatory DPO Contact Disclosures in Singapore
The website targeting Singaporean users fails to list the business address or email of its designated Data Protection Officer (DPO) in its privacy page, violating PDPA.
Legal basis: Singapore Personal Data Protection Act (PDPA) 2012, Sec. 11
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
498
SGPD-005
Failure to Document Deemed Consent Rules for Singapore
The portal processes user data under Singapore's 'deemed consent by notification' rules without conducting a prior Assessment of Impact or documenting notification structures.
Legal basis: Singapore Personal Data Protection Act (PDPA) 2012 Amendments
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
499
SGPD-006
Non-Compliant Data Portability Actions under Singapore PDPA
Customer dashboards processing Singaporean data fail to offer automated data portability transmission pathways for user profiles upon requested exports, violating PDPA.
Legal basis: Singapore Personal Data Protection Act (PDPA) 2012 Portability Provisions
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Incident response protocols fail to mandate notifying the Singapore PDPC within 3 calendar days of identifying a reportable data breach, violating statutory timelines.
Legal basis: Singapore Personal Data Protection Act (PDPA) 2012, Sec. 26D
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
501
SGPD-008
Singapore Do Not Call (DNC) Registry Violations
Telemarketing integrations dispatch promotional calls or texts to Singapore phone numbers without validating records against the national DNC Registry, violating Singapore PDPA.
Legal basis: Singapore Personal Data Protection Act (PDPA) 2012 - DNC Provisions
Lack of Dual-Language Privacy Notice under Malaysian PDPA
The website targeting Malaysian users fails to present its privacy policy in both national languages (Malay and English), violating explicit Malaysian PDPA requirements.
Legal basis: Malaysia Personal Data Protection Act (PDPA) 2010, Sec. 7(3)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
503
MYPD-002
Illegal Cross-Border Transfers under Malaysian PDPA
User databases transfer personal records of Malaysian citizens to server locations outside Malaysia without statutory exceptions or explicit consent, violating PDPA.
Legal basis: Malaysia Personal Data Protection Act (PDPA) 2010, Sec. 129
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
504
MYPD-003
Lack of Verification Controls for Data Correctness in Malaysia
The website database fails to implement mechanisms to ensure personal records collected from Malaysian users are processed accurately and kept up-to-date, violating PDPA.
Legal basis: Malaysia Personal Data Protection Act (PDPA) 2010, Sec. 11
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
505
MYPD-004
Non-Compliant Processing of Sensitive Personal Data in Malaysia
Web forms collect sensitive personal detail fields (such as health or political affiliations) of Malaysian users without obtaining explicit, signed consent, violating PDPA.
Legal basis: Malaysia Personal Data Protection Act (PDPA) 2010, Sec. 40
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
506
THPD-005
Failure to Disclose Thai DPO Contact Protocols
The website targeting Thai consumers fails to prominently publish contact options for its designated Data Protection Officer (DPO) under Thai PDPA requirements.
Legal basis: Thailand Personal Data Protection Act (PDPA) 2019, Sec. 41
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
507
THPD-006
Missing Thai Consent Revocation Interface
The user cabinet fails to offer a simple mechanism for Thai citizens to withdraw consent that is as easy as the mechanism used to grant it, violating PDPA.
Legal basis: Thailand Personal Data Protection Act (PDPA) 2019, Sec. 19
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
508
THPD-007
Illegal Cross-Border Transfers of Thai Personal Data
Database backups route personal details of Thai users to servers located abroad without complying with adequacy rules or obtaining consent, violating Thai PDPA.
Legal basis: Thailand Personal Data Protection Act (PDPA) 2019, Sec. 28
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
509
THPD-008
Missing Thai Data Processing Register Entries
Corporate controllers processing Thai citizen records fail to document and preserve logs of database operations and purpose evaluations, violating PDPA mandates.
Legal basis: Thailand Personal Data Protection Act (PDPA) 2019, Sec. 39
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
510
THPD-009
Collection of Thai Sensitive Personal Data without Explicit Consent
Online intake forms collect criminal records, biological, or health data of Thai residents without securing active, explicit consent, violating PDPA regulations.
Legal basis: Thailand Personal Data Protection Act (PDPA) 2019, Sec. 26
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
511
VNDP-002
Lack of Prior Impact Assessment for Vietnam Data Transfers
Organizations transferring Vietnamese personal data to server locations outside Vietnam fail to file a Transfer Impact Assessment with the Ministry of Public Security, violating Decree 13.
Legal basis: Vietnam Decree 13/2023/ND-CP on Personal Data Protection, Art. 25
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
512
VNDP-003
Non-Compliant Processing of Children's Data in Vietnam
Web applications collecting personal details of children in Vietnam aged 7 or older fail to verify child consent along with parental/guardian approval, violating Decree 13.
Legal basis: Vietnam Decree 13/2023/ND-CP on Personal Data Protection, Art. 20
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
513
VNDP-004
Lack of Localized Server Presence for Vietnam Operations
Enterprise systems fail to establish a local server presence to store user database records of Vietnamese citizens within Vietnamese territory when required by cybersecurity laws.
Legal basis: Vietnam Law on Cybersecurity No. 24/2018/QH14, Art. 26
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
514
VNDP-005
Failure to Disclose DPO Details under Vietnam Decree 13
Organizations processing sensitive personal details of Vietnamese citizens fail to designate a Data Protection Department or DPO contact in their privacy policies, violating Decree 13.
Legal basis: Vietnam Decree 13/2023/ND-CP on Personal Data Protection, Art. 28
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
515
VNDP-006
Lack of Verified Data Security Assessments in Vietnam
Platforms processing Vietnamese user records fail to perform annual database system security assessments and maintain verification logs for regulatory inspections under Decree 13.
Legal basis: Vietnam Decree 13/2023/ND-CP on Personal Data Protection, Art. 27
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
516
DPDP-004
Missing Multi-Language Privacy Notices for India
The website targeting Indian users fails to provide option toggles to view the privacy disclosures in all 22 scheduled languages of the Constitution of India, violating DPDP Act.
Legal basis: Digital Personal Data Protection Act (DPDP Act) 2023, Sec. 5(3)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
517
DPDP-005
Lack of Localized Dispute Redressal Channels for India
The support portal fails to provide Indian consumers with a clear mechanism to file grievances and contact a localized Grievance Officer, violating DPDP Act mandates.
Legal basis: Digital Personal Data Protection Act (DPDP Act) 2023, Sec. 13
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
518
DPDP-006
Incomplete Purpose-Specification Form Notices in India
Online input forms collect personal details of Indian residents without presenting a standalone, clear notification specifying exactly what details are collected and why, violating DPDP Act.
Legal basis: Digital Personal Data Protection Act (DPDP Act) 2023, Sec. 5(1)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
519
DPDP-007
Failure to Disclose DPO and Consent Manager Contacts in India
The privacy disclosures targeting India omit publishing details of the DPO and fail to support appointing a certified Consent Manager, violating DPDP requirements.
Legal basis: Digital Personal Data Protection Act (DPDP Act) 2023, Sec. 6
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
520
DPDP-008
Non-Compliant Processing of Children's Tracking Cookies in India
The website executes behavioral monitoring cookies or targets advertising algorithms towards users determined to be children under 18 in India, violating DPDP Act prohibitions.
Legal basis: Digital Personal Data Protection Act (DPDP Act) 2023, Sec. 9(2)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
521
DPDP-009
Lack of Data Erasure Controls on Vendor Subprocessors in India
The database fails to automatically propagate data erasure requests submitted by Indian users to third-party vendor subprocessors and partners, violating DPDP Act mandates.
Legal basis: Digital Personal Data Protection Act (DPDP Act) 2023, Sec. 12
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
522
JPAP-004
Lack of Cross-Border Information Disclosures under Japanese APPI
The privacy policy fails to inform Japanese users of the names of countries where their records are stored and the security systems implemented by recipient servers, violating APPI.
Legal basis: Japan Act on the Protection of Personal Information (APPI), Sec. 28
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
523
JPAP-005
Incomplete Disclosure of Database Safety Measures in Japan
The corporate privacy policy fails to list specific administrative, technical, and physical safety management measures taken to protect stored Japanese records, violating APPI.
Legal basis: Japan Act on the Protection of Personal Information (APPI), Sec. 32
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
524
JPAP-006
Lack of Consent for Pseudo-Personally Identifiable Information in Japan
The website tracks and processes pseudonymised user data (e.g. cookie IDs linked to server profiles) of Japanese visitors without meeting APPI disclosure requirements.
Legal basis: Japan Act on the Protection of Personal Information (APPI), Sec. 41
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
525
JPAP-007
Non-Compliant Processing of Personally Referable Information in Japan
Web databases transfer user identifiers to third parties knowing they will be linked to identifiable personal records in Japan without validating consent, violating APPI.
Legal basis: Japan Act on the Protection of Personal Information (APPI), Sec. 31
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
526
JPAP-008
Lack of Data Breach Notification System for PPC Japan
System incident tracking rules fail to mandate reporting significant data breach incidents (resulting in leaks of sensitive or high-volume files) to the Japanese Personal Information Protection Commission (PPC).
Legal basis: Japan Act on the Protection of Personal Information (APPI), Sec. 26
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
527
JPAP-009
Illegal Direct Marketing over Phone without Verification in Japan
Lead forms capturing Japanese telephone numbers fail to display clear opt-out checkboxes and verify Do Not Call preferences before initiating sales calls, violating APPI guidelines.
Legal basis: Japan Act on the Protection of Personal Information (APPI) Guidelines
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
528
SKPA-001
Lack of Multi-Option Form Consent Separations in South Korea
Online input forms targeting South Korean users bundle optional marketing consents together with essential terms of service agreement checkmarks, violating South Korea's PIPA.
Legal basis: South Korea Personal Information Protection Act (PIPA), Art. 22
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
529
SKPA-002
Non-Compliant Resident Registration Number Processing in S. Korea
Web applications process Resident Registration Numbers (RRN) of South Korean citizens without statutory legal authority or secure cryptographic measures, violating South Korea PIPA.
Legal basis: South Korea Personal Information Protection Act (PIPA), Art. 24-2
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
530
SKPA-003
Lack of Native Language DPO Disclosures in South Korea
The privacy disclosures targeting South Korean users fail to specify the contact address or phone number of the DPO in Korean native text, violating PIPA mandates.
Legal basis: South Korea Personal Information Protection Act (PIPA), Art. 31
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
531
SKPA-004
Missing Cross-Border Transfer Disclosures under Korean PIPA
The privacy policy fails to inform South Korean consumers of the date, destination country, and purpose of outbound personal data transfers to overseas servers, violating PIPA.
Legal basis: South Korea Personal Information Protection Act (PIPA), Art. 39-11
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
532
SKPA-005
South Korea PIPC Breach Notification Violations
Incident response guidelines fail to mandate reporting significant data breach leaks (affecting 1,000+ users) to the Korean Personal Information Protection Commission (PIPC) within 24 hours.
Legal basis: South Korea Personal Information Protection Act (PIPA), Art. 34
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
533
LGPD-005
Missing Brazilian DPO Registry with ANPD
Organizations processing Brazilian personal data fail to formally register and publish their designated DPO (Encarregado) contact details with the national ANPD authority, violating LGPD.
Legal basis: Lei Geral de Proteção de Dados (LGPD), Art. 41
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
534
LGPD-006
Lack of Explicit Consent for Processing Sensitive Brazilian Records
Online intake forms collect health, biometrics, or union status details from Brazilian consumers without obtaining a separate, explicit opt-in signature or verification checkbox, violating LGPD.
Legal basis: Lei Geral de Proteção de Dados (LGPD), Art. 11
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
535
LGPD-007
Non-Compliant Data Portability Path under Brazilian LGPD
The customer dashboard fails to provide Brazilian consumers with an automated interface to export and transfer their database profiles to competitor networks, violating LGPD.
Legal basis: Lei Geral de Proteção de Dados (LGPD), Art. 9
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
536
LGPD-008
Failure to Document Brazilian Processing Legal Bases
The corporate privacy policy fails to explicitly link each category of collected personal details to one of the ten statutory legal bases required for compliance under LGPD.
Legal basis: Lei Geral de Proteção de Dados (LGPD), Art. 7
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
537
LGPD-009
Failure to Honor Immediate Erasure Requests in Brazil
Support systems fail to instantly delete personal details and verify compliance upon receipt of erasure requests submitted by Brazilian users, violating LGPD regulations.
Legal basis: Lei Geral de Proteção de Dados (LGPD), Art. 16
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
538
POPI-003
Missing Registration of South African Information Officer
Organizations processing personal details of South African residents fail to register their designated Information Officer with the Information Regulator, violating POPIA.
Legal basis: Protection of Personal Information Act (POPIA) 2013, Sec. 55
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
540
POPI-005
Insecure Storage of South African Identity Numbers
System databases store South African national identity numbers in unencrypted database columns or permit unauthorized access, failing POPIA security requirements.
Legal basis: Protection of Personal Information Act (POPIA) 2013, Sec. 19
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
541
POPI-006
Failure to Audit South African Processing Purpose Boundaries
Web applications process details collected from South African citizens for reasons not compatible with the original collection purpose without consent, violating POPIA.
Legal basis: Protection of Personal Information Act (POPIA) 2013, Sec. 15
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
542
POPI-007
Failure to File PAIA Manual on Corporate Portals
South African-facing business platforms fail to host a public, downloadable PAIA manual detailing access procedures for corporate information registries, violating statutory requirements.
Legal basis: Promotion of Access to Information Act (PAIA) 2000
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
543
NDPA-002
Lack of Mandated Audit Disclosures under Nigerian NDPA
Large data controllers processing Nigerian records fail to file annual data protection audit reports with the Nigeria Data Protection Commission (NDPC), violating NDPA.
Legal basis: Nigeria Data Protection Act (NDPA) 2023, Sec. 33
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
544
NDPA-003
Lack of Explicit Consent for Direct Marketing in Nigeria
Online customer registration flows subscribe Nigerian users to promotional lists without obtaining explicit, prior consent, violating data protection regulations.
Legal basis: Nigeria Data Protection Act (NDPA) 2023, Sec. 26
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
545
NDPA-004
Illegal Storage of Nigerian Data Outside Nigeria
User databases transfer records of Nigerian citizens to servers outside Nigeria without meeting adequacy rules or executing verified contractual terms, violating NDPA.
Legal basis: Nigeria Data Protection Act (NDPA) 2023, Sec. 41
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
546
NDPA-005
Missing Information Security Audits under Nigerian Law
The enterprise processing Nigerian user records fails to perform and record annual database systems security assessments, violating NDPA regulations.
Legal basis: Nigeria Data Protection Act (NDPA) 2023, Sec. 39
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
547
MXPD-002
Missing Mexican Privacy Notice Structure (Aviso de Privacidad)
The privacy disclosures targeting Mexican consumers fail to provide the statutory structure of a formal Privacy Notice (Aviso de Privacidad), violating LFPDPPP.
Legal basis: Mexico Federal Law on Protection of Personal Data (LFPDPPP), Art. 15
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
548
MXPD-003
Lack of Explicit Opt-In for Sensitive Data in Mexico
Online intake forms collect financial or sensitive wellness details from Mexican users without obtaining explicit, signed opt-in signatures or checkboxes, violating Mexican law.
Legal basis: Mexico Federal Law on Protection of Personal Data (LFPDPPP), Art. 9
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
549
MXPD-004
Failure to Document ARCO Rights Redress Pathways in Mexico
The privacy policy fails to explain the specific procedures, timelines, and contact routes required to execute ARCO rights (Access, Rectification, Cancellation, Opposition) under Mexican law.
Legal basis: Mexico Federal Law on Protection of Personal Data (LFPDPPP), Art. 22
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
550
MXPD-005
Insecure Security Disclosures for Mexican Customer Data
Customer database records processing Mexican resident data lack documented administrative, technical, and physical security measures required under LFPDPPP regulations.
Legal basis: Mexico Federal Law on Protection of Personal Data (LFPDPPP), Art. 19
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
551
ARGPD-001
Failure to Register Databases with AAIP (Argentina)
The data controller processes personal data of Argentine residents without registering its databases with the Access to Public Information Agency (AAIP).
Legal basis: Argentina Personal Data Protection Act (Ley 25.326), Art. 3
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
553
ARGPD-003
Missing Local Security Safeguards for Argentine Data Subject Repositories
Database systems holding Argentine resident personal data fail to implement organizational and technical security measures mandated by AAIP regulations.
Legal basis: Argentina Personal Data Protection Act (Ley 25.326), Art. 9
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
554
ARGPD-004
Illegal Direct Marketing without Opt-Out Verification under Argentine Law
The website engages in direct marketing to Argentine residents without verifying the national 'Do Not Call' registry or providing a direct opt-out link.
Legal basis: Argentina Personal Data Protection Act (Ley 25.326), Art. 27
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
555
ARGPD-005
Lack of Adequate Third-Country Transfer Safeguards for Argentine Citizens
The controller transfers Argentine resident data internationally to countries or entities that do not provide adequate protection levels under AAIP standards.
Legal basis: Argentina Personal Data Protection Act (Ley 25.326), Art. 12
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
557
COLPD-002
Absence of Explicit Prior Consent for Colombian Residents
The website collects and processes personal data of Colombian residents without obtaining explicit, prior, and informed consent that can be verified later.
Legal basis: Colombia Data Protection Law (Ley 1581 of 2012), Art. 9
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
561
CHLPD-001
Failure to Honor Erasure or Correction Requests for Chilean Citizens
The website fails to provide automated or documented channels for Chilean residents to request deletion or rectification of their personal record data.
Legal basis: Chile Law on Private Life Protection (Ley 19.628), Art. 12
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
562
CHLPD-002
Illegal Processing of Sensitive Personal Information without Written Authorization in Chile
The site collects sensitive data of Chilean citizens (health, ideology, union membership) without obtaining explicit written or equivalent digital consent.
Legal basis: Chile Law on Private Life Protection (Ley 19.628), Art. 10
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
566
PERPD-001
Failure to Register Personal Data Banks in Peru (RNDP)
The data controller fails to register its personal databases containing Peruvian resident data with the National Registry for Personal Data Protection.
Legal basis: Peru Data Protection Law (Ley 29733), Art. 30
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
577
ECUPD-002
Lack of Localized Redress Pathways for Ecuadorian Protection Agency
The privacy policy fails to document user redress rights or provide a clear path to submit complaints to the Ecuadorian Superintendent of Data Protection.
Legal basis: Ecuador Law on Protection of Personal Data (LOPDP), Art. 33
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
587
PANPD-002
Lack of ARCO Rights Enforcement Pathways in Panama
The controller fails to provide a free and easily accessible email address or system to exercise access, rectification, opposition, and deletion in Panama.
Legal basis: Panama Data Protection Act (Ley 81 of 2019), Art. 15
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
591
KENPD-001
Failure to Register as a Data Controller with Kenyan ODPC
The entity collects and processes personal data of Kenyan residents without registering as a data controller or processor with the Office of the Data Protection Commissioner (ODPC).
Legal basis: Kenya Data Protection Act 2019, Section 18
Absence of Local Representative for Foreign Controllers in Kenya
Foreign data controllers processing personal data of data subjects in Kenya fail to appoint a resident local representative to handle regulatory matters.
Legal basis: Kenya Data Protection Act 2019, Section 50
Failure to Report Personal Data Breaches within 72 Hours in Egypt
The controller fails to establish internal guidelines to report personal data breaches to the Egyptian regulator and affected subjects within 72 hours.
Legal basis: Egypt Personal Data Protection Law (Law 151 of 2020), Art. 7
Unlawful Cross-Border Transfer of Egyptian Citizens' Data
The website transfers personal data of Egyptian residents to international entities without obtaining the necessary approval from the Egyptian Data Protection Center.
Legal basis: Egypt Personal Data Protection Law (Law 151 of 2020), Art. 14
Inadequate Verification of Consent for Children's Data in Qatar
The website processes personal data of children in Qatar without obtaining explicit consent from their parents or legal guardians as required by PDPPL.
Legal basis: Qatar Personal Data Privacy Protection Law (Law 13 of 2016), Art. 17
Lack of Written Consent for Sensitive Data in Bahrain
The website collects sensitive data (such as health status or biometrics) of Bahraini residents without obtaining prior, written, and explicit consent.
Legal basis: Bahrain Personal Data Protection Law (Law 30 of 2018), Art. 4
Failure to Respond to Omani Consumer Requests within Legal Timeline
The data controller's user request procedures do not mandate responding to access or rectification requests by Omani citizens within the statutory timeframe.
Legal basis: Oman Personal Data Protection Law (Royal Decree 6/2022), Art. 15
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
622
HKGPD-002
Lack of Separated Consent for Third-Party Marketing in Hong Kong
The website shares Hong Kong resident data with partners for marketing purposes without obtaining separate, explicit, and informed consent.
Legal basis: Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), Sec. 35J
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
623
HKGPD-003
Non-Compliant Data Retention Disclosures for Hong Kong Customers
The privacy policy fails to outline clear retention schedules or disposal procedures for personal data collected from Hong Kong residents.
Legal basis: Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), DPP 2
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
624
HKGPD-004
Insecure Data Deletion and Destruction Protocols in Hong Kong
The server-side data lifecycle fails to implement secure deletion algorithms for inactive Hong Kong user database entries.
Legal basis: Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), DPP 4
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
625
HKGPD-005
Lack of Data Access and Correction Interfaces for Hong Kong Subjects
The website fails to supply Hong Kong users with simple, dedicated contact forms or procedures to demand access or correction of their data.
Legal basis: Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), DPP 6
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
626
TWNPD-001
Incomplete Informational Disclosures under Taiwan PDPA
The privacy policy fails to explicitly list all mandatory items under PDPA Art. 8, such as the consequences of not providing data.
Legal basis: Taiwan Personal Data Protection Act (PDPA), Article 8
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
627
TWNPD-002
Unlawful Collection of Sensitive Personal Data without Written Consent in Taiwan
The website collects sensitive personal records (medical history, genetic data) of Taiwanese residents without obtaining explicit written consent.
Legal basis: Taiwan Personal Data Protection Act (PDPA), Article 6
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
628
TWNPD-003
Lack of Auditable Safety Maintenance Plan in Taiwan
The data controller fails to document and maintain an internal security maintenance plan to prevent personal data leakage in Taiwan.
Legal basis: Taiwan Personal Data Protection Act (PDPA), Article 27
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
629
TWNPD-004
Missing Incident Notification Protocols to Taiwanese Citizens
The company lacks protocols to notify Taiwanese data subjects of personal data leaks immediately after verification of a breach.
Legal basis: Taiwan Personal Data Protection Act (PDPA), Article 12
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
630
TWNPD-005
Inadequate Safeguards for Direct Marketing to Taiwan Residents
The website uses personal data of Taiwanese residents for marketing without providing a clear option to object at the first contact.
Legal basis: Taiwan Personal Data Protection Act (PDPA), Article 20
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
631
PHLPD-001
Missing Registration of Data Processing Systems with Philippines NPC
The entity processes personal data of Philippine citizens but fails to register its data processing systems with the National Privacy Commission (NPC).
Legal basis: Philippines Data Privacy Act of 2012 (RA 10173), Sec. 14
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
632
PHLPD-002
Failure to Designate a Data Protection Officer in the Philippines
The data controller targeting Philippine subjects fails to officially designate and register a Data Protection Officer with the NPC.
Legal basis: Philippines Data Privacy Act of 2012 (RA 10173), Sec. 21
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
633
PHLPD-003
Inadequate Privacy Notice Disclosures for Philippine Residents
The privacy policy fails to inform Philippine users about their specific rights to be informed, access, object, and demand erasure.
Legal basis: Philippines Data Privacy Act of 2012 (RA 10173), Sec. 16
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
634
PHLPD-004
Lack of Systemic Breach Notification System to NPC within 72 Hours
The company's security procedures do not mandate notification to the NPC and affected subjects within 72 hours of discovering a breach.
Legal basis: Philippines Data Privacy Act of 2012 (RA 10173), Sec. 20
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
635
PHLPD-005
Incomplete Consent Forms for Processing Sensitive Information in the Philippines
The consent mechanism bundles permission for sensitive info processing with general terms of service, violating Philippine consent laws.
Legal basis: Philippines Data Privacy Act of 2012 (RA 10173), Sec. 13
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
636
IDNPD-001
Lack of Documented Legal Basis for Indonesian Operations
The website collects and processes Indonesian citizen data without documenting the specific legal bases (consent, contract) under UU PDP.
Legal basis: Indonesia Personal Data Protection Act (UU PDP No. 27/2022), Art. 20
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
637
IDNPD-002
Failure to Appoint a Local Data Protection Officer in Indonesia
The data controller handles Indonesian personal records on a large scale but fails to designate a resident local Data Protection Officer.
Legal basis: Indonesia Personal Data Protection Act (UU PDP No. 27/2022), Art. 53
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
638
IDNPD-003
Missing Age and Parental Verification Controls for Children in Indonesia
The website collects personal data of Indonesian children without verifying their age and obtaining validated consent from parents.
Legal basis: Indonesia Personal Data Protection Act (UU PDP No. 27/2022), Art. 32
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
639
IDNPD-004
Lack of Explicit Incident Notification System in Indonesia within 72 Hours
The data controller fails to establish procedures to notify Indonesian authorities and subjects within 72 hours of data security breach detection.
Legal basis: Indonesia Personal Data Protection Act (UU PDP No. 27/2022), Art. 46
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
640
IDNPD-005
Non-Compliant Data Erasure Mechanisms for Indonesian Personal Data
The systems do not support total, permanent deletion of Indonesian user records upon valid consent withdrawal or contract termination.
Legal basis: Indonesia Personal Data Protection Act (UU PDP No. 27/2022), Art. 43
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
641
KAZPD-001
Failure to Register Databases containing Kazakhstan Resident Data
The data controller fails to register its databases processing personal data of Kazakhstan residents with the state authority.
Legal basis: Kazakhstan Law on Personal Data (Law 94-V), Art. 26
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
642
KAZPD-002
Non-Compliant Cross-Border Transfers without Confirming Adequacy in Kazakhstan
The website transfers personal data of Kazakhstan citizens to third countries without verifying adequacy or securing legal transfer grounds.
Legal basis: Kazakhstan Law on Personal Data (Law 94-V), Art. 16
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
643
KAZPD-003
Incomplete Consent Gathering Systems for Kazakhstan Residents
The website collects personal data of Kazakhstan residents without obtaining explicit consent that details specific processing purposes.
Legal basis: Kazakhstan Law on Personal Data (Law 94-V), Art. 8
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
644
KAZPD-004
Failure to Localize Server Storage within the Republic of Kazakhstan
The databases storing personal data of Kazakhstan residents are hosted outside Kazakhstan, violating mandatory data localization requirements.
Legal basis: Kazakhstan Law on Personal Data (Law 94-V), Art. 12
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
645
KAZPD-005
Lack of Standard Redress and Deletion Protocols for Kazakhstan Citizens
The controller fails to provide direct pathways or contact options to request blocking or destruction of Kazakhstan citizen personal records.
Legal basis: Kazakhstan Law on Personal Data (Law 94-V), Art. 24
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
646
UKRPD-001
Missing Notification of Data Processing to Ukrainian Commissioner
The controller processes sensitive personal data of Ukrainian residents without notifying the Commissioner for Human Rights.
Legal basis: Ukraine Law on Personal Data Protection, Article 9
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
655
CANPD-005
Incomplete Third-Party Transfer Agreements for Canadian Data
The controller transfers Canadian resident data to third-party processors without implementing formal contract guarantees ensuring equivalent protection.
Legal basis: Canada Personal Information Protection and Electronic Documents Act (PIPEDA), Schedule 1, Sec. 4.5.3
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
660
BOLPD-005
Insecure Storage of Bolivian Data Subject Registries
Databases processing personal data of Bolivian residents fail to deploy encryption and technical security safeguards required under telecommunication standards.
Legal basis: Bolivia General Telecommunications Law (Ley 164), Art. 57
Processing Ghanaian Sensitive Personal Data without Authorization
The website collects sensitive personal records (biometric, health, beliefs) of Ghanaian residents without obtaining prior written authorization from the DPC.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
737
UZBPD-002
Failure to Localize Server Databases within Uzbekistan
The databases storing personal records of Uzbekistani citizens are hosted outside Uzbekistan, violating localization laws.
Legal basis: Uzbekistan Law on Personal Data (ZRU-547), Art. 12-1
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
738
UZBPD-003
Inadequate Notices for Data Access and Correction in Uzbekistan
The privacy policy fails to outline user rights to demand access, block, or correct personal records in Uzbekistan.
Legal basis: Uzbekistan Law on Personal Data (ZRU-547), Art. 30
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
739
UZBPD-004
Non-Compliant International Transfers of Uzbekistani Data
The controller transfers personal records of Uzbekistani citizens to countries lacking adequate protection levels.
Legal basis: Uzbekistan Law on Personal Data (ZRU-547), Art. 15
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
740
UZBPD-005
Failure to Register Personal Databases with Uzbek State Register
The controller fails to register database systems processing personal data of Uzbek residents with the State Register.
Legal basis: Uzbekistan Law on Personal Data (ZRU-547), Art. 24
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
741
GEOPD-001
Failure to Notify State Inspector Service in Georgia
The data controller processes personal data of Georgian residents without notifying the State Inspector Service.
Legal basis: Georgia Law on Personal Data Protection, Article 15
Incomplete Privacy Notice Disclosures under Swiss FADP
The website fails to provide comprehensive information about the identity of the controller, categories of data, and recipient countries in its privacy notice.
Legal basis: Switzerland Federal Act on Data Protection (FADP), Art. 19, Art. 60
The controller exports personal data of Swiss residents to third countries without a Federal Council adequacy decision or standard contractual clauses.
Legal basis: Switzerland Federal Act on Data Protection (FADP), Art. 16, Art. 17
Inadequate Subject Rights Access Channels under Swiss FADP
The website fails to provide Swiss residents with free, accessible, and transparent methods to exercise their rights to access, correct, or delete data.
Legal basis: Switzerland Federal Act on Data Protection (FADP), Art. 25, Art. 26
Non-Compliant Direct Marketing Communications in Saudi Arabia
The website sends direct marketing materials or advertising cookies to Saudi subjects without obtaining prior opt-in consent and offering direct opt-out routes.
Legal basis: Saudi Arabia Personal Data Protection Law (PDPL), Art. 28
Unauthorized Cross-Border Transfer of Saudi Personal Data
The website exports personal data of Saudi residents to external hosting environments without ensuring compliance with national security and adequacy regulations.
Legal basis: Saudi Arabia Personal Data Protection Law (PDPL), Art. 29, Art. 35
Inadequate Access Controls and Security Logs under Israeli Regulations
The website database lacks compliance security log monitoring and access restrictions required for databases containing personal files under Israeli regulations.
Legal basis: Israel Privacy Protection Regulations (Information Security), 5777-2017
Non-Compliant Direct Mail Marketing Registry in Israel
The web controller uses lists of contacts for direct mailing to Israeli citizens without disclosing the source of the database and providing opt-out routes.
Legal basis: Israel Privacy Protection Act, 5741-1981, Section 17F
Lack of Direct Access and Rectification Procedures in Israel
The privacy policy fails to detail the administrative processes or specific timelines for Israeli subjects to inspect, rectify, or request erasure of their records.
Lack of Consent for Processing Sensitive Data in Sri Lanka
The website processes sensitive personal data (biometrics, health, financial records) of Sri Lankan subjects without obtaining valid, explicit consent.
Legal basis: Sri Lanka Personal Data Protection Act, No. 9 of 2022, Sec. 6
The website retains personal data of Sri Lankan users longer than necessary for the specified purposes, violating retention limits under Sri Lankan law.
Legal basis: Sri Lanka Personal Data Protection Act, No. 9 of 2022, Sec. 10
Failure to Document Security Breach Notification Protocols in Tanzania
The data controller fails to document administrative procedures to notify the Commission and affected subjects of security breaches as soon as practicable.
Legal basis: Tanzania Personal Data Protection Act, 2022, Sec. 40
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
801
BHSPD-001
Unregistered Processing of Personal Data in Bahamas
The website collects sensitive personal records of Bahamian subjects without registering the processing registry with the Data Protection Commissioner.
Legal basis: Bahamas Data Protection (Privacy of Personal Information) Act, Sec. 5, Sec. 15
Non-Compliant Cross-Border Data Transfer from Tunisia
The controller exports personal data of Tunisian users to external hosting environments without ensuring compliance with adequacy and regulatory approvals.
Lack of Explicit Consent for Sensitive Data in Ivory Coast
The website processes sensitive personal data (biometrics, health, financial records) of Ivorian subjects without obtaining valid, prior explicit consent.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
847
MNGPD-002
Missing Security Incident Notification Channels under Mongolian Law
The website controller fails to document specific administrative or public procedures to notify Mongolian subjects of data breach incidents.
Legal basis: Mongolia Law on Protection of Personal Data 2021, Article 15
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
848
MNGPD-003
Lack of Data Subject Rectification and Erasure Rights in Mongolia
The website privacy policy fails to document accessible contact paths or specific procedures for Mongolian users to request correction or destruction of records.
Legal basis: Mongolia Law on Protection of Personal Data 2021, Article 17, Article 18
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
849
MNGPD-004
Processing Biometric Data without Written Consent in Mongolia
The website collects sensitive biometric or genetic files of Mongolian subjects without obtaining prior written explicit consent.
Legal basis: Mongolia Law on Protection of Personal Data 2021, Article 8, Article 12
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
850
MNGPD-005
Non-Compliant Direct Marketing Communications in Mongolia
The website sends direct marketing materials or advertising cookies to Mongolian subjects without obtaining prior opt-in consent.
Legal basis: Mongolia Law on Protection of Personal Data 2021, Article 23
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
851
NORPD-001
Processing Sensitive Personal Data without Explicit Consent in Norway
The website processes sensitive personal records of Norwegian users without obtaining explicit, prior opt-in consent as required by the Datatilsynet.
Legal basis: Norway Personal Data Act, Sec. 1 (incorporating GDPR Art. 9)
Inadequate Subject Rights Access Channels in Liechtenstein
The website fails to provide Liechtenstein residents with free, accessible, and transparent methods to exercise rights of access, correction, or deletion.
Inadequate Subject Rights Access Channels in North Macedonia
The website fails to provide Macedonian residents with free, accessible, and transparent methods to exercise rights of access, correction, or deletion.
Legal basis: North Macedonia Law on Personal Data Protection, Article 19, Article 21
Unauthorized Cross-Border Transfer of Montenegrin Data
The website exports personal data of Montenegrin residents to external countries that do not ensure an adequate level of protection without AZLP approval.
Legal basis: Montenegro Law on Personal Data Protection, Article 28
Inadequate Subject Rights Access Channels in Montenegro
The website fails to provide Montenegrin residents with free, accessible, and transparent methods to exercise rights to check, rectify, or delete data.
Legal basis: Montenegro Law on Personal Data Protection, Article 19, Article 20
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
947
PNGPD-002
Lack of Explicit Consent for Sensitive Data in Papua New Guinea
The website collects sensitive personal records (health, biometric) of PNG residents without prior explicit written or digital consent.
Legal basis: Papua New Guinea Constitution, Section 49 (Right to Privacy)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
948
PNGPD-003
Inadequate Disclosures in Privacy Notice under PNG Law
The privacy policy fails to identify PNG processing purposes, retention details, or contact options for data subjects.
Legal basis: Papua New Guinea Constitution, Section 49 (Right to Privacy)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
949
PNGPD-004
Non-Compliant Cross-Border Transfers from Papua New Guinea
The controller transfers personal records of PNG subjects to external countries without ensuring adequacy or comparable protection.
Legal basis: Papua New Guinea Constitution, Section 49 (Right to Privacy)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
950
PNGPD-005
Inadequate Subject Rights Response Methods in Papua New Guinea
The website fails to establish transparent channels for PNG subjects to exercise access, correction, or erasure rights.
Legal basis: Papua New Guinea Constitution, Section 49 (Right to Privacy)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
951
SMRPD-001
Lack of Explicit Consent for Sensitive Data Processing in San Marino
The website collects sensitive personal records of Sammarinese subjects without obtaining valid, prior explicit written or digital consent.
Legal basis: San Marino Law no. 171 on Personal Data Protection, Art. 6, Art. 83
Inadequate Subject Rights Access Channels in San Marino
The website fails to provide Sammarinese residents with free, accessible, and transparent methods to exercise rights of access, correction, or deletion.
Legal basis: San Marino Law no. 171 on Personal Data Protection, Art. 15, Art. 17
Unauthorized Cross-Border Transfer of Faroese Data
The website exports personal data of Faroese residents to external countries that do not ensure an adequate level of protection without Datatilsynet approval.
Legal basis: Faroe Islands Act on Processing of Personal Data, Sec. 28
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
984
BMUPD-004
Lack of Formal Data Processor Agreements under Bermuda Law
The controller transfers personal records of Bermudian residents to third-party processors without a binding written contract ensuring equivalent protection.
Legal basis: Bermuda Personal Information Protection Act 2016 (PIPA), Section 12
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
986
CYMPD-001
Lack of Explicit Consent for Sensitive Data under Cayman DPA
The website collects sensitive personal records (health, financial, genetic) of Caymanian residents without obtaining prior explicit written or digital consent.
Legal basis: Cayman Islands Data Protection Act 2017, Sec. 6 (Principle 1)
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
993
LCAPD-003
Inadequate Technical Database Safeguards in Saint Lucia
The database collects and processes personal files of Saint Lucian residents without employing mandatory technical encryption or administrative controls.
Legal basis: Saint Lucia Data Protection Act 2011, Sec. 32
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
995
LCAPD-005
Non-Compliant Cross-Border Transfer of Saint Lucian Data
The controller transfers data of Saint Lucian residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
Legal basis: Saint Lucia Data Protection Act 2011, Sec. 47
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
998
KNAPD-003
Inadequate Technical Database Safeguards in St. Kitts & Nevis
The database collects and processes personal files of St. Kitts & Nevis residents without employing mandatory technical encryption or administrative controls.
Legal basis: Saint Kitts and Nevis Data Protection Act 2018, Sec. 32
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
999
KNAPD-004
Non-Compliant Data Retention Cycles in St. Kitts & Nevis
The website retains personal records of St. Kitts & Nevis users longer than necessary for the designated processing purpose without deletion protocols.
Legal basis: Saint Kitts and Nevis Data Protection Act 2018, Sec. 14
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1000
KNAPD-005
Non-Compliant Cross-Border Transfer of St. Kitts & Nevis Data
The controller transfers data of St. Kitts & Nevis residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
Legal basis: Saint Kitts and Nevis Data Protection Act 2018, Sec. 47
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1003
ATGPD-003
Inadequate Technical Database Safeguards in Antigua & Barbuda
The database collects and processes personal files of Antigua & Barbuda residents without employing mandatory technical encryption or administrative controls.
Legal basis: Antigua and Barbuda Data Protection Act 2013, Sec. 32
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1004
ATGPD-004
Non-Compliant Data Retention Cycles in Antigua & Barbuda
The website retains personal records of Antigua & Barbuda users longer than necessary for the designated processing purpose without deletion protocols.
Legal basis: Antigua and Barbuda Data Protection Act 2013, Sec. 14
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1005
ATGPD-005
Non-Compliant Cross-Border Transfer of Antigua & Barbuda Data
The controller transfers data of Antigua & Barbuda residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
Legal basis: Antigua and Barbuda Data Protection Act 2013, Sec. 47
Unauthorized Cross-Border Transfer of Seychelles Data
The website exports personal data of Seychelles residents to external countries that do not ensure an adequate level of protection without regulator approval.
Legal basis: Seychelles Data Protection Act 2003, Sec. 28
Inadequate Subject Rights Access Channels in Seychelles
The website fails to provide Seychelles residents with free, accessible, and transparent methods to exercise rights of access, correction, or deletion.
Legal basis: Seychelles Data Protection Act 2003, Sec. 19
Lack of Explicit Consent for Sensitive Data under Macau Law
The website collects sensitive personal records (health, financial, genetic) of Macau residents without obtaining prior explicit written or digital consent.
Legal basis: Macau Personal Data Protection Act (Law No. 8/2005), Article 7, Article 24
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1115
GRNPD-005
Non-Compliant Cross-Border Transfer of Grenadian Data
The controller transfers data of Grenadian residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
Legal basis: Grenada Data Protection Act 2014, Sec. 47
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1116
VCTPD-001
Processing Sensitive Data without Consent in St. Vincent & Grenadines
The website collects sensitive personal records (health, financial details) of St. Vincent & Grenadines subjects without prior written explicit consent.
Legal basis: Saint Vincent and the Grenadines Electronic Transactions Act, Sec. 15, Sec. 50
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1118
VCTPD-003
Inadequate Technical Database Safeguards in St. Vincent & Grenadines
The database collects and processes personal files of St. Vincent & Grenadines residents without employing mandatory technical encryption or administrative controls.
Legal basis: Saint Vincent and the Grenadines Electronic Transactions Act, Sec. 32
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1119
VCTPD-004
Non-Compliant Data Retention Cycles in St. Vincent & Grenadines
The website retains personal records of St. Vincent & Grenadines users longer than necessary for the designated processing purpose without deletion protocols.
Legal basis: Saint Vincent and the Grenadines Electronic Transactions Act, Sec. 14
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1120
VCTPD-005
Non-Compliant Cross-Border Transfer of St. Vincent & Grenadines Data
The controller transfers data of St. Vincent & Grenadines residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
Legal basis: Saint Vincent and the Grenadines Electronic Transactions Act, Sec. 47
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1140
GUYPD-005
Non-Compliant Cross-Border Transfer of Guyanese Data
The controller transfers data of Guyanese residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
Legal basis: Guyana Data Protection Act 2024, Sec. 47
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1145
BLZPD-005
Non-Compliant Cross-Border Transfer of Belizean Data
The controller transfers data of Belizean residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
Legal basis: Belize local laws / draft Data Protection Act, Sec. 47
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1148
SURPD-003
Inadequate Technical Database Safeguards in Suriname
The database collects and processes personal files of Surinamese residents without employing mandatory technical encryption or administrative controls.
Legal basis: Suriname local laws / draft Data Protection Act, Sec. 32
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1150
SURPD-005
Non-Compliant Cross-Border Transfer of Surinamese Data
The controller transfers data of Surinamese residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
Legal basis: Suriname local laws / draft Data Protection Act, Sec. 47
Processing Personal Data without Legal Basis in South Sudan
The website collects personal details of South Sudanese residents without establishing a valid lawful processing base or consent under South Sudan law.
Legal basis: South Sudan National Communications Act / draft Data Protection Act, Sec. 5
Lack of Explicit Consent for Sensitive Data in Equatorial Guinea
The website processes sensitive personal records (health, biometric) of Equatorial Guinean residents without prior explicit written or digital consent.
Legal basis: Equatorial Guinea Law No. 1/2016 on Cybersecurity and Data Protection, Article 12
Processing Personal Data without Legal Basis in CAR
The website collects personal details of Central African Republic residents without establishing a valid lawful processing base or consent under CAR law.
Legal basis: CAR draft Personal Data Protection Law / Telecom rules, Sec. 5
Lack of Explicit Consent for Sensitive Data in CAR
The website collects sensitive personal records (health, biometric) of Central African Republic residents without prior explicit written or digital consent.
Legal basis: CAR draft Personal Data Protection Law / Telecom rules, Sec. 8
The controller transfers personal records of Central African Republic subjects to external countries without ensuring adequacy or comparable protection.
Legal basis: CAR draft Personal Data Protection Law / Telecom rules, Sec. 14
Processing Personal Data without Legal Basis in Sierra Leone
The website collects personal details of Sierra Leonean residents without establishing a valid lawful processing base or consent under Sierra Leone law.
Legal basis: Sierra Leone draft Data Protection Act / National Cybersecurity Law, Sec. 5
Processing Personal Data without Legal Basis in Guinea-Bissau
The website collects personal details of Guinea-Bissau residents without establishing a valid lawful processing base or consent under Guinea-Bissau law.
Legal basis: Guinea-Bissau Civil Code / draft Personal Data Protection Law, Sec. 5
Processing Personal Data without Legal Basis in Solomon Islands
The website collects personal details of Solomon Islands residents without establishing a valid lawful processing base or consent under Solomon Islands law.
Legal basis: Solomon Islands local rules / Cybersecurity guidelines, Sec. 5
Processing Personal Data without Legal Basis in Marshall Islands
The website collects personal details of Marshall Islands residents without establishing a valid lawful processing base or consent under Marshall Islands law.
Legal basis: Marshall Islands local guidelines / draft Data Protection Bill, Sec. 5
Processing Sensitive Data without Written Consent in China
The website collects sensitive personal records (health, financial details) of Chinese subjects without prior written explicit consent under the Personal Information Protection Law (PIPL).
Legal basis: Personal Information Protection Law (PIPL)
Processing Personal Data without Authority Notification in China
The website controller collects personal details of Chinese residents without submitting a processing notification to the Cyberspace Administration of China (CAC).
Legal basis: Personal Information Protection Law (PIPL)
The database collects and processes personal files of Chinese residents without employing mandatory technical encryption or administrative controls required under Personal Information Protection Law (PIPL).
Legal basis: Personal Information Protection Law (PIPL)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1254
CHNPD-004
Non-Compliant Data Retention Cycles in China
The website retains personal records of Chinese users longer than necessary for the designated processing purpose without deletion protocols under Personal Information Protection Law (PIPL).
Legal basis: Personal Information Protection Law (PIPL)
Non-Compliant Cross-Border Transfer of Chinese Data
The controller transfers data of Chinese residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Personal Information Protection Law (PIPL).
Legal basis: Personal Information Protection Law (PIPL)
Processing Sensitive Data without Written Consent in Russia
The website collects sensitive personal records (health, financial details) of Russian subjects without prior written explicit consent under the Federal Law No. 152-FZ on Personal Data.
Legal basis: Federal Law No. 152-FZ on Personal Data
Inadequate Technical Database Safeguards in Russia
The database collects and processes personal files of Russian residents without employing mandatory technical encryption or administrative controls required under Federal Law No. 152-FZ on Personal Data.
Legal basis: Federal Law No. 152-FZ on Personal Data
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1259
RUSPD-004
Non-Compliant Data Retention Cycles in Russia
The website retains personal records of Russian users longer than necessary for the designated processing purpose without deletion protocols under Federal Law No. 152-FZ on Personal Data.
Legal basis: Federal Law No. 152-FZ on Personal Data
Non-Compliant Cross-Border Transfer of Russian Data
The controller transfers data of Russian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Federal Law No. 152-FZ on Personal Data.
Legal basis: Federal Law No. 152-FZ on Personal Data
Processing Sensitive Data without Written Consent in Turkey
The website collects sensitive personal records (health, financial details) of Turkish subjects without prior written explicit consent under the Law on Protection of Personal Data No. 6698 (KVKK).
Legal basis: Law on Protection of Personal Data No. 6698 (KVKK)
Inadequate Technical Database Safeguards in Turkey
The database collects and processes personal files of Turkish residents without employing mandatory technical encryption or administrative controls required under Law on Protection of Personal Data No. 6698 (KVKK).
Legal basis: Law on Protection of Personal Data No. 6698 (KVKK)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1264
TURPD-004
Non-Compliant Data Retention Cycles in Turkey
The website retains personal records of Turkish users longer than necessary for the designated processing purpose without deletion protocols under Law on Protection of Personal Data No. 6698 (KVKK).
Legal basis: Law on Protection of Personal Data No. 6698 (KVKK)
Non-Compliant Cross-Border Transfer of Turkish Data
The controller transfers data of Turkish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Law on Protection of Personal Data No. 6698 (KVKK).
Legal basis: Law on Protection of Personal Data No. 6698 (KVKK)
Processing Sensitive Data without Written Consent in Nigeria
The website collects sensitive personal records (health, financial details) of Nigerian subjects without prior written explicit consent under the Nigeria Data Protection Act 2023 (NDPA).
Legal basis: Nigeria Data Protection Act 2023 (NDPA)
Inadequate Technical Database Safeguards in Nigeria
The database collects and processes personal files of Nigerian residents without employing mandatory technical encryption or administrative controls required under Nigeria Data Protection Act 2023 (NDPA).
Legal basis: Nigeria Data Protection Act 2023 (NDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1269
NGAPD-004
Non-Compliant Data Retention Cycles in Nigeria
The website retains personal records of Nigerian users longer than necessary for the designated processing purpose without deletion protocols under Nigeria Data Protection Act 2023 (NDPA).
Legal basis: Nigeria Data Protection Act 2023 (NDPA)
Non-Compliant Cross-Border Transfer of Nigerian Data
The controller transfers data of Nigerian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Nigeria Data Protection Act 2023 (NDPA).
Legal basis: Nigeria Data Protection Act 2023 (NDPA)
Processing Sensitive Data without Written Consent in Afghanistan
The website collects sensitive personal records (health, financial details) of Afghan subjects without prior written explicit consent under the Afghan local communications and telecommunications decrees.
Legal basis: Afghan local communications and telecommunications decrees
Inadequate Technical Database Safeguards in Afghanistan
The database collects and processes personal files of Afghan residents without employing mandatory technical encryption or administrative controls required under Afghan local communications and telecommunications decrees.
Legal basis: Afghan local communications and telecommunications decrees
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1274
AFGPD-004
Non-Compliant Data Retention Cycles in Afghanistan
The website retains personal records of Afghan users longer than necessary for the designated processing purpose without deletion protocols under Afghan local communications and telecommunications decrees.
Legal basis: Afghan local communications and telecommunications decrees
Non-Compliant Cross-Border Transfer of Afghan Data
The controller transfers data of Afghan residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Afghan local communications and telecommunications decrees.
Legal basis: Afghan local communications and telecommunications decrees
Processing Sensitive Data without Written Consent in Azerbaijan
The website collects sensitive personal records (health, financial details) of Azerbaijani subjects without prior written explicit consent under the Law of Azerbaijan on Personal Data No. 998-IIIQ.
Legal basis: Law of Azerbaijan on Personal Data No. 998-IIIQ
Processing Personal Data without Authority Notification in Azerbaijan
The website controller collects personal details of Azerbaijani residents without submitting a processing notification to the Ministry of Digital Development.
Legal basis: Law of Azerbaijan on Personal Data No. 998-IIIQ
Inadequate Technical Database Safeguards in Azerbaijan
The database collects and processes personal files of Azerbaijani residents without employing mandatory technical encryption or administrative controls required under Law of Azerbaijan on Personal Data No. 998-IIIQ.
Legal basis: Law of Azerbaijan on Personal Data No. 998-IIIQ
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1279
AZEPD-004
Non-Compliant Data Retention Cycles in Azerbaijan
The website retains personal records of Azerbaijani users longer than necessary for the designated processing purpose without deletion protocols under Law of Azerbaijan on Personal Data No. 998-IIIQ.
Legal basis: Law of Azerbaijan on Personal Data No. 998-IIIQ
Non-Compliant Cross-Border Transfer of Azerbaijani Data
The controller transfers data of Azerbaijani residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Law of Azerbaijan on Personal Data No. 998-IIIQ.
Legal basis: Law of Azerbaijan on Personal Data No. 998-IIIQ
Processing Sensitive Data without Written Consent in Bangladesh
The website collects sensitive personal records (health, financial details) of Bangladeshi subjects without prior written explicit consent under the Information and Communication Technology Act / draft Data Protection Act.
Legal basis: Information and Communication Technology Act / draft Data Protection Act
Processing Personal Data without Authority Notification in Bangladesh
The website controller collects personal details of Bangladeshi residents without submitting a processing notification to the BTRC / Data Protection Authority.
Legal basis: Information and Communication Technology Act / draft Data Protection Act
Inadequate Technical Database Safeguards in Bangladesh
The database collects and processes personal files of Bangladeshi residents without employing mandatory technical encryption or administrative controls required under Information and Communication Technology Act / draft Data Protection Act.
Legal basis: Information and Communication Technology Act / draft Data Protection Act
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1284
BGDPD-004
Non-Compliant Data Retention Cycles in Bangladesh
The website retains personal records of Bangladeshi users longer than necessary for the designated processing purpose without deletion protocols under Information and Communication Technology Act / draft Data Protection Act.
Legal basis: Information and Communication Technology Act / draft Data Protection Act
Non-Compliant Cross-Border Transfer of Bangladeshi Data
The controller transfers data of Bangladeshi residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Information and Communication Technology Act / draft Data Protection Act.
Legal basis: Information and Communication Technology Act / draft Data Protection Act
Processing Sensitive Data without Written Consent in Belarus
The website collects sensitive personal records (health, financial details) of Belarusian subjects without prior written explicit consent under the Law of Belarus No. 99-Z on Protection of Personal Data.
Legal basis: Law of Belarus No. 99-Z on Protection of Personal Data
Processing Personal Data without Authority Notification in Belarus
The website controller collects personal details of Belarusian residents without submitting a processing notification to the National Center for Personal Data Protection.
Legal basis: Law of Belarus No. 99-Z on Protection of Personal Data
Inadequate Technical Database Safeguards in Belarus
The database collects and processes personal files of Belarusian residents without employing mandatory technical encryption or administrative controls required under Law of Belarus No. 99-Z on Protection of Personal Data.
Legal basis: Law of Belarus No. 99-Z on Protection of Personal Data
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1289
BLRPD-004
Non-Compliant Data Retention Cycles in Belarus
The website retains personal records of Belarusian users longer than necessary for the designated processing purpose without deletion protocols under Law of Belarus No. 99-Z on Protection of Personal Data.
Legal basis: Law of Belarus No. 99-Z on Protection of Personal Data
Non-Compliant Cross-Border Transfer of Belarusian Data
The controller transfers data of Belarusian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Law of Belarus No. 99-Z on Protection of Personal Data.
Legal basis: Law of Belarus No. 99-Z on Protection of Personal Data
Processing Sensitive Data without Written Consent in Cameroon
The website collects sensitive personal records (health, financial details) of Cameroonian subjects without prior written explicit consent under the Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality.
Legal basis: Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality
Inadequate Technical Database Safeguards in Cameroon
The database collects and processes personal files of Cameroonian residents without employing mandatory technical encryption or administrative controls required under Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality.
Legal basis: Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1294
CMRPD-004
Non-Compliant Data Retention Cycles in Cameroon
The website retains personal records of Cameroonian users longer than necessary for the designated processing purpose without deletion protocols under Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality.
Legal basis: Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality
Non-Compliant Cross-Border Transfer of Cameroonian Data
The controller transfers data of Cameroonian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality.
Legal basis: Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality
Processing Sensitive Data without Written Consent in Comoros
The website collects sensitive personal records (health, financial details) of Comorian subjects without prior written explicit consent under the Comoros local communications and transaction laws.
Legal basis: Comoros local communications and transaction laws
Inadequate Technical Database Safeguards in Comoros
The database collects and processes personal files of Comorian residents without employing mandatory technical encryption or administrative controls required under Comoros local communications and transaction laws.
Legal basis: Comoros local communications and transaction laws
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1299
COMPD-004
Non-Compliant Data Retention Cycles in Comoros
The website retains personal records of Comorian users longer than necessary for the designated processing purpose without deletion protocols under Comoros local communications and transaction laws.
Legal basis: Comoros local communications and transaction laws
Non-Compliant Cross-Border Transfer of Comorian Data
The controller transfers data of Comorian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Comoros local communications and transaction laws.
Legal basis: Comoros local communications and transaction laws
Processing Sensitive Data without Written Consent in Cuba
The website collects sensitive personal records (health, financial details) of Cuban subjects without prior written explicit consent under the Cuban Decree-Law No. 370 on Informatization of Society.
Legal basis: Cuban Decree-Law No. 370 on Informatization of Society
The database collects and processes personal files of Cuban residents without employing mandatory technical encryption or administrative controls required under Cuban Decree-Law No. 370 on Informatization of Society.
Legal basis: Cuban Decree-Law No. 370 on Informatization of Society
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1304
CUBPD-004
Non-Compliant Data Retention Cycles in Cuba
The website retains personal records of Cuban users longer than necessary for the designated processing purpose without deletion protocols under Cuban Decree-Law No. 370 on Informatization of Society.
Legal basis: Cuban Decree-Law No. 370 on Informatization of Society
The controller transfers data of Cuban residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Cuban Decree-Law No. 370 on Informatization of Society.
Legal basis: Cuban Decree-Law No. 370 on Informatization of Society
Processing Sensitive Data without Written Consent in DR Congo
The website collects sensitive personal records (health, financial details) of Congolese subjects without prior written explicit consent under the DRC Telecom Law No. 20/017 / Cybersecurity framework.
Legal basis: DRC Telecom Law No. 20/017 / Cybersecurity framework
Inadequate Technical Database Safeguards in DR Congo
The database collects and processes personal files of Congolese residents without employing mandatory technical encryption or administrative controls required under DRC Telecom Law No. 20/017 / Cybersecurity framework.
Legal basis: DRC Telecom Law No. 20/017 / Cybersecurity framework
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1309
CODPD-004
Non-Compliant Data Retention Cycles in DR Congo
The website retains personal records of Congolese users longer than necessary for the designated processing purpose without deletion protocols under DRC Telecom Law No. 20/017 / Cybersecurity framework.
Legal basis: DRC Telecom Law No. 20/017 / Cybersecurity framework
Non-Compliant Cross-Border Transfer of Congolese Data
The controller transfers data of Congolese residents outside the country without ensuring adequate protection levels or obtaining required authorizations under DRC Telecom Law No. 20/017 / Cybersecurity framework.
Legal basis: DRC Telecom Law No. 20/017 / Cybersecurity framework
Processing Sensitive Data without Written Consent in Ethiopia
The website collects sensitive personal records (health, financial details) of Ethiopian subjects without prior written explicit consent under the Ethiopian draft Personal Data Protection Proclamation.
Legal basis: Ethiopian draft Personal Data Protection Proclamation
Inadequate Technical Database Safeguards in Ethiopia
The database collects and processes personal files of Ethiopian residents without employing mandatory technical encryption or administrative controls required under Ethiopian draft Personal Data Protection Proclamation.
Legal basis: Ethiopian draft Personal Data Protection Proclamation
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1314
ETHPD-004
Non-Compliant Data Retention Cycles in Ethiopia
The website retains personal records of Ethiopian users longer than necessary for the designated processing purpose without deletion protocols under Ethiopian draft Personal Data Protection Proclamation.
Legal basis: Ethiopian draft Personal Data Protection Proclamation
Non-Compliant Cross-Border Transfer of Ethiopian Data
The controller transfers data of Ethiopian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Ethiopian draft Personal Data Protection Proclamation.
Legal basis: Ethiopian draft Personal Data Protection Proclamation
Processing Sensitive Data without Written Consent in Haiti
The website collects sensitive personal records (health, financial details) of Haitian subjects without prior written explicit consent under the Haitian Cyber Security guidelines / draft privacy rules.
The database collects and processes personal files of Haitian residents without employing mandatory technical encryption or administrative controls required under Haitian Cyber Security guidelines / draft privacy rules.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1319
HTIPD-004
Non-Compliant Data Retention Cycles in Haiti
The website retains personal records of Haitian users longer than necessary for the designated processing purpose without deletion protocols under Haitian Cyber Security guidelines / draft privacy rules.
Non-Compliant Cross-Border Transfer of Haitian Data
The controller transfers data of Haitian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Haitian Cyber Security guidelines / draft privacy rules.
Processing Sensitive Data without Written Consent in Iran
The website collects sensitive personal records (health, financial details) of Iranian subjects without prior written explicit consent under the Iran Cyber Space regulations / draft Personal Data protection.
Legal basis: Iran Cyber Space regulations / draft Personal Data protection
The database collects and processes personal files of Iranian residents without employing mandatory technical encryption or administrative controls required under Iran Cyber Space regulations / draft Personal Data protection.
Legal basis: Iran Cyber Space regulations / draft Personal Data protection
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1324
IRNPD-004
Non-Compliant Data Retention Cycles in Iran
The website retains personal records of Iranian users longer than necessary for the designated processing purpose without deletion protocols under Iran Cyber Space regulations / draft Personal Data protection.
Legal basis: Iran Cyber Space regulations / draft Personal Data protection
Non-Compliant Cross-Border Transfer of Iranian Data
The controller transfers data of Iranian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Iran Cyber Space regulations / draft Personal Data protection.
Legal basis: Iran Cyber Space regulations / draft Personal Data protection
Processing Sensitive Data without Written Consent in Libya
The website collects sensitive personal records (health, financial details) of Libyan subjects without prior written explicit consent under the Libyan local telecom and cybercrime resolutions.
Legal basis: Libyan local telecom and cybercrime resolutions
The database collects and processes personal files of Libyan residents without employing mandatory technical encryption or administrative controls required under Libyan local telecom and cybercrime resolutions.
Legal basis: Libyan local telecom and cybercrime resolutions
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1329
LBYPD-004
Non-Compliant Data Retention Cycles in Libya
The website retains personal records of Libyan users longer than necessary for the designated processing purpose without deletion protocols under Libyan local telecom and cybercrime resolutions.
Legal basis: Libyan local telecom and cybercrime resolutions
Non-Compliant Cross-Border Transfer of Libyan Data
The controller transfers data of Libyan residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Libyan local telecom and cybercrime resolutions.
Legal basis: Libyan local telecom and cybercrime resolutions
Processing Sensitive Data without Written Consent in Nauru
The website collects sensitive personal records (health, financial details) of Nauruan subjects without prior written explicit consent under the Nauru Cybersecurity Act / draft privacy rules.
Legal basis: Nauru Cybersecurity Act / draft privacy rules
Processing Personal Data without Authority Notification in Nauru
The website controller collects personal details of Nauruan residents without submitting a processing notification to the Ministry of Telecommunications.
Legal basis: Nauru Cybersecurity Act / draft privacy rules
The database collects and processes personal files of Nauruan residents without employing mandatory technical encryption or administrative controls required under Nauru Cybersecurity Act / draft privacy rules.
Legal basis: Nauru Cybersecurity Act / draft privacy rules
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1334
NRUPD-004
Non-Compliant Data Retention Cycles in Nauru
The website retains personal records of Nauruan users longer than necessary for the designated processing purpose without deletion protocols under Nauru Cybersecurity Act / draft privacy rules.
Legal basis: Nauru Cybersecurity Act / draft privacy rules
Non-Compliant Cross-Border Transfer of Nauruan Data
The controller transfers data of Nauruan residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Nauru Cybersecurity Act / draft privacy rules.
Legal basis: Nauru Cybersecurity Act / draft privacy rules
Processing Sensitive Data without Written Consent in North Korea
The website collects sensitive personal records (health, financial details) of North Korean subjects without prior written explicit consent under the DPRK Cybersecurity and electronic transactions laws.
Legal basis: DPRK Cybersecurity and electronic transactions laws
Processing Personal Data without Authority Notification in North Korea
The website controller collects personal details of North Korean residents without submitting a processing notification to the Ministry of Posts and Telecommunications.
Legal basis: DPRK Cybersecurity and electronic transactions laws
Inadequate Technical Database Safeguards in North Korea
The database collects and processes personal files of North Korean residents without employing mandatory technical encryption or administrative controls required under DPRK Cybersecurity and electronic transactions laws.
Legal basis: DPRK Cybersecurity and electronic transactions laws
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1339
PRKPD-004
Non-Compliant Data Retention Cycles in North Korea
The website retains personal records of North Korean users longer than necessary for the designated processing purpose without deletion protocols under DPRK Cybersecurity and electronic transactions laws.
Legal basis: DPRK Cybersecurity and electronic transactions laws
Non-Compliant Cross-Border Transfer of North Korean Data
The controller transfers data of North Korean residents outside the country without ensuring adequate protection levels or obtaining required authorizations under DPRK Cybersecurity and electronic transactions laws.
Legal basis: DPRK Cybersecurity and electronic transactions laws
Processing Sensitive Data without Written Consent in Turkmenistan
The website collects sensitive personal records (health, financial details) of Turkmen subjects without prior written explicit consent under the Law of Turkmenistan No. 562-V on Information and its Protection.
Legal basis: Law of Turkmenistan No. 562-V on Information and its Protection
Inadequate Technical Database Safeguards in Turkmenistan
The database collects and processes personal files of Turkmen residents without employing mandatory technical encryption or administrative controls required under Law of Turkmenistan No. 562-V on Information and its Protection.
Legal basis: Law of Turkmenistan No. 562-V on Information and its Protection
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1344
TKMPD-004
Non-Compliant Data Retention Cycles in Turkmenistan
The website retains personal records of Turkmen users longer than necessary for the designated processing purpose without deletion protocols under Law of Turkmenistan No. 562-V on Information and its Protection.
Legal basis: Law of Turkmenistan No. 562-V on Information and its Protection
Non-Compliant Cross-Border Transfer of Turkmen Data
The controller transfers data of Turkmen residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Law of Turkmenistan No. 562-V on Information and its Protection.
Legal basis: Law of Turkmenistan No. 562-V on Information and its Protection
Processing Sensitive Data without Written Consent in Tuvalu
The website collects sensitive personal records (health, financial details) of Tuvaluan subjects without prior written explicit consent under the Tuvalu Cybersecurity and draft privacy rules.
Legal basis: Tuvalu Cybersecurity and draft privacy rules
Inadequate Technical Database Safeguards in Tuvalu
The database collects and processes personal files of Tuvaluan residents without employing mandatory technical encryption or administrative controls required under Tuvalu Cybersecurity and draft privacy rules.
Legal basis: Tuvalu Cybersecurity and draft privacy rules
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1349
TUVPD-004
Non-Compliant Data Retention Cycles in Tuvalu
The website retains personal records of Tuvaluan users longer than necessary for the designated processing purpose without deletion protocols under Tuvalu Cybersecurity and draft privacy rules.
Legal basis: Tuvalu Cybersecurity and draft privacy rules
Non-Compliant Cross-Border Transfer of Tuvaluan Data
The controller transfers data of Tuvaluan residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Tuvalu Cybersecurity and draft privacy rules.
Legal basis: Tuvalu Cybersecurity and draft privacy rules
Processing Sensitive Data without Written Consent in Vatican City
The website collects sensitive personal records (health, financial details) of Vatican subjects without prior written explicit consent under the Vatican local cybersecurity and administrative directives.
Legal basis: Vatican local cybersecurity and administrative directives
Inadequate Technical Database Safeguards in Vatican City
The database collects and processes personal files of Vatican residents without employing mandatory technical encryption or administrative controls required under Vatican local cybersecurity and administrative directives.
Legal basis: Vatican local cybersecurity and administrative directives
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1354
VATPD-004
Non-Compliant Data Retention Cycles in Vatican City
The website retains personal records of Vatican users longer than necessary for the designated processing purpose without deletion protocols under Vatican local cybersecurity and administrative directives.
Legal basis: Vatican local cybersecurity and administrative directives
Non-Compliant Cross-Border Transfer of Vatican Data
The controller transfers data of Vatican residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Vatican local cybersecurity and administrative directives.
Legal basis: Vatican local cybersecurity and administrative directives
Processing Sensitive Data without Written Consent in Western Sahara
The website collects sensitive personal records (health, financial details) of Sahrawi subjects without prior written explicit consent under the Western Sahara local rules / cybersecurity draft.
Legal basis: Western Sahara local rules / cybersecurity draft
Processing Personal Data without Authority Notification in Western Sahara
The website controller collects personal details of Sahrawi residents without submitting a processing notification to the Telecommunications authority.
Legal basis: Western Sahara local rules / cybersecurity draft
Inadequate Technical Database Safeguards in Western Sahara
The database collects and processes personal files of Sahrawi residents without employing mandatory technical encryption or administrative controls required under Western Sahara local rules / cybersecurity draft.
Legal basis: Western Sahara local rules / cybersecurity draft
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1359
ESHPD-004
Non-Compliant Data Retention Cycles in Western Sahara
The website retains personal records of Sahrawi users longer than necessary for the designated processing purpose without deletion protocols under Western Sahara local rules / cybersecurity draft.
Legal basis: Western Sahara local rules / cybersecurity draft
Non-Compliant Cross-Border Transfer of Sahrawi Data
The controller transfers data of Sahrawi residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Western Sahara local rules / cybersecurity draft.
Legal basis: Western Sahara local rules / cybersecurity draft
Processing Sensitive Data without Written Consent in Bulgaria
The website collects sensitive personal records (health, financial details) of Bulgarian subjects without prior written explicit consent under the Bulgarian Personal Data Protection Act.
Legal basis: Bulgarian Personal Data Protection Act
Inadequate Technical Database Safeguards in Bulgaria
The database collects and processes personal files of Bulgarian residents without employing mandatory technical encryption or administrative controls required under Bulgarian Personal Data Protection Act.
Legal basis: Bulgarian Personal Data Protection Act
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1364
BGRPD-004
Non-Compliant Data Retention Cycles in Bulgaria
The website retains personal records of Bulgarian users longer than necessary for the designated processing purpose without deletion protocols under Bulgarian Personal Data Protection Act.
Legal basis: Bulgarian Personal Data Protection Act
Non-Compliant Cross-Border Transfer of Bulgarian Data
The controller transfers data of Bulgarian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Bulgarian Personal Data Protection Act.
Legal basis: Bulgarian Personal Data Protection Act
Processing Sensitive Data without Written Consent in Croatia
The website collects sensitive personal records (health, financial details) of Croatian subjects without prior written explicit consent under the Croatian Act on the Implementation of the General Data Protection Regulation.
Legal basis: Croatian Act on the Implementation of the General Data Protection Regulation
Inadequate Technical Database Safeguards in Croatia
The database collects and processes personal files of Croatian residents without employing mandatory technical encryption or administrative controls required under Croatian Act on the Implementation of the General Data Protection Regulation.
Legal basis: Croatian Act on the Implementation of the General Data Protection Regulation
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1369
HRVPD-004
Non-Compliant Data Retention Cycles in Croatia
The website retains personal records of Croatian users longer than necessary for the designated processing purpose without deletion protocols under Croatian Act on the Implementation of the General Data Protection Regulation.
Legal basis: Croatian Act on the Implementation of the General Data Protection Regulation
Non-Compliant Cross-Border Transfer of Croatian Data
The controller transfers data of Croatian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Croatian Act on the Implementation of the General Data Protection Regulation.
Legal basis: Croatian Act on the Implementation of the General Data Protection Regulation
Processing Sensitive Data without Written Consent in Estonia
The website collects sensitive personal records (health, financial details) of Estonian subjects without prior written explicit consent under the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
Legal basis: Estonian Personal Data Protection Act (Isikuandmete kaitse seadus)
Inadequate Technical Database Safeguards in Estonia
The database collects and processes personal files of Estonian residents without employing mandatory technical encryption or administrative controls required under Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
Legal basis: Estonian Personal Data Protection Act (Isikuandmete kaitse seadus)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1374
ESTPD-004
Non-Compliant Data Retention Cycles in Estonia
The website retains personal records of Estonian users longer than necessary for the designated processing purpose without deletion protocols under Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
Legal basis: Estonian Personal Data Protection Act (Isikuandmete kaitse seadus)
Non-Compliant Cross-Border Transfer of Estonian Data
The controller transfers data of Estonian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
Legal basis: Estonian Personal Data Protection Act (Isikuandmete kaitse seadus)
Processing Sensitive Data without Written Consent in Latvia
The website collects sensitive personal records (health, financial details) of Latvian subjects without prior written explicit consent under the Latvian Personal Data Processing Law.
Inadequate Technical Database Safeguards in Latvia
The database collects and processes personal files of Latvian residents without employing mandatory technical encryption or administrative controls required under Latvian Personal Data Processing Law.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1379
LVAPD-004
Non-Compliant Data Retention Cycles in Latvia
The website retains personal records of Latvian users longer than necessary for the designated processing purpose without deletion protocols under Latvian Personal Data Processing Law.
Non-Compliant Cross-Border Transfer of Latvian Data
The controller transfers data of Latvian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Latvian Personal Data Processing Law.
Processing Sensitive Data without Written Consent in Lithuania
The website collects sensitive personal records (health, financial details) of Lithuanian subjects without prior written explicit consent under the Lithuanian Law on Legal Protection of Personal Data.
Legal basis: Lithuanian Law on Legal Protection of Personal Data
Inadequate Technical Database Safeguards in Lithuania
The database collects and processes personal files of Lithuanian residents without employing mandatory technical encryption or administrative controls required under Lithuanian Law on Legal Protection of Personal Data.
Legal basis: Lithuanian Law on Legal Protection of Personal Data
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1384
LTUPD-004
Non-Compliant Data Retention Cycles in Lithuania
The website retains personal records of Lithuanian users longer than necessary for the designated processing purpose without deletion protocols under Lithuanian Law on Legal Protection of Personal Data.
Legal basis: Lithuanian Law on Legal Protection of Personal Data
Non-Compliant Cross-Border Transfer of Lithuanian Data
The controller transfers data of Lithuanian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Lithuanian Law on Legal Protection of Personal Data.
Legal basis: Lithuanian Law on Legal Protection of Personal Data
Processing Sensitive Data without Written Consent in Cyprus
The website collects sensitive personal records (health, financial details) of Cypriot subjects without prior written explicit consent under the Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law.
Legal basis: Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law
Processing Personal Data without Authority Notification in Cyprus
The website controller collects personal details of Cypriot residents without submitting a processing notification to the Commissioner for Personal Data Protection.
Legal basis: Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law
Inadequate Technical Database Safeguards in Cyprus
The database collects and processes personal files of Cypriot residents without employing mandatory technical encryption or administrative controls required under Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law.
Legal basis: Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1389
CYPPD-004
Non-Compliant Data Retention Cycles in Cyprus
The website retains personal records of Cypriot users longer than necessary for the designated processing purpose without deletion protocols under Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law.
Legal basis: Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law
Non-Compliant Cross-Border Transfer of Cypriot Data
The controller transfers data of Cypriot residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law.
Legal basis: Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law
Processing Sensitive Data without Written Consent in Malta
The website collects sensitive personal records (health, financial details) of Maltese subjects without prior written explicit consent under the Malta Data Protection Act (Cap. 586).
The database collects and processes personal files of Maltese residents without employing mandatory technical encryption or administrative controls required under Malta Data Protection Act (Cap. 586).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1394
MLTPD-004
Non-Compliant Data Retention Cycles in Malta
The website retains personal records of Maltese users longer than necessary for the designated processing purpose without deletion protocols under Malta Data Protection Act (Cap. 586).
Non-Compliant Cross-Border Transfer of Maltese Data
The controller transfers data of Maltese residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Malta Data Protection Act (Cap. 586).
Processing Sensitive Data without Written Consent in Slovakia
The website collects sensitive personal records (health, financial details) of Slovak subjects without prior written explicit consent under the Slovak Act No. 18/2018 Coll. on Personal Data Protection.
Legal basis: Slovak Act No. 18/2018 Coll. on Personal Data Protection
Inadequate Technical Database Safeguards in Slovakia
The database collects and processes personal files of Slovak residents without employing mandatory technical encryption or administrative controls required under Slovak Act No. 18/2018 Coll. on Personal Data Protection.
Legal basis: Slovak Act No. 18/2018 Coll. on Personal Data Protection
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1399
SVKPD-004
Non-Compliant Data Retention Cycles in Slovakia
The website retains personal records of Slovak users longer than necessary for the designated processing purpose without deletion protocols under Slovak Act No. 18/2018 Coll. on Personal Data Protection.
Legal basis: Slovak Act No. 18/2018 Coll. on Personal Data Protection
Non-Compliant Cross-Border Transfer of Slovak Data
The controller transfers data of Slovak residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Slovak Act No. 18/2018 Coll. on Personal Data Protection.
Legal basis: Slovak Act No. 18/2018 Coll. on Personal Data Protection
Processing Sensitive Data without Written Consent in Slovenia
The website collects sensitive personal records (health, financial details) of Slovenian subjects without prior written explicit consent under the Slovenian Personal Data Protection Act (ZVOP-2).
Legal basis: Slovenian Personal Data Protection Act (ZVOP-2)
Inadequate Technical Database Safeguards in Slovenia
The database collects and processes personal files of Slovenian residents without employing mandatory technical encryption or administrative controls required under Slovenian Personal Data Protection Act (ZVOP-2).
Legal basis: Slovenian Personal Data Protection Act (ZVOP-2)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1404
SVNPD-004
Non-Compliant Data Retention Cycles in Slovenia
The website retains personal records of Slovenian users longer than necessary for the designated processing purpose without deletion protocols under Slovenian Personal Data Protection Act (ZVOP-2).
Legal basis: Slovenian Personal Data Protection Act (ZVOP-2)
Non-Compliant Cross-Border Transfer of Slovenian Data
The controller transfers data of Slovenian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Slovenian Personal Data Protection Act (ZVOP-2).
Legal basis: Slovenian Personal Data Protection Act (ZVOP-2)
Processing Sensitive Data without Written Consent in Luxembourg
The website collects sensitive personal records (health, financial details) of Luxembourgish subjects without prior written explicit consent under the Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection.
Legal basis: Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection
Inadequate Technical Database Safeguards in Luxembourg
The database collects and processes personal files of Luxembourgish residents without employing mandatory technical encryption or administrative controls required under Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection.
Legal basis: Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1409
LUXPD-004
Non-Compliant Data Retention Cycles in Luxembourg
The website retains personal records of Luxembourgish users longer than necessary for the designated processing purpose without deletion protocols under Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection.
Legal basis: Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection
Non-Compliant Cross-Border Transfer of Luxembourgish Data
The controller transfers data of Luxembourgish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection.
Legal basis: Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection
Processing Sensitive Data without Written Consent in Czech Republic
The website collects sensitive personal records (health, financial details) of Czech subjects without prior written explicit consent under the Czech Act No. 110/2019 Coll. on Personal Data Processing.
Legal basis: Czech Act No. 110/2019 Coll. on Personal Data Processing
Inadequate Technical Database Safeguards in Czech Republic
The database collects and processes personal files of Czech residents without employing mandatory technical encryption or administrative controls required under Czech Act No. 110/2019 Coll. on Personal Data Processing.
Legal basis: Czech Act No. 110/2019 Coll. on Personal Data Processing
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1414
CZEPD-004
Non-Compliant Data Retention Cycles in Czech Republic
The website retains personal records of Czech users longer than necessary for the designated processing purpose without deletion protocols under Czech Act No. 110/2019 Coll. on Personal Data Processing.
Legal basis: Czech Act No. 110/2019 Coll. on Personal Data Processing
The controller transfers data of Czech residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Czech Act No. 110/2019 Coll. on Personal Data Processing.
Legal basis: Czech Act No. 110/2019 Coll. on Personal Data Processing
Processing Sensitive Data without Written Consent in Hungary
The website collects sensitive personal records (health, financial details) of Hungarian subjects without prior written explicit consent under the Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.
Legal basis: Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information
Inadequate Technical Database Safeguards in Hungary
The database collects and processes personal files of Hungarian residents without employing mandatory technical encryption or administrative controls required under Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.
Legal basis: Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1419
HUNPD-004
Non-Compliant Data Retention Cycles in Hungary
The website retains personal records of Hungarian users longer than necessary for the designated processing purpose without deletion protocols under Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.
Legal basis: Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information
Non-Compliant Cross-Border Transfer of Hungarian Data
The controller transfers data of Hungarian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.
Legal basis: Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information
Processing Sensitive Data without Written Consent in Romania
The website collects sensitive personal records (health, financial details) of Romanian subjects without prior written explicit consent under the Romanian Law No. 190/2018 on implementation measures of GDPR.
Legal basis: Romanian Law No. 190/2018 on implementation measures of GDPR
Inadequate Technical Database Safeguards in Romania
The database collects and processes personal files of Romanian residents without employing mandatory technical encryption or administrative controls required under Romanian Law No. 190/2018 on implementation measures of GDPR.
Legal basis: Romanian Law No. 190/2018 on implementation measures of GDPR
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1424
ROUPD-004
Non-Compliant Data Retention Cycles in Romania
The website retains personal records of Romanian users longer than necessary for the designated processing purpose without deletion protocols under Romanian Law No. 190/2018 on implementation measures of GDPR.
Legal basis: Romanian Law No. 190/2018 on implementation measures of GDPR
Non-Compliant Cross-Border Transfer of Romanian Data
The controller transfers data of Romanian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Romanian Law No. 190/2018 on implementation measures of GDPR.
Legal basis: Romanian Law No. 190/2018 on implementation measures of GDPR
Processing Sensitive Data without Written Consent in Poland
The website collects sensitive personal records (health, financial details) of Polish subjects without prior written explicit consent under the Polish Act of 10 May 2018 on the Protection of Personal Data.
Legal basis: Polish Act of 10 May 2018 on the Protection of Personal Data
Inadequate Technical Database Safeguards in Poland
The database collects and processes personal files of Polish residents without employing mandatory technical encryption or administrative controls required under Polish Act of 10 May 2018 on the Protection of Personal Data.
Legal basis: Polish Act of 10 May 2018 on the Protection of Personal Data
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1429
POLPD-004
Non-Compliant Data Retention Cycles in Poland
The website retains personal records of Polish users longer than necessary for the designated processing purpose without deletion protocols under Polish Act of 10 May 2018 on the Protection of Personal Data.
Legal basis: Polish Act of 10 May 2018 on the Protection of Personal Data
Non-Compliant Cross-Border Transfer of Polish Data
The controller transfers data of Polish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Polish Act of 10 May 2018 on the Protection of Personal Data.
Legal basis: Polish Act of 10 May 2018 on the Protection of Personal Data
Processing Sensitive Data without Written Consent in Ireland
The website collects sensitive personal records (health, financial details) of Irish subjects without prior written explicit consent under the Irish Data Protection Act 2018.
Inadequate Technical Database Safeguards in Ireland
The database collects and processes personal files of Irish residents without employing mandatory technical encryption or administrative controls required under Irish Data Protection Act 2018.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1434
IRLPD-004
Non-Compliant Data Retention Cycles in Ireland
The website retains personal records of Irish users longer than necessary for the designated processing purpose without deletion protocols under Irish Data Protection Act 2018.
The controller transfers data of Irish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Irish Data Protection Act 2018.
Processing Sensitive Data without Written Consent in Austria
The website collects sensitive personal records (health, financial details) of Austrian subjects without prior written explicit consent under the Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG).
Legal basis: Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG)
Inadequate Technical Database Safeguards in Austria
The database collects and processes personal files of Austrian residents without employing mandatory technical encryption or administrative controls required under Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG).
Legal basis: Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1439
AUTPD-004
Non-Compliant Data Retention Cycles in Austria
The website retains personal records of Austrian users longer than necessary for the designated processing purpose without deletion protocols under Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG).
Legal basis: Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG)
Non-Compliant Cross-Border Transfer of Austrian Data
The controller transfers data of Austrian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG).
Legal basis: Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG)
Processing Sensitive Data without Written Consent in Sweden
The website collects sensitive personal records (health, financial details) of Swedish subjects without prior written explicit consent under the Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning).
Legal basis: Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning)
Inadequate Technical Database Safeguards in Sweden
The database collects and processes personal files of Swedish residents without employing mandatory technical encryption or administrative controls required under Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning).
Legal basis: Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1444
SWEPD-004
Non-Compliant Data Retention Cycles in Sweden
The website retains personal records of Swedish users longer than necessary for the designated processing purpose without deletion protocols under Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning).
Legal basis: Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning)
Non-Compliant Cross-Border Transfer of Swedish Data
The controller transfers data of Swedish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning).
Legal basis: Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning)
Processing Sensitive Data without Written Consent in Finland
The website collects sensitive personal records (health, financial details) of Finnish subjects without prior written explicit consent under the Finnish Data Protection Act (Tietosuojalaki 1050/2018).
Legal basis: Finnish Data Protection Act (Tietosuojalaki 1050/2018)
Processing Personal Data without Authority Notification in Finland
The website controller collects personal details of Finnish residents without submitting a processing notification to the Office of the Data Protection Ombudsman.
Legal basis: Finnish Data Protection Act (Tietosuojalaki 1050/2018)
Inadequate Technical Database Safeguards in Finland
The database collects and processes personal files of Finnish residents without employing mandatory technical encryption or administrative controls required under Finnish Data Protection Act (Tietosuojalaki 1050/2018).
Legal basis: Finnish Data Protection Act (Tietosuojalaki 1050/2018)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1449
FLNPD-004
Non-Compliant Data Retention Cycles in Finland
The website retains personal records of Finnish users longer than necessary for the designated processing purpose without deletion protocols under Finnish Data Protection Act (Tietosuojalaki 1050/2018).
Legal basis: Finnish Data Protection Act (Tietosuojalaki 1050/2018)
Non-Compliant Cross-Border Transfer of Finnish Data
The controller transfers data of Finnish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Finnish Data Protection Act (Tietosuojalaki 1050/2018).
Legal basis: Finnish Data Protection Act (Tietosuojalaki 1050/2018)
Processing Sensitive Data without Written Consent in Denmark
The website collects sensitive personal records (health, financial details) of Danish subjects without prior written explicit consent under the Danish Data Protection Act (Databeskyttelsesloven).
Legal basis: Danish Data Protection Act (Databeskyttelsesloven)
Inadequate Technical Database Safeguards in Denmark
The database collects and processes personal files of Danish residents without employing mandatory technical encryption or administrative controls required under Danish Data Protection Act (Databeskyttelsesloven).
Legal basis: Danish Data Protection Act (Databeskyttelsesloven)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1454
DNKPD-004
Non-Compliant Data Retention Cycles in Denmark
The website retains personal records of Danish users longer than necessary for the designated processing purpose without deletion protocols under Danish Data Protection Act (Databeskyttelsesloven).
Legal basis: Danish Data Protection Act (Databeskyttelsesloven)
Non-Compliant Cross-Border Transfer of Danish Data
The controller transfers data of Danish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Danish Data Protection Act (Databeskyttelsesloven).
Legal basis: Danish Data Protection Act (Databeskyttelsesloven)
Processing Sensitive Data without Written Consent in Belgium
The website collects sensitive personal records (health, financial details) of Belgian subjects without prior written explicit consent under the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
Legal basis: Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data
Inadequate Technical Database Safeguards in Belgium
The database collects and processes personal files of Belgian residents without employing mandatory technical encryption or administrative controls required under Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
Legal basis: Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1459
BELPD-004
Non-Compliant Data Retention Cycles in Belgium
The website retains personal records of Belgian users longer than necessary for the designated processing purpose without deletion protocols under Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
Legal basis: Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data
Non-Compliant Cross-Border Transfer of Belgian Data
The controller transfers data of Belgian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
Legal basis: Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data
Processing Sensitive Data without Written Consent in Greece
The website collects sensitive personal records (health, financial details) of Greek subjects without prior written explicit consent under the Greek Law No. 4624/2019 on Personal Data Protection Measures.
Legal basis: Greek Law No. 4624/2019 on Personal Data Protection Measures
Inadequate Technical Database Safeguards in Greece
The database collects and processes personal files of Greek residents without employing mandatory technical encryption or administrative controls required under Greek Law No. 4624/2019 on Personal Data Protection Measures.
Legal basis: Greek Law No. 4624/2019 on Personal Data Protection Measures
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1464
GRCPD-004
Non-Compliant Data Retention Cycles in Greece
The website retains personal records of Greek users longer than necessary for the designated processing purpose without deletion protocols under Greek Law No. 4624/2019 on Personal Data Protection Measures.
Legal basis: Greek Law No. 4624/2019 on Personal Data Protection Measures
The controller transfers data of Greek residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Greek Law No. 4624/2019 on Personal Data Protection Measures.
Legal basis: Greek Law No. 4624/2019 on Personal Data Protection Measures
Processing Sensitive Data without Written Consent in Portugal
The website collects sensitive personal records (health, financial details) of Portuguese subjects without prior written explicit consent under the Portuguese Law No. 58/2019 on execution rules of GDPR.
Legal basis: Portuguese Law No. 58/2019 on execution rules of GDPR
Inadequate Technical Database Safeguards in Portugal
The database collects and processes personal files of Portuguese residents without employing mandatory technical encryption or administrative controls required under Portuguese Law No. 58/2019 on execution rules of GDPR.
Legal basis: Portuguese Law No. 58/2019 on execution rules of GDPR
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1469
PRTPD-004
Non-Compliant Data Retention Cycles in Portugal
The website retains personal records of Portuguese users longer than necessary for the designated processing purpose without deletion protocols under Portuguese Law No. 58/2019 on execution rules of GDPR.
Legal basis: Portuguese Law No. 58/2019 on execution rules of GDPR
Non-Compliant Cross-Border Transfer of Portuguese Data
The controller transfers data of Portuguese residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Portuguese Law No. 58/2019 on execution rules of GDPR.
Legal basis: Portuguese Law No. 58/2019 on execution rules of GDPR
Processing Sensitive Data without Written Consent in Greenland
The website collects sensitive personal records (health, financial details) of Greenlandic subjects without prior written explicit consent under the Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland).
Legal basis: Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland)
Inadequate Technical Database Safeguards in Greenland
The database collects and processes personal files of Greenlandic residents without employing mandatory technical encryption or administrative controls required under Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland).
Legal basis: Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1474
GRLPD-004
Non-Compliant Data Retention Cycles in Greenland
The website retains personal records of Greenlandic users longer than necessary for the designated processing purpose without deletion protocols under Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland).
Legal basis: Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland)
Non-Compliant Cross-Border Transfer of Greenlandic Data
The controller transfers data of Greenlandic residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland).
Legal basis: Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland)
Processing Sensitive Data without Written Consent in Falkland Islands
The website collects sensitive personal records (health, financial details) of Falkland Islands subjects without prior written explicit consent under the Falkland Islands Data Protection Ordinance 2018.
Legal basis: Falkland Islands Data Protection Ordinance 2018
Processing Personal Data without Authority Notification in Falkland Islands
The website controller collects personal details of Falkland Islands residents without submitting a processing notification to the Data Protection Commissioner.
Legal basis: Falkland Islands Data Protection Ordinance 2018
Inadequate Technical Database Safeguards in Falkland Islands
The database collects and processes personal files of Falkland Islands residents without employing mandatory technical encryption or administrative controls required under Falkland Islands Data Protection Ordinance 2018.
Legal basis: Falkland Islands Data Protection Ordinance 2018
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1479
FLKPD-004
Non-Compliant Data Retention Cycles in Falkland Islands
The website retains personal records of Falkland Islands users longer than necessary for the designated processing purpose without deletion protocols under Falkland Islands Data Protection Ordinance 2018.
Legal basis: Falkland Islands Data Protection Ordinance 2018
Non-Compliant Cross-Border Transfer of Falkland Islands Data
The controller transfers data of Falkland Islands residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Falkland Islands Data Protection Ordinance 2018.
Legal basis: Falkland Islands Data Protection Ordinance 2018
Processing Sensitive Data without Written Consent in French Polynesia
The website collects sensitive personal records (health, financial details) of French Polynesian subjects without prior written explicit consent under the French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés).
Legal basis: French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés)
Inadequate Technical Database Safeguards in French Polynesia
The database collects and processes personal files of French Polynesian residents without employing mandatory technical encryption or administrative controls required under French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés).
Legal basis: French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1484
PYFPD-004
Non-Compliant Data Retention Cycles in French Polynesia
The website retains personal records of French Polynesian users longer than necessary for the designated processing purpose without deletion protocols under French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés).
Legal basis: French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés)
Non-Compliant Cross-Border Transfer of French Polynesian Data
The controller transfers data of French Polynesian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés).
Legal basis: French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés)
Processing Sensitive Data without Written Consent in New Caledonia
The website collects sensitive personal records (health, financial details) of New Caledonian subjects without prior written explicit consent under the French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés).
Legal basis: French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés)
Inadequate Technical Database Safeguards in New Caledonia
The database collects and processes personal files of New Caledonian residents without employing mandatory technical encryption or administrative controls required under French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés).
Legal basis: French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1489
NCLPD-004
Non-Compliant Data Retention Cycles in New Caledonia
The website retains personal records of New Caledonian users longer than necessary for the designated processing purpose without deletion protocols under French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés).
Legal basis: French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés)
Non-Compliant Cross-Border Transfer of New Caledonian Data
The controller transfers data of New Caledonian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés).
Legal basis: French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés)
Processing Sensitive Data without Written Consent in Montserrat
The website collects sensitive personal records (health, financial details) of Montserratian subjects without prior written explicit consent under the Montserrat draft Data Protection Act / cybersecurity rules.
Legal basis: Montserrat draft Data Protection Act / cybersecurity rules
Processing Personal Data without Authority Notification in Montserrat
The website controller collects personal details of Montserratian residents without submitting a processing notification to the Data Protection Commissioner.
Legal basis: Montserrat draft Data Protection Act / cybersecurity rules
Inadequate Technical Database Safeguards in Montserrat
The database collects and processes personal files of Montserratian residents without employing mandatory technical encryption or administrative controls required under Montserrat draft Data Protection Act / cybersecurity rules.
Legal basis: Montserrat draft Data Protection Act / cybersecurity rules
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1494
MSRPD-004
Non-Compliant Data Retention Cycles in Montserrat
The website retains personal records of Montserratian users longer than necessary for the designated processing purpose without deletion protocols under Montserrat draft Data Protection Act / cybersecurity rules.
Legal basis: Montserrat draft Data Protection Act / cybersecurity rules
Non-Compliant Cross-Border Transfer of Montserratian Data
The controller transfers data of Montserratian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Montserrat draft Data Protection Act / cybersecurity rules.
Legal basis: Montserrat draft Data Protection Act / cybersecurity rules
Processing Sensitive Data without Written Consent in Saint Helena
The website collects sensitive personal records (health, financial details) of Saint Helenian subjects without prior written explicit consent under the Saint Helena Data Protection Ordinance / draft privacy rules.
Legal basis: Saint Helena Data Protection Ordinance / draft privacy rules
Processing Personal Data without Authority Notification in Saint Helena
The website controller collects personal details of Saint Helenian residents without submitting a processing notification to the Data Protection Commissioner.
Legal basis: Saint Helena Data Protection Ordinance / draft privacy rules
Inadequate Technical Database Safeguards in Saint Helena
The database collects and processes personal files of Saint Helenian residents without employing mandatory technical encryption or administrative controls required under Saint Helena Data Protection Ordinance / draft privacy rules.
Legal basis: Saint Helena Data Protection Ordinance / draft privacy rules
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1499
SHNPD-004
Non-Compliant Data Retention Cycles in Saint Helena
The website retains personal records of Saint Helenian users longer than necessary for the designated processing purpose without deletion protocols under Saint Helena Data Protection Ordinance / draft privacy rules.
Legal basis: Saint Helena Data Protection Ordinance / draft privacy rules
Non-Compliant Cross-Border Transfer of Saint Helenian Data
The controller transfers data of Saint Helenian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Saint Helena Data Protection Ordinance / draft privacy rules.
Legal basis: Saint Helena Data Protection Ordinance / draft privacy rules
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1552
EUDSA-002
Missing Terms for Content Moderation Rules
The terms of service fail to disclose algorithmic filters or human review policies used to moderate comments.
Legal basis: EU Digital Services Act (DSA) Article 14
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1553
EUDSA-003
Lack of Recommender System Parameter Transparency
The website presents recommendations or product order feeds without explaining the main sorting factors.
Legal basis: EU Digital Services Act (DSA) Article 27
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1555
EUDSA-005
Unlabeled Online Advertisements and Sponsors
Paid promotional links or sponsored items load inside content streams without clear labels identifying the buyer.
Legal basis: EU Digital Services Act (DSA) Article 26
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1556
EUDSA-006
Missing Notice-and-Action Mechanism for Users
The portal provides no clear, accessible digital form for visitors to flag illegal comments or items.
Legal basis: EU Digital Services Act (DSA) Article 16
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1557
EUDSA-007
Non-Compliant User Suspension Rules
The website blocks accounts or removes seller items without providing a detailed, written justification.
Legal basis: EU Digital Services Act (DSA) Article 17
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1558
EUDSA-008
Missing Statements of Reasons in Public Directory
The web host moderates third-party comments without publishing decisions in the EU DSA Database.
Legal basis: EU Digital Services Act (DSA) Article 24(5)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1559
EUDSA-009
Inadequate Complaint Handling System
The website provides no digital appeal mechanism allowing users to challenge moderation rulings for 6 months.
Legal basis: EU Digital Services Act (DSA) Article 20
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1560
EUDSA-010
Deceptive Advertising Targeting Policies
The website uses sensitive personal details (religion, health, orientation) to target promotional banners.
Legal basis: EU Digital Services Act (DSA) Article 26
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1561
EUDMA-001
Unfair Self-Preferencing in Product Listings
The store search engine ranks owner-branded goods higher than equivalent third-party seller inventory.
Legal basis: EU Digital Markets Act (DMA) Article 6(5)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1562
EUDMA-002
Unlawful Multi-Source Data Combination
The portal combines user data from core services with third-party tracking pixels without explicit opt-in.
Legal basis: EU Digital Markets Act (DMA) Article 5(2)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1563
EUDMA-003
Restricting Third-Party Software Side-Loading
The web portal restricts users from running external payment integrations or browsers within the page framework.
Legal basis: EU Digital Markets Act (DMA) Article 6(4)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1564
EUDMA-004
Restricting Business User Data Portability
The website checkout dashboard blocks sellers from exporting their transaction history to external servers.
Legal basis: EU Digital Markets Act (DMA) Article 6(10)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1565
EUDMA-005
Unfair Advertising Performance Reporting
The system charges advertisers for promotional space without sharing free daily performance metrics.
Legal basis: EU Digital Markets Act (DMA) Article 6(8)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1567
EUDMA-007
Deceptive Choice Screen Implementation
The system configures default search engines or browsers during setup without presenting unbiased options.
Legal basis: EU Digital Markets Act (DMA) Article 6(3)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1568
EUDMA-008
Restricting Platform Services Interoperability
The API restricts third-party communication tools from linking with the core messaging system.
Legal basis: EU Digital Markets Act (DMA) Article 6(7)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1569
EUDMA-009
Deceptive and Complex Unsubscribe Flows
The portal forces business users through telephone confirmation lines to terminate core service access.
Legal basis: EU Digital Markets Act (DMA) Article 6(13)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1570
EUDMA-010
Unlawful Exploitation of Business User Sales Data
The website host uses non-public checkout transaction data from sellers to launch competing direct products.
Legal basis: EU Digital Markets Act (DMA) Article 6(2)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1571
UKAAC-001
Inadequate Age Verification for Sensitive Content
The portal uses a simple, unverified self-declaration button for age verification on mature media streams.
Legal basis: UK Age Appropriate Design Code (Children's Code) Standard 3
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,663–$7,988 per violation (CCPA) / $2,500–$7,500 per affected child (AB 2273, partly blocked by a court)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1588
CAAAC-008
Failure to Provide Clear, Prominent, and Child-Friendly Privacy Terms (California AADC)
A business that provides an online service, product, or feature likely to be accessed by children fails to provide privacy information, terms of service, policies, and community standards concisely, prominently, and using clear language suited to the age of children likely to access the service.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1592
EUAIA-002
Missing Generative AI Content Disclosures
Synthetic images or AI-generated news items lack machine-readable labels detecting the artificial origin.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1593
EUAIA-003
Prohibited Deployments of Emotion Recognition Systems
The website employs AI tracking camera inputs to analyze candidate emotions during online job tests.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1594
EUAIA-004
Unlawful Biometric Classification Implementations
AI analytics categorize visitors based on biometric profiles to target gender-specific product catalogs.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1595
EUAIA-005
Deceptive Deepfake Image and Video Disclosures
Realistic altered video or audio files load inside media streams without explicit altered-content warnings.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1596
EUAIA-006
Inadequate High-Risk AI System Risk Management
The online portal deploys automated CV ranking software without pre-deployment testing and risk documentation.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1597
EUAIA-007
Missing Logging Capabilities for High-Risk AI Systems
Automated pricing models operate on checkouts without records tracking raw telemetry input parameters.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1598
EUAIA-008
Lack of Human Oversight in Automated Recruitment
AI hiring screening results reject candidates automatically without a human review or appeal path.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1599
EUAIA-009
Unlawful Web Data Scraping for AI Training
Scraping agents fetch copyright images from website storage to train AI models without honoring opt-out flags.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1600
EUAIA-010
Insecure High-Risk AI Database Integration
The automated credit eligibility model runs on the server without registering in the public EU AI database.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1601
TXDPS-001
Inaccessible Data Access Channel under Texas Data Privacy and Security Act (TDPSA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Texas Data Privacy and Security Act (TDPSA).
Legal basis: Texas Data Privacy and Security Act (TDPSA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1602
TXDPS-002
Missing Data Rectification Form under Texas Data Privacy and Security Act (TDPSA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Texas Data Privacy and Security Act (TDPSA).
Legal basis: Texas Data Privacy and Security Act (TDPSA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1603
TXDPS-003
Inaccessible Data Deletion Portal under Texas Data Privacy and Security Act (TDPSA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Texas Data Privacy and Security Act (TDPSA).
Legal basis: Texas Data Privacy and Security Act (TDPSA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1604
TXDPS-004
Lack of Data Portability Export under Texas Data Privacy and Security Act (TDPSA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Texas Data Privacy and Security Act (TDPSA).
Legal basis: Texas Data Privacy and Security Act (TDPSA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1606
TXDPS-006
Missing Opt-Out of Personal Data Sales under Texas Data Privacy and Security Act (TDPSA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Texas Data Privacy and Security Act (TDPSA).
Legal basis: Texas Data Privacy and Security Act (TDPSA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1608
TXDPS-008
Processing Sensitive Data without Consent under Texas Data Privacy and Security Act (TDPSA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Texas Data Privacy and Security Act (TDPSA).
Legal basis: Texas Data Privacy and Security Act (TDPSA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1609
TXDPS-009
Missing Data Protection Impact Assessment under Texas Data Privacy and Security Act (TDPSA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Texas Data Privacy and Security Act (TDPSA).
Legal basis: Texas Data Privacy and Security Act (TDPSA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1611
VCDPA-001
Inaccessible Data Access Channel under Virginia Consumer Data Protection Act (VCDPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Virginia Consumer Data Protection Act (VCDPA).
Legal basis: Virginia Consumer Data Protection Act (VCDPA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1612
VCDPA-002
Missing Data Rectification Form under Virginia Consumer Data Protection Act (VCDPA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Virginia Consumer Data Protection Act (VCDPA).
Legal basis: Virginia Consumer Data Protection Act (VCDPA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1613
VCDPA-003
Inaccessible Data Deletion Portal under Virginia Consumer Data Protection Act (VCDPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Virginia Consumer Data Protection Act (VCDPA).
Legal basis: Virginia Consumer Data Protection Act (VCDPA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1614
VCDPA-004
Lack of Data Portability Export under Virginia Consumer Data Protection Act (VCDPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Virginia Consumer Data Protection Act (VCDPA).
Legal basis: Virginia Consumer Data Protection Act (VCDPA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1615
VCDPA-005
Missing Opt-Out of Targeted Advertising under Virginia Consumer Data Protection Act (VCDPA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Virginia Consumer Data Protection Act (VCDPA).
Legal basis: Virginia Consumer Data Protection Act (VCDPA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1616
VCDPA-006
Missing Opt-Out of Personal Data Sales under Virginia Consumer Data Protection Act (VCDPA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Virginia Consumer Data Protection Act (VCDPA).
Legal basis: Virginia Consumer Data Protection Act (VCDPA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1617
VCDPA-007
Missing Opt-Out of Automated Profiling under Virginia Consumer Data Protection Act (VCDPA)
The website uses automated decision models for client eligibility without providing an opt-out under the Virginia Consumer Data Protection Act (VCDPA).
Legal basis: Virginia Consumer Data Protection Act (VCDPA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1618
VCDPA-008
Processing Sensitive Data without Consent under Virginia Consumer Data Protection Act (VCDPA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Virginia Consumer Data Protection Act (VCDPA).
Legal basis: Virginia Consumer Data Protection Act (VCDPA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1619
VCDPA-009
Missing Data Protection Impact Assessment under Virginia Consumer Data Protection Act (VCDPA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Virginia Consumer Data Protection Act (VCDPA).
Legal basis: Virginia Consumer Data Protection Act (VCDPA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1620
VCDPA-010
Non-Compliant Notice at Collection under Virginia Consumer Data Protection Act (VCDPA)
The website collects personal details without presenting a compliant privacy disclosure notice under the Virginia Consumer Data Protection Act (VCDPA).
Legal basis: Virginia Consumer Data Protection Act (VCDPA)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1621
COPR-001
Inaccessible Data Access Channel under Colorado Privacy Act (CPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Colorado Privacy Act (CPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1631
CTDPA-001
Inaccessible Data Access Channel under Connecticut Data Privacy Act (CTDPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Connecticut Data Privacy Act (CTDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1632
CTDPA-002
Missing Data Rectification Form under Connecticut Data Privacy Act (CTDPA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Connecticut Data Privacy Act (CTDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1633
CTDPA-003
Inaccessible Data Deletion Portal under Connecticut Data Privacy Act (CTDPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Connecticut Data Privacy Act (CTDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1634
CTDPA-004
Lack of Data Portability Export under Connecticut Data Privacy Act (CTDPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Connecticut Data Privacy Act (CTDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1641
UCPA-001
Inaccessible Data Access Channel under Utah Consumer Privacy Act (UCPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Utah Consumer Privacy Act (UCPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1651
ORCPA-001
Inaccessible Data Access Channel under Oregon Consumer Privacy Act (OCPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Oregon Consumer Privacy Act (OCPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1653
ORCPA-003
Inaccessible Data Deletion Portal under Oregon Consumer Privacy Act (OCPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Oregon Consumer Privacy Act (OCPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1654
ORCPA-004
Lack of Data Portability Export under Oregon Consumer Privacy Act (OCPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Oregon Consumer Privacy Act (OCPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1661
FLORDB-001
Inaccessible Data Access Channel under Florida Digital Bill of Rights (FDBR)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Florida Digital Bill of Rights (FDBR).
Legal basis: Florida Digital Bill of Rights (FDBR)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1662
FLORDB-002
Missing Data Rectification Form under Florida Digital Bill of Rights (FDBR)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Florida Digital Bill of Rights (FDBR).
Legal basis: Florida Digital Bill of Rights (FDBR)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1663
FLORDB-003
Inaccessible Data Deletion Portal under Florida Digital Bill of Rights (FDBR)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Florida Digital Bill of Rights (FDBR).
Legal basis: Florida Digital Bill of Rights (FDBR)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1664
FLORDB-004
Lack of Data Portability Export under Florida Digital Bill of Rights (FDBR)
The website fails to offer a portable, structured format for users to download and transfer their records under the Florida Digital Bill of Rights (FDBR).
Legal basis: Florida Digital Bill of Rights (FDBR)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1666
FLORDB-006
Missing Opt-Out of Personal Data Sales under Florida Digital Bill of Rights (FDBR)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Florida Digital Bill of Rights (FDBR).
Legal basis: Florida Digital Bill of Rights (FDBR)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1671
PIPEDA-001
Inaccessible Data Access Channel under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
Legal basis: Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1672
PIPEDA-002
Missing Data Rectification Form under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
Legal basis: Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1673
PIPEDA-003
Inaccessible Data Deletion Portal under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
Legal basis: Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1674
PIPEDA-004
Lack of Data Portability Export under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
Legal basis: Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1675
PIPEDA-005
Missing Opt-Out of Targeted Advertising under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
Legal basis: Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1676
PIPEDA-006
Missing Opt-Out of Personal Data Sales under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
Legal basis: Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1677
PIPEDA-007
Missing Opt-Out of Automated Profiling under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website uses automated decision models for client eligibility without providing an opt-out under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
Legal basis: Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1678
PIPEDA-008
Processing Sensitive Data without Consent under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
Legal basis: Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1679
PIPEDA-009
Missing Data Protection Impact Assessment under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
Legal basis: Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1680
PIPEDA-010
Non-Compliant Notice at Collection under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website collects personal details without presenting a compliant privacy disclosure notice under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
Legal basis: Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1681
LAW25-001
Inaccessible Data Access Channel under Quebec Law 25
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Quebec Law 25.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1682
LAW25-002
Missing Data Rectification Form under Quebec Law 25
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Quebec Law 25.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1683
LAW25-003
Inaccessible Data Deletion Portal under Quebec Law 25
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Quebec Law 25.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1684
LAW25-004
Lack of Data Portability Export under Quebec Law 25
The website fails to offer a portable, structured format for users to download and transfer their records under the Quebec Law 25.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1685
LAW25-005
Missing Opt-Out of Targeted Advertising under Quebec Law 25
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Quebec Law 25.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1686
LAW25-006
Missing Opt-Out of Personal Data Sales under Quebec Law 25
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Quebec Law 25.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1687
LAW25-007
Missing Opt-Out of Automated Profiling under Quebec Law 25
The website uses automated decision models for client eligibility without providing an opt-out under the Quebec Law 25.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1688
LAW25-008
Processing Sensitive Data without Consent under Quebec Law 25
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Quebec Law 25.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1689
LAW25-009
Missing Data Protection Impact Assessment under Quebec Law 25
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Quebec Law 25.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1690
LAW25-010
Non-Compliant Notice at Collection under Quebec Law 25
The website collects personal details without presenting a compliant privacy disclosure notice under the Quebec Law 25.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1691
TDDDG-001
Inaccessible Data Access Channel under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
Legal basis: German Telecommunications-Telemedia Data Protection Act (TDDDG)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1692
TDDDG-002
Missing Data Rectification Form under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
Legal basis: German Telecommunications-Telemedia Data Protection Act (TDDDG)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1693
TDDDG-003
Inaccessible Data Deletion Portal under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
Legal basis: German Telecommunications-Telemedia Data Protection Act (TDDDG)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1694
TDDDG-004
Lack of Data Portability Export under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website fails to offer a portable, structured format for users to download and transfer their records under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
Legal basis: German Telecommunications-Telemedia Data Protection Act (TDDDG)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1695
TDDDG-005
Missing Opt-Out of Targeted Advertising under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
Legal basis: German Telecommunications-Telemedia Data Protection Act (TDDDG)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1696
TDDDG-006
Missing Opt-Out of Personal Data Sales under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
Legal basis: German Telecommunications-Telemedia Data Protection Act (TDDDG)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1697
TDDDG-007
Missing Opt-Out of Automated Profiling under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website uses automated decision models for client eligibility without providing an opt-out under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
Legal basis: German Telecommunications-Telemedia Data Protection Act (TDDDG)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1698
TDDDG-008
Processing Sensitive Data without Consent under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
Legal basis: German Telecommunications-Telemedia Data Protection Act (TDDDG)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1699
TDDDG-009
Missing Data Protection Impact Assessment under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
Legal basis: German Telecommunications-Telemedia Data Protection Act (TDDDG)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1700
TDDDG-010
Non-Compliant Notice at Collection under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website collects personal details without presenting a compliant privacy disclosure notice under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
Legal basis: German Telecommunications-Telemedia Data Protection Act (TDDDG)
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1701
SGPDPA-001
Inaccessible Data Access Channel under Singapore Personal Data Protection Act (PDPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Singapore Personal Data Protection Act (PDPA).
Legal basis: Singapore Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1702
SGPDPA-002
Missing Data Rectification Form under Singapore Personal Data Protection Act (PDPA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Singapore Personal Data Protection Act (PDPA).
Legal basis: Singapore Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1703
SGPDPA-003
Inaccessible Data Deletion Portal under Singapore Personal Data Protection Act (PDPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Singapore Personal Data Protection Act (PDPA).
Legal basis: Singapore Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1704
SGPDPA-004
Lack of Data Portability Export under Singapore Personal Data Protection Act (PDPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Singapore Personal Data Protection Act (PDPA).
Legal basis: Singapore Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1705
SGPDPA-005
Missing Opt-Out of Targeted Advertising under Singapore Personal Data Protection Act (PDPA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Singapore Personal Data Protection Act (PDPA).
Legal basis: Singapore Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1706
SGPDPA-006
Missing Opt-Out of Personal Data Sales under Singapore Personal Data Protection Act (PDPA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Singapore Personal Data Protection Act (PDPA).
Legal basis: Singapore Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1707
SGPDPA-007
Missing Opt-Out of Automated Profiling under Singapore Personal Data Protection Act (PDPA)
The website uses automated decision models for client eligibility without providing an opt-out under the Singapore Personal Data Protection Act (PDPA).
Legal basis: Singapore Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1708
SGPDPA-008
Processing Sensitive Data without Consent under Singapore Personal Data Protection Act (PDPA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Singapore Personal Data Protection Act (PDPA).
Legal basis: Singapore Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1709
SGPDPA-009
Missing Data Protection Impact Assessment under Singapore Personal Data Protection Act (PDPA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Singapore Personal Data Protection Act (PDPA).
Legal basis: Singapore Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1710
SGPDPA-010
Non-Compliant Notice at Collection under Singapore Personal Data Protection Act (PDPA)
The website collects personal details without presenting a compliant privacy disclosure notice under the Singapore Personal Data Protection Act (PDPA).
Legal basis: Singapore Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1711
AUSAPP-001
Inaccessible Data Access Channel under Australian Privacy Principles (APPs)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Australian Privacy Principles (APPs).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1712
AUSAPP-002
Missing Data Rectification Form under Australian Privacy Principles (APPs)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Australian Privacy Principles (APPs).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1713
AUSAPP-003
Inaccessible Data Deletion Portal under Australian Privacy Principles (APPs)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Australian Privacy Principles (APPs).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1714
AUSAPP-004
Lack of Data Portability Export under Australian Privacy Principles (APPs)
The website fails to offer a portable, structured format for users to download and transfer their records under the Australian Privacy Principles (APPs).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1715
AUSAPP-005
Missing Opt-Out of Targeted Advertising under Australian Privacy Principles (APPs)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Australian Privacy Principles (APPs).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1716
AUSAPP-006
Missing Opt-Out of Personal Data Sales under Australian Privacy Principles (APPs)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Australian Privacy Principles (APPs).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1717
AUSAPP-007
Missing Opt-Out of Automated Profiling under Australian Privacy Principles (APPs)
The website uses automated decision models for client eligibility without providing an opt-out under the Australian Privacy Principles (APPs).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1718
AUSAPP-008
Processing Sensitive Data without Consent under Australian Privacy Principles (APPs)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Australian Privacy Principles (APPs).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1719
AUSAPP-009
Missing Data Protection Impact Assessment under Australian Privacy Principles (APPs)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Australian Privacy Principles (APPs).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1720
AUSAPP-010
Non-Compliant Notice at Collection under Australian Privacy Principles (APPs)
The website collects personal details without presenting a compliant privacy disclosure notice under the Australian Privacy Principles (APPs).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1721
NZPRIV-001
Inaccessible Data Access Channel under New Zealand Privacy Act 2020
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the New Zealand Privacy Act 2020.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1722
NZPRIV-002
Missing Data Rectification Form under New Zealand Privacy Act 2020
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the New Zealand Privacy Act 2020.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1723
NZPRIV-003
Inaccessible Data Deletion Portal under New Zealand Privacy Act 2020
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the New Zealand Privacy Act 2020.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1724
NZPRIV-004
Lack of Data Portability Export under New Zealand Privacy Act 2020
The website fails to offer a portable, structured format for users to download and transfer their records under the New Zealand Privacy Act 2020.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1725
NZPRIV-005
Missing Opt-Out of Targeted Advertising under New Zealand Privacy Act 2020
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the New Zealand Privacy Act 2020.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1726
NZPRIV-006
Missing Opt-Out of Personal Data Sales under New Zealand Privacy Act 2020
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the New Zealand Privacy Act 2020.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1727
NZPRIV-007
Missing Opt-Out of Automated Profiling under New Zealand Privacy Act 2020
The website uses automated decision models for client eligibility without providing an opt-out under the New Zealand Privacy Act 2020.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1728
NZPRIV-008
Processing Sensitive Data without Consent under New Zealand Privacy Act 2020
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the New Zealand Privacy Act 2020.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1729
NZPRIV-009
Missing Data Protection Impact Assessment under New Zealand Privacy Act 2020
The organization fails to conduct or document required risk assessments for high-risk web profiling under the New Zealand Privacy Act 2020.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1730
NZPRIV-010
Non-Compliant Notice at Collection under New Zealand Privacy Act 2020
The website collects personal details without presenting a compliant privacy disclosure notice under the New Zealand Privacy Act 2020.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1731
JPAPPI-001
Inaccessible Data Access Channel under Japan Act on the Protection of Personal Information (APPI)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Japan Act on the Protection of Personal Information (APPI).
Legal basis: Japan Act on the Protection of Personal Information (APPI)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1732
JPAPPI-002
Missing Data Rectification Form under Japan Act on the Protection of Personal Information (APPI)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Japan Act on the Protection of Personal Information (APPI).
Legal basis: Japan Act on the Protection of Personal Information (APPI)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1733
JPAPPI-003
Inaccessible Data Deletion Portal under Japan Act on the Protection of Personal Information (APPI)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Japan Act on the Protection of Personal Information (APPI).
Legal basis: Japan Act on the Protection of Personal Information (APPI)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1734
JPAPPI-004
Lack of Data Portability Export under Japan Act on the Protection of Personal Information (APPI)
The website fails to offer a portable, structured format for users to download and transfer their records under the Japan Act on the Protection of Personal Information (APPI).
Legal basis: Japan Act on the Protection of Personal Information (APPI)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1735
JPAPPI-005
Missing Opt-Out of Targeted Advertising under Japan Act on the Protection of Personal Information (APPI)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Japan Act on the Protection of Personal Information (APPI).
Legal basis: Japan Act on the Protection of Personal Information (APPI)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1736
JPAPPI-006
Missing Opt-Out of Personal Data Sales under Japan Act on the Protection of Personal Information (APPI)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Japan Act on the Protection of Personal Information (APPI).
Legal basis: Japan Act on the Protection of Personal Information (APPI)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1737
JPAPPI-007
Missing Opt-Out of Automated Profiling under Japan Act on the Protection of Personal Information (APPI)
The website uses automated decision models for client eligibility without providing an opt-out under the Japan Act on the Protection of Personal Information (APPI).
Legal basis: Japan Act on the Protection of Personal Information (APPI)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1738
JPAPPI-008
Processing Sensitive Data without Consent under Japan Act on the Protection of Personal Information (APPI)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Japan Act on the Protection of Personal Information (APPI).
Legal basis: Japan Act on the Protection of Personal Information (APPI)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1739
JPAPPI-009
Missing Data Protection Impact Assessment under Japan Act on the Protection of Personal Information (APPI)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Japan Act on the Protection of Personal Information (APPI).
Legal basis: Japan Act on the Protection of Personal Information (APPI)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1740
JPAPPI-010
Non-Compliant Notice at Collection under Japan Act on the Protection of Personal Information (APPI)
The website collects personal details without presenting a compliant privacy disclosure notice under the Japan Act on the Protection of Personal Information (APPI).
Legal basis: Japan Act on the Protection of Personal Information (APPI)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1741
KRPIPA-001
Inaccessible Data Access Channel under South Korea Personal Information Protection Act (PIPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the South Korea Personal Information Protection Act (PIPA).
Legal basis: South Korea Personal Information Protection Act (PIPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1742
KRPIPA-002
Missing Data Rectification Form under South Korea Personal Information Protection Act (PIPA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the South Korea Personal Information Protection Act (PIPA).
Legal basis: South Korea Personal Information Protection Act (PIPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1743
KRPIPA-003
Inaccessible Data Deletion Portal under South Korea Personal Information Protection Act (PIPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the South Korea Personal Information Protection Act (PIPA).
Legal basis: South Korea Personal Information Protection Act (PIPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1744
KRPIPA-004
Lack of Data Portability Export under South Korea Personal Information Protection Act (PIPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the South Korea Personal Information Protection Act (PIPA).
Legal basis: South Korea Personal Information Protection Act (PIPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1745
KRPIPA-005
Missing Opt-Out of Targeted Advertising under South Korea Personal Information Protection Act (PIPA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the South Korea Personal Information Protection Act (PIPA).
Legal basis: South Korea Personal Information Protection Act (PIPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1746
KRPIPA-006
Missing Opt-Out of Personal Data Sales under South Korea Personal Information Protection Act (PIPA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the South Korea Personal Information Protection Act (PIPA).
Legal basis: South Korea Personal Information Protection Act (PIPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1747
KRPIPA-007
Missing Opt-Out of Automated Profiling under South Korea Personal Information Protection Act (PIPA)
The website uses automated decision models for client eligibility without providing an opt-out under the South Korea Personal Information Protection Act (PIPA).
Legal basis: South Korea Personal Information Protection Act (PIPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1748
KRPIPA-008
Processing Sensitive Data without Consent under South Korea Personal Information Protection Act (PIPA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the South Korea Personal Information Protection Act (PIPA).
Legal basis: South Korea Personal Information Protection Act (PIPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1749
KRPIPA-009
Missing Data Protection Impact Assessment under South Korea Personal Information Protection Act (PIPA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the South Korea Personal Information Protection Act (PIPA).
Legal basis: South Korea Personal Information Protection Act (PIPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1750
KRPIPA-010
Non-Compliant Notice at Collection under South Korea Personal Information Protection Act (PIPA)
The website collects personal details without presenting a compliant privacy disclosure notice under the South Korea Personal Information Protection Act (PIPA).
Legal basis: South Korea Personal Information Protection Act (PIPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1751
VNDPD-001
Inaccessible Data Access Channel under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
Legal basis: Vietnam Personal Data Protection Decree 13/2023/ND-CP
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1752
VNDPD-002
Missing Data Rectification Form under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
Legal basis: Vietnam Personal Data Protection Decree 13/2023/ND-CP
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1753
VNDPD-003
Inaccessible Data Deletion Portal under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
Legal basis: Vietnam Personal Data Protection Decree 13/2023/ND-CP
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1754
VNDPD-004
Lack of Data Portability Export under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website fails to offer a portable, structured format for users to download and transfer their records under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
Legal basis: Vietnam Personal Data Protection Decree 13/2023/ND-CP
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1755
VNDPD-005
Missing Opt-Out of Targeted Advertising under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
Legal basis: Vietnam Personal Data Protection Decree 13/2023/ND-CP
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1756
VNDPD-006
Missing Opt-Out of Personal Data Sales under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
Legal basis: Vietnam Personal Data Protection Decree 13/2023/ND-CP
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1757
VNDPD-007
Missing Opt-Out of Automated Profiling under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website uses automated decision models for client eligibility without providing an opt-out under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
Legal basis: Vietnam Personal Data Protection Decree 13/2023/ND-CP
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1758
VNDPD-008
Processing Sensitive Data without Consent under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
Legal basis: Vietnam Personal Data Protection Decree 13/2023/ND-CP
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1759
VNDPD-009
Missing Data Protection Impact Assessment under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
Legal basis: Vietnam Personal Data Protection Decree 13/2023/ND-CP
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1760
VNDPD-010
Non-Compliant Notice at Collection under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website collects personal details without presenting a compliant privacy disclosure notice under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
Legal basis: Vietnam Personal Data Protection Decree 13/2023/ND-CP
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1761
THPDPA-001
Inaccessible Data Access Channel under Thailand Personal Data Protection Act (PDPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Thailand Personal Data Protection Act (PDPA).
Legal basis: Thailand Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1762
THPDPA-002
Missing Data Rectification Form under Thailand Personal Data Protection Act (PDPA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Thailand Personal Data Protection Act (PDPA).
Legal basis: Thailand Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1763
THPDPA-003
Inaccessible Data Deletion Portal under Thailand Personal Data Protection Act (PDPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Thailand Personal Data Protection Act (PDPA).
Legal basis: Thailand Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1764
THPDPA-004
Lack of Data Portability Export under Thailand Personal Data Protection Act (PDPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Thailand Personal Data Protection Act (PDPA).
Legal basis: Thailand Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1765
THPDPA-005
Missing Opt-Out of Targeted Advertising under Thailand Personal Data Protection Act (PDPA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Thailand Personal Data Protection Act (PDPA).
Legal basis: Thailand Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1766
THPDPA-006
Missing Opt-Out of Personal Data Sales under Thailand Personal Data Protection Act (PDPA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Thailand Personal Data Protection Act (PDPA).
Legal basis: Thailand Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1767
THPDPA-007
Missing Opt-Out of Automated Profiling under Thailand Personal Data Protection Act (PDPA)
The website uses automated decision models for client eligibility without providing an opt-out under the Thailand Personal Data Protection Act (PDPA).
Legal basis: Thailand Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1768
THPDPA-008
Processing Sensitive Data without Consent under Thailand Personal Data Protection Act (PDPA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Thailand Personal Data Protection Act (PDPA).
Legal basis: Thailand Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1769
THPDPA-009
Missing Data Protection Impact Assessment under Thailand Personal Data Protection Act (PDPA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Thailand Personal Data Protection Act (PDPA).
Legal basis: Thailand Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1770
THPDPA-010
Non-Compliant Notice at Collection under Thailand Personal Data Protection Act (PDPA)
The website collects personal details without presenting a compliant privacy disclosure notice under the Thailand Personal Data Protection Act (PDPA).
Legal basis: Thailand Personal Data Protection Act (PDPA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1771
INDPDP-001
Inaccessible Data Access Channel under India Digital Personal Data Protection Act 2023 (DPDP)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the India Digital Personal Data Protection Act 2023 (DPDP).
Legal basis: India Digital Personal Data Protection Act 2023 (DPDP)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1772
INDPDP-002
Missing Data Rectification Form under India Digital Personal Data Protection Act 2023 (DPDP)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the India Digital Personal Data Protection Act 2023 (DPDP).
Legal basis: India Digital Personal Data Protection Act 2023 (DPDP)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1773
INDPDP-003
Inaccessible Data Deletion Portal under India Digital Personal Data Protection Act 2023 (DPDP)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the India Digital Personal Data Protection Act 2023 (DPDP).
Legal basis: India Digital Personal Data Protection Act 2023 (DPDP)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1774
INDPDP-004
Lack of Data Portability Export under India Digital Personal Data Protection Act 2023 (DPDP)
The website fails to offer a portable, structured format for users to download and transfer their records under the India Digital Personal Data Protection Act 2023 (DPDP).
Legal basis: India Digital Personal Data Protection Act 2023 (DPDP)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1775
INDPDP-005
Missing Opt-Out of Targeted Advertising under India Digital Personal Data Protection Act 2023 (DPDP)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the India Digital Personal Data Protection Act 2023 (DPDP).
Legal basis: India Digital Personal Data Protection Act 2023 (DPDP)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1776
INDPDP-006
Missing Opt-Out of Personal Data Sales under India Digital Personal Data Protection Act 2023 (DPDP)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the India Digital Personal Data Protection Act 2023 (DPDP).
Legal basis: India Digital Personal Data Protection Act 2023 (DPDP)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1777
INDPDP-007
Missing Opt-Out of Automated Profiling under India Digital Personal Data Protection Act 2023 (DPDP)
The website uses automated decision models for client eligibility without providing an opt-out under the India Digital Personal Data Protection Act 2023 (DPDP).
Legal basis: India Digital Personal Data Protection Act 2023 (DPDP)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1778
INDPDP-008
Processing Sensitive Data without Consent under India Digital Personal Data Protection Act 2023 (DPDP)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the India Digital Personal Data Protection Act 2023 (DPDP).
Legal basis: India Digital Personal Data Protection Act 2023 (DPDP)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1779
INDPDP-009
Missing Data Protection Impact Assessment under India Digital Personal Data Protection Act 2023 (DPDP)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the India Digital Personal Data Protection Act 2023 (DPDP).
Legal basis: India Digital Personal Data Protection Act 2023 (DPDP)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1780
INDPDP-010
Non-Compliant Notice at Collection under India Digital Personal Data Protection Act 2023 (DPDP)
The website collects personal details without presenting a compliant privacy disclosure notice under the India Digital Personal Data Protection Act 2023 (DPDP).
Legal basis: India Digital Personal Data Protection Act 2023 (DPDP)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1781
BRLGPD-001
Inaccessible Data Access Channel under Brazil General Data Protection Law (LGPD)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Brazil General Data Protection Law (LGPD).
Legal basis: Brazil General Data Protection Law (LGPD)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1782
BRLGPD-002
Missing Data Rectification Form under Brazil General Data Protection Law (LGPD)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Brazil General Data Protection Law (LGPD).
Legal basis: Brazil General Data Protection Law (LGPD)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1783
BRLGPD-003
Inaccessible Data Deletion Portal under Brazil General Data Protection Law (LGPD)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Brazil General Data Protection Law (LGPD).
Legal basis: Brazil General Data Protection Law (LGPD)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1784
BRLGPD-004
Lack of Data Portability Export under Brazil General Data Protection Law (LGPD)
The website fails to offer a portable, structured format for users to download and transfer their records under the Brazil General Data Protection Law (LGPD).
Legal basis: Brazil General Data Protection Law (LGPD)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1785
BRLGPD-005
Missing Opt-Out of Targeted Advertising under Brazil General Data Protection Law (LGPD)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Brazil General Data Protection Law (LGPD).
Legal basis: Brazil General Data Protection Law (LGPD)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1786
BRLGPD-006
Missing Opt-Out of Personal Data Sales under Brazil General Data Protection Law (LGPD)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Brazil General Data Protection Law (LGPD).
Legal basis: Brazil General Data Protection Law (LGPD)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1787
BRLGPD-007
Missing Opt-Out of Automated Profiling under Brazil General Data Protection Law (LGPD)
The website uses automated decision models for client eligibility without providing an opt-out under the Brazil General Data Protection Law (LGPD).
Legal basis: Brazil General Data Protection Law (LGPD)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1788
BRLGPD-008
Processing Sensitive Data without Consent under Brazil General Data Protection Law (LGPD)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Brazil General Data Protection Law (LGPD).
Legal basis: Brazil General Data Protection Law (LGPD)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1789
BRLGPD-009
Missing Data Protection Impact Assessment under Brazil General Data Protection Law (LGPD)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Brazil General Data Protection Law (LGPD).
Legal basis: Brazil General Data Protection Law (LGPD)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1790
BRLGPD-010
Non-Compliant Notice at Collection under Brazil General Data Protection Law (LGPD)
The website collects personal details without presenting a compliant privacy disclosure notice under the Brazil General Data Protection Law (LGPD).
Legal basis: Brazil General Data Protection Law (LGPD)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1791
ZAPOPI-001
Inaccessible Data Access Channel under South Africa Protection of Personal Information Act (POPIA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the South Africa Protection of Personal Information Act (POPIA).
Legal basis: South Africa Protection of Personal Information Act (POPIA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1792
ZAPOPI-002
Missing Data Rectification Form under South Africa Protection of Personal Information Act (POPIA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the South Africa Protection of Personal Information Act (POPIA).
Legal basis: South Africa Protection of Personal Information Act (POPIA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1793
ZAPOPI-003
Inaccessible Data Deletion Portal under South Africa Protection of Personal Information Act (POPIA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the South Africa Protection of Personal Information Act (POPIA).
Legal basis: South Africa Protection of Personal Information Act (POPIA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1794
ZAPOPI-004
Lack of Data Portability Export under South Africa Protection of Personal Information Act (POPIA)
The website fails to offer a portable, structured format for users to download and transfer their records under the South Africa Protection of Personal Information Act (POPIA).
Legal basis: South Africa Protection of Personal Information Act (POPIA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1795
ZAPOPI-005
Missing Opt-Out of Targeted Advertising under South Africa Protection of Personal Information Act (POPIA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the South Africa Protection of Personal Information Act (POPIA).
Legal basis: South Africa Protection of Personal Information Act (POPIA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1796
ZAPOPI-006
Missing Opt-Out of Personal Data Sales under South Africa Protection of Personal Information Act (POPIA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the South Africa Protection of Personal Information Act (POPIA).
Legal basis: South Africa Protection of Personal Information Act (POPIA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1797
ZAPOPI-007
Missing Opt-Out of Automated Profiling under South Africa Protection of Personal Information Act (POPIA)
The website uses automated decision models for client eligibility without providing an opt-out under the South Africa Protection of Personal Information Act (POPIA).
Legal basis: South Africa Protection of Personal Information Act (POPIA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1798
ZAPOPI-008
Processing Sensitive Data without Consent under South Africa Protection of Personal Information Act (POPIA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the South Africa Protection of Personal Information Act (POPIA).
Legal basis: South Africa Protection of Personal Information Act (POPIA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1799
ZAPOPI-009
Missing Data Protection Impact Assessment under South Africa Protection of Personal Information Act (POPIA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the South Africa Protection of Personal Information Act (POPIA).
Legal basis: South Africa Protection of Personal Information Act (POPIA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1800
ZAPOPI-010
Non-Compliant Notice at Collection under South Africa Protection of Personal Information Act (POPIA)
The website collects personal details without presenting a compliant privacy disclosure notice under the South Africa Protection of Personal Information Act (POPIA).
Legal basis: South Africa Protection of Personal Information Act (POPIA)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1801
TXSBB-001
Data Broker Not Registered in Texas
A business that collects, processes or transfers personal data it did not collect directly from the individuals appears to operate as a data broker in Texas without registering with the Texas Secretary of State (registration fee $300). Penalty: at least $100 per day plus unpaid fees, up to $10,000 in a 12-month period. The public registry, not the website, confirms it.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1802
TXSBB-002
No Conspicuous Data Broker Notice on the Website (Texas)
A data broker's website or app does not post a conspicuous notice stating that the entity is a data broker, written clearly, not misleading, readily accessible to the public including people with disabilities, and containing the language prescribed by the Texas Secretary of State. Penalty: at least $100 per day, up to $10,000 in a 12-month period.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1803
TXSBB-003
Data Broker Notice Without Instructions on Privacy Rights (Texas)
The data broker notice on the website or app does not inform consumers how to exercise their rights under the Texas Data Privacy and Security Act (Chapter 541) — a requirement in force since 1 September 2025.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1804
TXSBB-004
No Comprehensive Information Security Program (Texas Data Broker)
A data broker doing business in Texas shows signs of weak data protection (for example exposed data or missing basic safeguards), suggesting it lacks the written comprehensive information security program with administrative, technical and physical safeguards that Texas requires of data brokers. Confirmed by audit.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1805
TXSBB-005
Data Broker Not Registered With the California Privacy Protection Agency
A business meeting the definition of a data broker appears not to have registered with the California Privacy Protection Agency by 31 January following the year it met the definition. Administrative fine: $200 per day of non-registration plus unpaid fees and costs. Confirmed by the agency's registry, not by the website.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1806
TXSBB-006
Data Broker Privacy Policy Without Request Metrics (California)
A data broker's privacy policy does not disclose, by 1 July each year, how many deletion, access, opt-out and related consumer requests it received, complied with and denied in the previous year, with the median and mean response times and the reasons for denials.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1807
TXSBB-007
Data Broker Not Processing Deletion Requests From California's DROP
Since 1 August 2026 a registered data broker must access the California Privacy Protection Agency's accessible deletion mechanism at least every 45 days and delete the personal information of consumers who submitted requests. Signs such as continued listing of a consumer's data suggest the broker does not. Fine: $200 for each deletion request for each day of non-compliance.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1808
TXSBB-008
Data Broker Not Registered in Vermont
A data broker appears not to have registered annually with the Vermont Secretary of State by 31 January (fee $100), with its opt-out methods, the activities consumers cannot opt out of, its purchaser credentialing and the prior year's data broker security breaches. Confirmed by the state registry, not by the website.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1809
TXSBB-009
No Written Information Security Program (Vermont Data Broker)
Signs of weak data protection suggest that a data broker lacks the written comprehensive information security program Vermont requires, with an employee designated to maintain it and identification of foreseeable internal and external risks to personally identifiable information. Confirmed by audit.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1810
TXSBB-010
No Prominent Page With Privacy-Rights Instructions (Texas Data Broker)
The data broker's website has no page that prominently displays specific instructions on how consumers can exercise their rights under the Texas Data Privacy and Security Act; since 1 September 2025 a link to this page must be part of the data broker's registration with the Secretary of State.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1811
WAHMHD-001
Geofencing Around In-Person Health Care Facilities (Washington)
Location-tracking or ad technology on the site suggests the use of a geofence — a virtual boundary of 2,000 feet or less — around an entity providing in-person health care services to identify or track people seeking care, collect their health data, or send them health-related messages or ads. Washington makes this unlawful; confirmed by audit of the location campaigns.
Legal basis: RCW 19.373.080 (Washington My Health My Data Act)
No Homepage Link to a Consumer Health Data Privacy Policy (Washington)
A business that collects consumer health data does not prominently publish on its homepage a link to a separate consumer health data privacy policy, as Washington's My Health My Data Act requires of regulated entities and small businesses.
Legal basis: RCW 19.373.020(1)(b) (Washington My Health My Data Act)
Health Data Privacy Policy Missing Required Disclosures (Washington)
The consumer health data privacy policy does not clearly and conspicuously disclose the categories of health data collected and why, their sources, the categories shared, the categories of third parties and the specific affiliates receiving them, and how consumers can exercise their rights.
Legal basis: RCW 19.373.020(1)(a) (Washington My Health My Data Act)
One Consent for Both Collecting and Sharing Health Data (Washington)
The site obtains a single consent that covers both collection and sharing of consumer health data, although Washington requires consent to share that is separate and distinct from the consent to collect, unless sharing is necessary to provide the service the consumer requested.
Legal basis: RCW 19.373.030(1)(b) (Washington My Health My Data Act)
Health Data Consent Request Without Required Details (Washington)
The request for consent to collect or share consumer health data does not clearly and conspicuously state the categories of data, the purpose and specific uses, the categories of recipients, and how the consumer can withdraw consent.
Legal basis: RCW 19.373.030(1)(c) (Washington My Health My Data Act)
No Way to Submit Health Data Rights Requests (Washington)
The consumer health data privacy policy does not describe a secure and reliable way to submit requests to confirm, access, delete health data or withdraw consent — one that fits how consumers normally interact with the business.
Legal basis: RCW 19.373.040(1)(d) (Washington My Health My Data Act)
Selling Health Data Without a Signed Authorization (Washington)
Signs of health data being sold or offered for sale (for example data-sale disclosures or ad-tech partners receiving health signals) without a plain-language valid authorization signed by the consumer, separate from any collection consent and expiring after one year. Confirmed by audit of data sales.
Legal basis: RCW 19.373.070 (Washington My Health My Data Act)
Weak Security and Access Controls for Health Data (Washington)
Visible security weaknesses suggest that access to consumer health data is not limited to staff and processors who need it and that administrative, technical and physical safeguards do not meet the industry's reasonable standard of care. Confirmed by audit.
Legal basis: RCW 19.373.050 (Washington My Health My Data Act)
Geofencing Near Mental, Reproductive or Sexual Health Facilities (Connecticut)
Location-tracking or ad technology suggests a geofence within 1,750 feet of a mental health, reproductive or sexual health facility used to identify, track, collect data from or send notifications to consumers about their health data. Prohibited in Connecticut; enforced by the Attorney General. Confirmed by audit.
Legal basis: Conn. Gen. Stat. § 42-526(a)(1)(C) (Connecticut)
Selling Consumer Health Data Without Consent (Connecticut)
Signs of consumer health data being sold or offered for sale — for example health-related audiences offered to advertisers — without first obtaining the consumer's consent, which Connecticut prohibits. Confirmed by audit of data sales.
Legal basis: Conn. Gen. Stat. § 42-526(a)(1)(D) (Connecticut)
No Annual Cybersecurity Compliance Filing With NY DFS
A New York DFS-regulated financial services company shows no sign of submitting, by 15 April each year, either a written certification of material compliance with Part 500 for the prior year or a written acknowledgment of non-compliance with a remediation timeline. Confirmed with the regulator, not from the website.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1822
NYDFS-002
Nonpublic Information Not Encrypted in Transit (NY DFS)
Pages or forms of a DFS-regulated company that handle nonpublic information are served over plain HTTP, mixed content or outdated TLS, although Part 500 requires encryption meeting industry standards for nonpublic information in transit over external networks.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1823
NYDFS-003
No Multi-Factor Authentication for Access to Systems (NY DFS)
Internet-exposed login portals of a DFS-regulated company suggest access with a password only, although Part 500 requires multi-factor authentication for any individual accessing its information systems (for small companies under the limited exemption: at least for remote access, cloud applications with nonpublic information and privileged accounts). Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1824
NYDFS-004
No Annual Penetration Testing (NY DFS)
Long-standing, easily found weaknesses suggest the company does not have its information systems penetration-tested from inside and outside their boundaries by a qualified party at least annually, as Part 500 requires. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1825
NYDFS-005
Known Vulnerabilities Left Unremediated (NY DFS)
The public website of a DFS-regulated company runs software or libraries in versions with publicly known vulnerabilities, although Part 500 requires timely remediation of vulnerabilities, prioritised by the risk they pose.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1826
NYDFS-006
Cybersecurity Incident Not Reported to DFS Within 72 Hours
Public signs of a cybersecurity incident (for example a defacement, data exposure or ransomware notice) without evidence that the company notified the superintendent electronically within 72 hours of determining that the incident occurred, as Part 500 requires. Confirmed with the regulator.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1827
NYDFS-007
No Complete Asset Inventory (NY DFS)
Forgotten subdomains, test systems or outdated services visible from the internet suggest the company lacks the complete, accurate and documented inventory of its information systems — with owner, location, classification and support expiration date — that Part 500 requires. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1828
NYDFS-008
Remote-Control Protocols Left Open (NY DFS)
Remote-control services of the company's devices (for example remote desktop or VNC) appear reachable from the internet, although Part 500 requires disabling or securely configuring all protocols that permit remote control of devices. Seen by network scan rather than from the website; confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1829
NYDFS-009
No Annual Cybersecurity Awareness Training (NY DFS)
Signs of successful social-engineering exposure (for example staff email addresses and roles published without safeguards, or phishing incidents) suggest the company does not provide at least annual cybersecurity awareness training, including social engineering, for all personnel as Part 500 requires. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1830
NYDFS-010
No Password Policy Meeting Industry Standards (NY DFS)
Login forms that give no sign of password requirements or protections against common passwords suggest the company lacks the written password policy meeting industry standards that Part 500 requires wherever passwords are used. Confirmed by audit.
A payment service provider appears not to apply strong customer authentication — two independent elements of knowledge, possession or inherence — when the payer accesses the payment account online or initiates an electronic payment, or not to link remote payments dynamically to the amount and payee. The duty lies with the payment service provider; confirmed by a test payment or audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1832
PSD2-002
Surcharge for Paying With a Consumer Card (EU)
The checkout adds a fee for paying with a consumer debit or credit card whose interchange fees are regulated by Regulation (EU) 2015/751, or for SEPA credit transfers and direct debits, although PSD2 prohibits payees from requesting such charges.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1833
PSD2-003
Payment-Method Fee Above the Trader's Cost (EU)
The site charges consumers a fee for using a particular means of payment (for example a wallet or a commercial card) that appears to exceed the cost the trader bears for that means, which EU consumer law prohibits.
Legal basis: Directive 2011/83/EU Art. 19 (Consumer Rights Directive)
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1834
PSD2-004
Currency Conversion Offered Without Charges and Rate (EU)
At checkout the payee offers to charge the payer in another currency (dynamic currency conversion) without first disclosing all charges and the exchange rate to be used, although PSD2 requires this disclosure and the payer's agreement on that basis.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1835
PSD2-005
Payment Service Without Execution Time, Charges or Exchange Rate (EU)
A payment service provider's website (for example a money transfer service) does not make available before a single payment the maximum execution time, all charges with their breakdown, and the actual or reference exchange rate, as PSD2 requires.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1836
PSD2-006
Payer Not Shown Amount and Payee During Authentication (EU)
The authentication step for a remote payment does not show the payer the amount and the payee, or the authentication code is not specific to them, as the EU technical standards on dynamic linking require. Confirmed by a test payment.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1837
PSD2-007
Payment Credentials Not Adequately Protected (EU)
The login or payment page of a payment service provider transmits users' personalised security credentials without adequate protection — for example over plain HTTP, with mixed content or on a page that loads unvetted third-party scripts — although PSD2 requires adequate security measures to protect their confidentiality and integrity.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1838
PSD2-008
Users Not Informed of a Major Security Incident (EU)
Public signs of a major operational or security incident at a payment service provider without evidence that it informed its users without undue delay of the incident and the measures they can take, where their financial interests are or may be affected, as PSD2 requires. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1839
PSD2-009
Surcharge for Paying With a Consumer Card (UK)
The checkout charges a fee for paying with a consumer (non-commercial) card or for payments covered by the SEPA regulation, although in the UK a payee must not charge a payer any fee for these means of payment.
Legal basis: UK Consumer Rights (Payment Surcharges) Regulations 2012 reg. 6A
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1840
PSD2-010
Strong Customer Authentication Not Applied (UK)
A UK payment service provider appears not to apply strong customer authentication when a user accesses the payment account online, initiates an electronic payment or acts through a remote channel with fraud risk, or not to link remote payments dynamically to the amount and payee. Confirmed by a test payment or audit.
Legal basis: UK Payment Services Regulations 2017 reg. 100
Inadequate Client-Side Script Integrity Controls Audit and Record Failures
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Inadequate audit trails or record preservation protocols fail to document configuration settings.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. User interfaces employ design components that restrict access or options for visitors.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Automated scanning tools fail to run periodically on public web paths.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Automated logging systems fail to store customer choices in an immutable storage registry.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Disclosures fail to clearly state the reasons and scope of personal file processing.
Inadequate Client-Side Script Integrity Controls Audit Control Verification
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Data transfer procedures operate without automated checks ensuring record validity.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Administrative consoles allow standard user credentials without enforcing MFA keys.
Missing Secure Transmission Controls for Financial Data
Application or account pages of a non-bank financial institution under FTC jurisdiction (for example a lender, mortgage broker or tax preparer) send customer information such as Social Security numbers or credit data over plain HTTP, mixed content or outdated TLS, although the Safeguards Rule requires encrypting all customer information in transit over external networks.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1852
GLBAS-002
No Multi-Factor Authentication for System Access (GLBA)
Login portals give no sign of multi-factor authentication, although the Safeguards Rule requires it for any individual accessing any information system, unless the Qualified Individual has approved in writing reasonably equivalent or more secure controls. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1853
GLBAS-003
No Penetration Testing or Six-Monthly Vulnerability Scans (GLBA)
Publicly known vulnerabilities left in place suggest that, absent continuous monitoring, the institution does not run annual penetration tests and vulnerability assessments at least every six months, as the Safeguards Rule requires for institutions with customer information on 5,000 or more consumers. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1854
GLBAS-004
Signs of Insecure Development in Customer-Facing Applications (GLBA)
Web applications that transmit or store customer information show signs of insecure development — for example exposed source-control folders, debug pages, verbose error messages or directory listings — although the Safeguards Rule requires secure development practices for in-house applications and security testing of external ones.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1855
GLBAS-005
Breach of 500+ Consumers Not Reported to the FTC Within 30 Days
Public signs of a security event involving unencrypted customer information without evidence that the institution notified the FTC electronically no later than 30 days after discovery, as required when at least 500 consumers are affected. Confirmed with the regulator.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1856
GLBAS-006
Customer Information Kept Beyond Two Years Without Need (GLBA)
Signs such as indefinite retention statements or long-inactive accounts still holding full data suggest the institution lacks procedures to securely dispose of customer information no later than two years after last use, unless it is needed or legally required, and does not review its retention policy periodically. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1857
GLBAS-007
No Qualified Individual for the Security Program (GLBA)
No sign of a designated Qualified Individual responsible for overseeing, implementing and enforcing the information security program — for example no security contact at all — although the Safeguards Rule requires one (who may work for a service provider or affiliate). Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1858
GLBAS-008
No Written Incident Response Plan (GLBA)
Signs of a slow or disorganised response to a security event suggest the institution lacks the written incident response plan — with goals, roles, communications, remediation and documentation — that the Safeguards Rule requires of institutions with information on 5,000 or more consumers. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1859
GLBAS-009
No Security Awareness Training for Personnel (GLBA)
Signs of exposure to social engineering suggest the institution does not provide its personnel with security awareness training updated to reflect the risks identified in its risk assessment, as the Safeguards Rule requires. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1860
GLBAS-010
Service Providers Receiving Customer Data Without Oversight (GLBA)
Third-party scripts or services receive data from application or account pages, suggesting the institution does not select capable service providers, bind them by contract to maintain safeguards and periodically assess them, as the Safeguards Rule requires. Confirmed by audit of contracts and assessments.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1861
FTCDP-001
Fictitious Original Pricing Discounts
The catalog shows crossed-out 'original' prices as the basis for a discount, but there is no sign the item was actually offered at that price, openly and in good faith, on a regular basis for a reasonably substantial period — for example a permanent 'sale' or a 'was' price never charged. The FTC Guides treat a fictitious former price as a false bargain.
Unsupported "Compare At" or Comparable Value Claims
Product pages show a "compare at" or "value" price implying that other retailers sell the same item at that price, without evidence that substantial sales at that price occur in the trade area.
Manufacturer's Suggested Price Used as a Fictitious Reference
Discounts are measured against a manufacturer's list or suggested retail price (MSRP) that is not the price at which substantial sales are actually made in the market.
Inflated Base Price in "Free" or "Buy One, Get One" Offers
A "free" item or "buy one, get one" offer is conditioned on buying another product whose price was raised, or whose quality or quantity was reduced, to cover the cost of the free item.
Misleading "Wholesale", "Factory" or "Limited" Price Claims
The site calls retail prices "wholesale" or "factory" prices, advertises "limited" offers that are not in fact limited, or discounts seconds and irregular goods against the price of perfect goods without saying so.
Hidden Mandatory Fees for Event Tickets or Short-Term Lodging
A ticketing or lodging site shows a price that excludes mandatory fees, or shows the total price less prominently than other pricing information. The FTC rule applies only to live-event tickets and short-term lodging.
Legal basis: 16 CFR § 464.2 (FTC Rule on Unfair or Deceptive Fees)
A ticketing or lodging site misrepresents the nature, purpose, amount or refundability of a fee, or what the fee pays for — for example, a "service fee" presented as a government tax.
Legal basis: 16 CFR § 464.3 (FTC Rule on Unfair or Deceptive Fees)
A discount announced to EU consumers does not show the prior price, meaning the lowest price the trader applied during at least the 30 days before the reduction.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1869
FTCDP-009
California "Former Price" Older Than Three Months
A "was" or former price shown to California consumers was not the prevailing market price within the three months before the advertisement, and the date it applied is not clearly stated.
Subscription Started Online Cannot Be Cancelled Online
The site lets consumers accept an automatically renewing subscription online but offers no way to end it online — for example it requires a phone call or a chat with support. California requires online termination at will, without steps that obstruct or delay it, through a prominently located direct link or button (in the account or settings) or a ready-to-send termination email provided by the business.
Material Terms Not Disclosed Before Billing Information Is Collected
An online offer with a negative option feature (charges continue until the consumer cancels) asks for card or billing details before clearly and conspicuously disclosing all material terms of the transaction, such as the price, how often it is charged and that charges recur until cancelled.
The consumer is enrolled in recurring charges without a separate, affirmative act of agreement — for example through a pre-checked box or simply by completing the purchase — so the seller does not obtain the express informed consent that ROSCA requires before charging the card or account.
Auto-Renewal Terms Not Shown Next to the Consent Request
Automatic renewal terms are not presented clearly and conspicuously before the purchase is completed and in visual proximity to the request for consent; if the offer includes a free trial, the price charged after the trial ends is not clearly explained.
Contract Text That Undermines Consent to Auto-Renewal
The offer or contract contains information that interferes with, detracts from, contradicts or otherwise undermines the consumer's ability to give affirmative consent to the automatic renewal — for example text near the consent control that plays down or contradicts the renewal terms.
Retention Offer Without a Visible “Click to Cancel” Button
When a consumer asks to cancel online, the site shows a discount, retention benefit or information about the effects of cancelling without simultaneously displaying a prominently located, continuously and proximately displayed direct link or button entitled “click to cancel” or words to that effect.
No “Verträge hier kündigen” Cancellation Button (Germany)
A website on which consumers can conclude a paid ongoing contract has no cancellation button labelled only “Verträge hier kündigen” (“cancel contracts here”) or an equally unambiguous wording, permanently available, directly and easily accessible and leading directly to a confirmation page. If the button is missing, the consumer may terminate at any time without a notice period (§ 312k(6) BGB).
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
The cancellation button leads to a page that does not ask for and allow the consumer to give the type of termination (and, for extraordinary termination, the reason), details that identify them, the contract, the time the termination should take effect and the means for sending the electronic confirmation, or that lacks a confirmation button labelled only “jetzt kündigen” (“cancel now”) or an equally unambiguous wording.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1879
FTCCC-009
Cancellation Harder Than Sign-Up (New York)
Consumers in New York cannot cancel at any time with a simple mechanism as easy to use as the one used to consent and through the same medium, or cancellation is obstructed or unreasonably delayed — for example by giving false information about how to cancel or misrepresenting the consequences or costs of cancelling.
Legal basis: N.Y. Gen. Bus. Law § 527-a(1)(d), (e)
For distance contracts concluded through an online interface, the site offers no withdrawal function labelled “withdraw from contract here” or an unambiguous equivalent, prominently displayed and continuously available throughout the withdrawal period, leading to an online withdrawal statement and a “confirm withdrawal” step. Applies in the EU from 19 June 2026 (inserted by Directive (EU) 2023/2673).
Legal basis: Directive 2011/83/EU Art. 11a (Consumer Rights Directive)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1881
FTCFR-001
Undisclosed Compensated Review Incentives
Reviews or testimonials shown on the site come from people who received payment, free or discounted products, a chance to win a prize or another benefit from the seller, and this material connection is not disclosed clearly and conspicuously next to the review.
The site offers money, discounts, coupons, gifts, contest entries or other incentives in exchange for reviews expressing a particular sentiment — for example a discount for a five-star review. The FTC Consumer Reviews and Testimonials Rule prohibits incentives conditioned on the sentiment of a review, whether positive or negative.
Company-Controlled Site Presented as Independent Reviews
A review or comparison website, an 'awards' page or an organization that the business controls, owns or operates is presented as offering independent reviews or opinions about a category of products or services that includes the business's own.
Exceptional-Results Testimonials Without Typical Results
Testimonials describe results on a key attribute of the product — for example weight lost, income earned or money saved — without a clear and conspicuous disclosure of the performance consumers can generally expect; the FTC Endorsement Guides call for that disclosure unless the advertiser can substantiate that such results are representative.
Terms of Service That Restrict or Penalize Reviews
The site's standard terms of sale or service prohibit or restrict customers from posting reviews, impose a fee or penalty for reviews, or require customers to transfer intellectual property rights in their reviews. Under the Consumer Review Fairness Act such provisions are void and offering them is unlawful; California separately bars contract terms waiving a consumer's right to make statements about the seller or its goods (penalty up to $2,500, then up to $5,000).
The site gives access to consumer reviews of its products but does not state whether and how it ensures that the published reviews come from consumers who actually used or purchased the product — information EU law treats as material, so leaving it out can be a misleading omission.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1887
FTCFR-007
“Verified Reviews” Claim Without Real Checks (EU)
The site states that its reviews come from consumers who actually used or purchased the product — for example with a 'verified buyer' label — while reviews can be posted without any purchase or use being checked, such as through an open form. Making that claim without reasonable and proportionate checks is on the EU list of practices banned in all circumstances.
Legal basis: Directive 2005/29/EC Annex I point 23b
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1888
FTCFR-008
Reviews Published in a Misleading Way (UK)
Consumer reviews or review information such as star averages are published in a misleading way — for example negative reviews are left out or removed while positive ones are shown, positive reviews are given greater prominence, or the fact that a reviewer was commissioned is omitted. Banned in all circumstances in the UK since 6 April 2025.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1889
FTCFR-009
Platform Without Public Review Rules or Deleting Reviews (China)
An e-commerce platform serving consumers in China does not publish its credit evaluation (review) rules, gives consumers no way to review goods or services sold on the platform, or deletes consumers' reviews of them.
Legal basis: E-Commerce Law of the PRC Art. 39 (China)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1890
FTCFR-010
Incentivised Reviews Without Saying So (UK)
The business submits, or commissions others to submit or write, consumer reviews that conceal that they were incentivised: the reviewer was commissioned by any means, and this is not made apparent in the review or otherwise. Banned in all circumstances in the UK since 6 April 2025.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1891
EUDOR-001
No Weekly Vulnerability Scanning of Critical Systems
A financial entity subject to DORA shows no sign of automated vulnerability scanning, at least weekly, of the ICT assets that support critical or important functions, as the EU ICT risk-management standards require. An external scan can only suggest the gap (for example long-unpatched software); an audit confirms it.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1892
EUDOR-002
Outdated Third-Party Libraries With Known Vulnerabilities
The financial entity's public web interface loads third-party or open-source libraries in versions with publicly known vulnerabilities. The EU ICT risk-management standards require tracking the third-party libraries used by services supporting critical or important functions and prioritising patches for identified vulnerabilities.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1893
EUDOR-003
Unencrypted Connections Over the Public Internet
Pages or endpoints of the financial entity's web service are reachable over plain HTTP without a redirect to HTTPS, or HTTPS pages load resources over HTTP (mixed content), although the EU ICT risk-management standards require encryption of network connections passing over public networks.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1894
EUDOR-004
TLS Certificate Expired or Not Renewed in Time
The TLS certificate of the financial entity's website has expired or is within days of expiry without a renewed certificate in place, although the EU ICT risk-management standards require prompt renewal of certificates in advance of their expiration.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1895
EUDOR-005
Outdated Encryption Protocols Still Accepted
The financial entity's website still accepts TLS 1.0 or TLS 1.1, which RFC 8996 formally deprecated in 2021, although the EU ICT risk-management standards require updating cryptographic technology in line with developments in cryptanalysis.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1896
EUDOR-006
No Procedure for Disclosing Vulnerabilities to Clients and the Public
The financial entity shows no procedure for the responsible disclosure of vulnerabilities to clients, counterparties and the public — for example no security advisories — although the EU ICT risk-management standards require one. Absence on the website only suggests the gap; an audit confirms it.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1897
EUDOR-007
Detected Vulnerabilities Not Recorded and Tracked
Vulnerabilities visible from outside persist over time, suggesting that detected vulnerabilities affecting ICT systems are not recorded and their resolution is not monitored, as the EU ICT risk-management standards require. Confirmed only by audit of the vulnerability records.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1898
EUDOR-008
No Up-to-Date Register of Certificates
Certificate problems visible from outside (expired, mismatched or forgotten certificates on subdomains) suggest that the financial entity keeps no up-to-date register of certificates and certificate-storing devices for ICT assets supporting critical or important functions, as the EU ICT risk-management standards require. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1899
EUDOR-009
No Annual Review of Network Security Design
Exposed administrative interfaces or unnecessary open services suggest that the financial entity does not review its network architecture and network security design once a year to identify potential vulnerabilities, as the EU ICT risk-management standards require. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1900
EUDOR-010
No Crisis Communication Plan for Major ICT Incidents
The financial entity shows no crisis communication arrangements — for example no public status or incident notice channel — for the responsible disclosure of major ICT-related incidents or vulnerabilities to clients, counterparts and the public, which DORA requires as part of the ICT risk management framework. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1901
EUCTA-001
Missing Trade Register Details on the Website
The website of a service provider established in the EU does not give, in an easily, directly and permanently accessible way, the trade register in which the provider is entered and its registration number (or equivalent means of identification in that register).
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1902
EUCTA-002
No Provider Name, Geographic Address or Direct Contact
The website does not make permanently accessible the service provider's name, the geographic address where it is established, or contact details — including an email address — that allow it to be contacted rapidly and communicated with directly; a contact form alone or a PO box does not provide these particulars.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1903
EUCTA-003
VAT Identification Number Not Shown
A service provider whose activity is subject to VAT does not show its VAT identification number on the website in an easily, directly and permanently accessible way.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1904
EUCTA-004
Supervisory Authority Not Named for a Licensed Activity
The website offers an activity that requires an authorisation — for example licensed financial, insurance or payment services — but does not give the particulars of the supervisory authority responsible for it.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1905
EUCTA-005
Missing or Hidden Legal Notice (Impressum) (Germany)
A website offering commercial digital services, as a rule for payment, has no legal notice (Impressum) that is easily recognisable, directly reachable and permanently available — for example no Impressum link at all, or one reachable only through several clicks or hidden behind a script.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1906
EUCTA-006
Impressum Without Legal Form or Authorised Representative (Germany)
The legal notice of a company (legal person) gives a name and address but omits the legal form or the person authorised to represent it, as required by § 5(1) No. 1 of the German Digitale-Dienste-Gesetz (DDG).
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1907
EUCTA-007
UK Company Website Without Registered Number or Office (UK)
The website of a company registered in the United Kingdom does not disclose the part of the UK in which it is registered, its registered number and the address of its registered office.
Legal basis: UK Company, LLP and Business (Names and Trading Disclosures) Regulations 2015 reg. 25
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1908
EUCTA-008
Prices Without Saying Whether Tax and Delivery Are Included (UK)
An online service that refers to prices does not indicate them clearly and unambiguously, and in particular does not say whether they include tax and delivery costs.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1909
EUCTA-009
Business Licence Not Displayed on the Homepage (China)
An e-commerce operator serving consumers in China does not continuously display, in a prominent place on its homepage, its business licence information and any administrative licences related to its business (or a link to them). Fine up to ¥10,000 under Art. 76(1).
Legal basis: E-Commerce Law of the PRC Art. 15 (China)
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1910
EUCTA-010
Regulated Profession Without Required Professional Details
A website offering services of a regulated profession (for example lawyers, doctors, architects or accountants) does not state the professional body with which the provider is registered, the professional title and the Member State where it was granted, or a reference to the applicable professional rules and how to access them.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1911
WCAG2-001
Inadequate Button Target Size
Interactive targets such as navigation links, icons and buttons are smaller than 24 by 24 CSS pixels without the spacing, equivalent control or other exceptions WCAG 2.2 allows (inline text links, browser-controlled or essential sizes), making them hard to activate for people with limited dexterity.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1912
WCAG2-002
Content Locked to a Single Screen Orientation
The site restricts its view or operation to portrait or landscape only, although that orientation is not essential, so users whose device is mounted in a fixed orientation cannot use it.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1913
WCAG2-003
Personal Data Fields Without Autocomplete Purpose
Form fields that collect the user's own data (name, email, phone, address) do not declare their purpose programmatically, for example with the HTML autocomplete attribute, so browsers and assistive tools cannot fill or label them.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1915
WCAG2-005
Hover Pop-ups That Cannot Be Dismissed or Hovered
Tooltips, menus or pop-ups that appear on hover or focus cannot be dismissed without moving the pointer or focus, disappear when the pointer moves onto them, or vanish before the user has finished reading.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1916
WCAG2-006
Single-Key Shortcuts That Cannot Be Turned Off
The site uses keyboard shortcuts made of a single letter, number or symbol key that cannot be turned off, remapped, or limited to when the relevant component has focus, which triggers actions by accident for speech-input users.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1917
WCAG2-007
Keyboard Focus Indicator Hidden
Links, buttons and form controls show no visible focus indicator when reached with the keyboard, often because CSS removes the outline, so keyboard users cannot see where they are.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1920
WCAG2-010
Visible Label Missing From the Accessible Name
A button or link's accessible name (for example from aria-label) does not contain its visible text, so a speech-input user who says what they see cannot activate it.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1921
EAAAX-001
Inaccessible E-Commerce Checkout Controls
Identification, security and payment functions of an online shop — login, verification codes, card fields, payment buttons — are not perceivable, operable, understandable and robust (for example unlabeled fields, a CAPTCHA without an accessible alternative or a keyboard trap in the payment frame), although the European Accessibility Act requires them to be accessible.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1922
EAAAX-002
Product Accessibility Information Not Passed On to Buyers (EU)
Product pages of an online shop give no information about the accessibility of the products or services sold, although the European Accessibility Act requires e-commerce services to provide it whenever the responsible economic operator (for example the manufacturer) supplies it.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1923
EAAAX-003
Service Website Not Perceivable, Operable, Understandable and Robust (EU)
The website or related online application of a service covered by the European Accessibility Act has accessibility failures (for example missing text alternatives, insufficient contrast or controls unreachable by keyboard), although the Act requires websites and mobile services to be accessible in a consistent and adequate way.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1924
EAAAX-004
Service Information in Small Fonts, Low Contrast or Fixed Spacing (EU)
Information about how the service works is presented in fonts of inadequate size or shape, with insufficient contrast, or with letter, line and paragraph spacing that cannot be adjusted, although the European Accessibility Act requires these presentation qualities.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1925
EAAAX-005
Support Services Without Accessibility Information (EU)
Help desks, contact centres or technical support offered on the site give no information on the accessibility of the service and its compatibility with assistive technologies, or can be reached only through a single inaccessible channel (for example phone only), although the European Accessibility Act requires this where support services exist.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1926
EAAAX-006
No Accessibility Information in the Terms and Conditions (EU)
The general terms and conditions (or equivalent document) do not include the information assessing how the service meets the accessibility requirements — a general description of the service in accessible formats, explanations needed to understand its operation and how the requirements of Annex I are met.
Legal basis: Directive (EU) 2019/882 Annex V point 1 (European Accessibility Act)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1927
EAAAX-007
Consumer Banking Information Too Complex (Above B2) (EU)
Information provided by a consumer banking service is written at a level of complexity above B2 (upper intermediate) of the Common European Framework of Reference for Languages, although the European Accessibility Act requires it to be understandable within that level.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1928
EAAAX-008
Inaccessible Identification, Signature or Payment in Online Banking (EU)
Identification methods, electronic signatures, security steps or payment services of a consumer banking service are not perceivable, operable, understandable and robust — for example one-time-code screens with time limits and no accessible alternative — although the European Accessibility Act requires them to be accessible.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1929
EAAAX-009
Service Offered in Germany Without Meeting Accessibility Requirements
A service covered by the German Accessibility Strengthening Act (BFSG), such as an online shop or consumer banking, is offered although it does not meet the accessibility requirements — for example the website fails basic accessibility checks. Offering such a service is an administrative offence with a fine of up to €100,000 (BFSG § 37(1) No. 8, (2)).
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1930
EAAAX-010
Accessibility Information Not Published in Accessible Form (Germany)
The information required by Annex 3 of the German Accessibility Strengthening Act (how the service meets the accessibility requirements) has not been prepared or is not made available to the public in accessible form — for example it is missing or published only as an image or scanned PDF.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1931
ONADA-001
Missing Accessibility Feedback Channel
An organization providing goods, services or facilities in Ontario has no publicly available process for receiving and responding to feedback about how it serves persons with disabilities, although the Integrated Accessibility Standards require such a process and information about it to be readily available to the public.
Legal basis: O. Reg. 191/11 s. 80.50 (Ontario AODA)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1932
ONADA-002
Website Below WCAG 2.0 Level AA (Ontario)
The public website of a large organization (50 or more employees in Ontario) or a designated public sector organization fails WCAG 2.0 Level AA success criteria, although since 1 January 2021 all its internet websites and web content must conform (except live captions 1.2.4 and pre-recorded audio description 1.2.5).
Legal basis: O. Reg. 191/11 s. 14(4) (Ontario AODA)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1933
ONADA-003
No Notice That Accessible Formats Are Available (Ontario)
The organization does not notify the public that accessible formats and communication supports are available to persons with disabilities on request, as the Integrated Accessibility Standards require.
Legal basis: O. Reg. 191/11 s. 12(3) (Ontario AODA)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1934
ONADA-004
Feedback Process Without Notice of Accessible Formats (Ontario)
The organization has a feedback process but does not tell the public that accessible formats and communication supports are available for it, although Ontario requires both the accessibility of feedback processes and that notice.
Legal basis: O. Reg. 191/11 s. 11(2) (Ontario AODA)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1935
ONADA-005
Accessibility Policies Not Publicly Available (Ontario)
An organization other than a small organization does not make publicly available documents describing its accessibility policies — including its statement of commitment to meet the accessibility needs of persons with disabilities — or does not offer them in an accessible format on request.
Legal basis: O. Reg. 191/11 s. 3(3) (Ontario AODA)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1936
ONADA-006
No Public Notice of Temporary Disruptions to Accessible Services (Ontario)
The website shows no practice of notifying the public of temporary disruptions to facilities or services that persons with disabilities usually use (for example an accessible entrance or elevator), with the reason, expected duration and alternatives available, as Ontario's customer service standards require. Confirmed by audit.
Legal basis: O. Reg. 191/11 s. 80.48 (Ontario AODA)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1937
ONADA-007
Accessible Formats Not Provided in Time or at Extra Cost (Ontario)
Signs that accessible formats and communication supports are not provided on request in a timely manner and at no more than the regular cost charged to others — for example a surcharge for large print or long delays — as Ontario requires. Confirmed by a request or audit.
Legal basis: O. Reg. 191/11 s. 12(1) (Ontario AODA)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1938
ONADA-008
Feedback Process Without Actions on Complaints (Ontario)
The published feedback process does not specify the actions the organization will take if it receives a complaint about how it provides goods, services or facilities to persons with disabilities, as Ontario requires.
Legal basis: O. Reg. 191/11 s. 80.50(2) (Ontario AODA)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1939
ONADA-009
Customer Service Documents Not Offered in Accessible Formats (Ontario)
Customer service documents the organization must give on request (for example its feedback process or service-animal policy) appear to be available only as inaccessible files, suggesting they are not provided in an accessible format or with communication support on request. Confirmed by a request or audit.
Legal basis: O. Reg. 191/11 s. 80.51(1) (Ontario AODA)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1940
ONADA-010
False or Misleading Accessibility Report (Ontario)
Public statements of full accessibility compliance contradicted by the website's own accessibility failures suggest that the organization's accessibility report to the Ontario director may contain false or misleading information — an offence punishable by up to $50,000 per day, or up to $100,000 per day for a corporation. Confirmed by review of the filed report.
Legal basis: Accessibility for Ontarians with Disabilities Act, 2005 s. 37(1)(a), (3)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1941
SEC50-001
Missing Closed Captions on Prerecorded Video (Section 508)
Prerecorded videos with sound on a federal agency's public-facing website (for example training or onboarding videos) have no synchronized captions, although Section 508 requires public-facing electronic content to conform to WCAG 2.0 Level A and AA, including captions for prerecorded audio.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1942
SEC50-002
Public-Facing Federal Content Below WCAG 2.0 AA (Section 508)
Public-facing electronic content of a federal agency — web pages, documents, forms — fails WCAG 2.0 Level A or AA success criteria, although the Revised 508 Standards require all public-facing electronic content to conform.
Legal basis: 36 CFR 1194 App. A E205.2 (Section 508)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1943
SEC50-003
Video Player Without Caption Controls Next to Volume (Section 508)
An embedded video player offers volume controls but no user control for selecting captions at the same menu level as the volume or program selection controls, as the Section 508 technical requirements for software require.
Legal basis: 36 CFR 1194 App. C 503.4.1 (Section 508)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1944
SEC50-004
Video Player Without Audio Description Controls (Section 508)
A video player that offers program selection gives no user control for selecting audio descriptions at the same menu level as the volume or program selection controls, as Section 508 requires.
Legal basis: 36 CFR 1194 App. C 503.4.2 (Section 508)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1945
SEC50-005
Help and Support Documentation Not Accessible (Section 508)
Electronic support documentation — help pages, FAQs, user guides, web-based self-service support — does not conform to WCAG 2.0 Level A and AA, for example scanned PDF manuals without text, although Section 508 requires it.
Legal basis: 36 CFR 1194 App. C 602.3 (Section 508)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1946
SEC50-006
Support Services Without Accessibility Feature Information (Section 508)
Help desk or support pages give no information on the accessibility and compatibility features of the ICT (for example how to use it with screen readers or keyboard only), although Section 508 requires support services to include it.
Legal basis: 36 CFR 1194 App. C 603.2 (Section 508)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1947
SEC50-007
No Way to Operate Without Vision (Section 508)
Functionality is available only visually — for example content drawn on a canvas, image-only buttons or maps without a text alternative — with no mode of operation that does not require vision, as the Section 508 functional performance criteria require.
Legal basis: 36 CFR 1194 App. C 302.1 (Section 508)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1948
SEC50-008
No Way to Operate Without Hearing (Section 508)
Information or operation depends on sound — audio-only instructions, audio alerts or podcasts without a transcript — with no mode of operation that does not require hearing, as the Section 508 functional performance criteria require.
Legal basis: 36 CFR 1194 App. C 302.4 (Section 508)
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1949
SEC50-009
Prerecorded Video Without Audio Description (Section 508)
Prerecorded videos on a federal agency's public website convey important visual information that is not described in the soundtrack or an audio description track, although Section 508 requires WCAG 2.0 Level AA conformance, including audio description for prerecorded video.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1950
SEC50-010
Federal Service Not Offering Comparable Access (Section 508)
Members of the public with disabilities seeking information or services from a federal agency online cannot access and use it comparably to others — for example an application form that cannot be completed with a screen reader — although Section 508 requires comparable access unless an undue burden would be imposed, in which case an alternative means must be provided.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$118,225–$236,451 (ADA: first–repeat violation) / up to €100,000 (EAA, Germany) / up to $100,000 per day (AODA, corporation)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1951
EEOC-001
Missing Automated Hiring Algorithmic Bias Audit
An employer or employment agency hiring in New York City uses an automated employment decision tool to screen candidates or employees without a bias audit conducted no more than one year before its use. Penalty up to $500 for a first violation and $500–$1,500 for each subsequent one; each day of use is a separate violation. Confirmed by the audit record.
Legal basis: NYC Admin. Code § 20-871(a)(1) (Local Law 144)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1952
EEOC-002
Bias Audit Summary Not Published on the Website (NYC)
An employer or employment agency that uses an automated employment decision tool in New York City has not published on its website a summary of the results of the most recent bias audit and the distribution date of the audited tool before using it.
Legal basis: NYC Admin. Code § 20-871(a)(2) (Local Law 144)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1953
EEOC-003
No Notice of Automated Screening or Alternative Process (NYC)
Job postings or the application flow do not notify New York City candidates, at least ten business days before use, that an automated employment decision tool will assess them, and do not let them request an alternative selection process or accommodation. Each missing notice is a separate violation.
Legal basis: NYC Admin. Code § 20-871(b)(1) (Local Law 144)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1954
EEOC-004
No Notice of Qualifications the Tool Evaluates (NYC)
Candidates or employees in New York City are not told, at least ten business days before use, which job qualifications and characteristics the automated employment decision tool will use to assess them.
Legal basis: NYC Admin. Code § 20-871(b)(2) (Local Law 144)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1955
EEOC-005
No Disclosure of Data Type, Source and Retention for the Hiring Tool (NYC)
The website does not disclose the type of data collected for the automated employment decision tool, its source and the data retention policy; if not on the website, this information must be provided within 30 days of a candidate's or employee's written request.
Legal basis: NYC Admin. Code § 20-871(b)(3) (Local Law 144)
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1956
EEOC-006
Automated Screening That Screens Out Applicants With Disabilities (ADA)
Automated tests or selection criteria in the online hiring process (for example timed games, video or voice analysis) may screen out applicants with disabilities; under the ADA this is discrimination unless the criteria are job-related and consistent with business necessity. Confirmed by analysis of outcomes.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1957
EEOC-007
No Way to Request Accommodation in Online Assessments (ADA)
The online application or automated assessment gives applicants no way to request a reasonable accommodation — for example extra time or an alternative format — although under the ADA not making reasonable accommodations for a qualified applicant with a disability is discrimination unless it imposes undue hardship.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1958
EEOC-008
Automated Selection With Possible Disparate Impact (Title VII)
An automated hiring tool that ranks or filters applicants may cause a disparate impact by race, color, religion, sex or national origin; under Title VII this is an unlawful employment practice unless the employer shows it is job-related and consistent with business necessity and no less discriminatory alternative was refused. Confirmed by statistical analysis.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1959
EEOC-009
Candidate Privacy Notice Silent on Automated Decision-Making (EU)
The privacy notice for job applicants does not state whether automated decision-making, including profiling, is used, nor give meaningful information about the logic involved and its significance and envisaged consequences for the candidate, as GDPR requires where such decisions are made.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1960
EEOC-010
Solely Automated Rejection of Candidates Without Human Review (EU)
Signs that applications are rejected automatically — for example instant rejection emails after an automated test — without human involvement, and without the right to obtain human intervention, express one's point of view and contest the decision, which GDPR requires for decisions based solely on automated processing with legal or similarly significant effects. Confirmed by audit.
Canada PIPEDA & Law 25 / Brazil LGPD / Australia Privacy Act / Singapore PDPA / EU AI Act & DSA
Up to C$100,000 (PIPEDA) / C$25,000,000 or 4% (Quebec) / 2% of Brazil revenue, max R$50,000,000 (LGPD) / A$50,000,000, 3× benefit or 30% of turnover (Australia) / 10% of Singapore turnover or S$1,000,000 (PDPA) / €35,000,000 or 7% (AI Act)
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1961
BIPAX-001
Missing Biometric Scanner Consent in Virtual Try-On
A virtual try-on or similar feature captures face geometry (or another biometric identifier) for a commercial purpose without first informing the person and obtaining consent, which Texas prohibits; each violation carries a civil penalty of up to $25,000.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1962
BIPAX-002
Biometric Identifiers Sold or Disclosed to Others (Texas)
Signs that captured biometric identifiers are sold, leased or disclosed to third parties (for example face data sent to an ad-tech or analytics partner) outside the narrow exceptions Texas allows, such as a transaction the person requested or a law enforcement warrant. Up to $25,000 per violation; confirmed by audit of data flows.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1963
BIPAX-003
Biometric Data Kept After Its Purpose Ends (Texas)
Retention statements or practices suggest biometric identifiers are kept indefinitely, although Texas requires destroying them within a reasonable time and no later than one year after the purpose for collecting them expires. Up to $25,000 per violation; confirmed by audit.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1964
BIPAX-004
Biometric Images Transmitted Without Reasonable Care (Texas)
Face images or other biometric data captured by the site are uploaded over an unencrypted connection or sent to third-party scripts, although Texas requires storing, transmitting and protecting biometric identifiers with reasonable care, at least as protectively as other confidential information.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1965
BIPAX-005
Biometric Enrollment Without Notice, Consent or Opt-Out (Washington)
The service enrolls biometric identifiers (for example face or voice templates) in a database for a commercial purpose without first giving readily available notice and obtaining consent or providing a mechanism to prevent their subsequent commercial use, as Washington requires. Enforced by the Attorney General under the Consumer Protection Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1966
BIPAX-006
Enrolled Biometrics Disclosed Without Consent (Washington)
Signs that enrolled biometric identifiers are sold, leased or disclosed to others for a commercial purpose without the person's consent and outside the exceptions Washington allows (for example a requested service, a financial transaction or a court order). Confirmed by audit.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1967
BIPAX-007
Enrolled Biometrics Retained Longer Than Necessary (Washington)
Retention statements suggest enrolled biometric identifiers are kept longer than reasonably necessary to provide the service, prevent fraud or security threats, or comply with a law or court order, as Washington limits. Confirmed by audit.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1968
BIPAX-008
Biometric Identification Without Explicit Consent (EU)
Face recognition, voice identification or similar features process biometric data to uniquely identify people in the EU without explicit consent (or another Article 9(2) exception), for example by starting a face scan without a separate, specific consent step.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1969
BIPAX-009
No Easy Way to Withdraw Biometric Consent (EU)
Consent to face or voice processing can be given with one click but there is no equally easy way to withdraw it later (for example withdrawal only by post or email request), although GDPR requires withdrawal to be as easy as giving consent.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1970
BIPAX-010
Face Search Built on Images Scraped From the Internet (Texas)
The service captures biometric identifiers from photos found online (for example a face search across scraped images) and treats their public availability as consent, although in Texas a person has not been informed or consented merely because an image exists online, unless they published it themselves. Up to $25,000 per violation.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1971
CIPAX-001
Chat Messages Read by a Third Party Without Warning (California)
A third-party chat or transcription script receives visitors' messages in real time while they are being sent, with no notice or consent of all parties. California's wiretap provision prohibits reading or learning the contents of a communication in transit without the consent of all parties, and aiding anyone to do so; individuals may sue for $5,000 per violation. Whether website chat vendors fall under it is disputed in court.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1972
CIPAX-002
Tracking Script Recording Addressing Data Without Consent (California)
Third-party tracking scripts capture visitors' IP addresses, device identifiers or other addressing and routing information without consent. California prohibits installing or using a pen register or trap and trace device — a device or process that records such information — without a court order, and individuals may sue for $5,000 per violation; whether website trackers qualify is disputed in court.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1973
CIPAX-003
Session Recording of Confidential Communications Without Consent (California)
Session-replay or recording scripts capture what visitors type into chats or forms about confidential matters (for example health or financial questions) without the consent of all parties. California prohibits recording a confidential communication without all parties' consent; fines up to $2,500 per violation and private suits for $5,000 per violation.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1974
CIPAX-004
Calls From Mobile Phones Recorded Without Consent (California)
Click-to-call or call-centre features suggest customer calls — including from mobile or cordless phones — are recorded without informing callers and obtaining the consent of all parties, which California prohibits. Confirmed by a test call or audit.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1975
CIPAX-005
Electronic Communications Intercepted Without All-Party Consent (Florida)
Chat, session-replay or similar scripts intercept visitors' electronic communications without the prior consent of all parties, which Florida requires for interception to be lawful. A person whose communication is intercepted may sue for actual damages, but not less than $100 a day or $1,000, whichever is higher. Whether these tools are 'interception' is disputed in court.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1976
CIPAX-006
Intercepted Communication Contents Disclosed or Used (Florida)
Signs that the contents of intercepted chats or recorded sessions are disclosed to other companies or used (for example for advertising) although the business knew or had reason to know they were obtained by unlawful interception, which Florida prohibits. Confirmed by audit of data sharing.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1977
CIPAX-007
Private Communications Intercepted Without All Participants' Consent (Washington)
Chat or messaging features intercept or record private communications between individuals by a device or process designed to record or transmit them, without first obtaining the consent of all participants, which Washington makes unlawful.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1978
CIPAX-008
Private Conversations Recorded by Voice Features Without Consent (Washington)
Voice assistants, voice notes or microphone-based features record private conversations without first obtaining the consent of all persons engaged in them, which Washington prohibits.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1979
CIPAX-009
Session-Replay or Chat Scripts Access the Device Before Consent (EU)
Session-replay, heatmap or third-party chat scripts store or read identifiers on visitors' devices before consent, although for anything not strictly necessary for the service the user requested, EU law requires prior consent based on clear and comprehensive information.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1980
CIPAX-010
Using Intercepted Chat Content for Other Purposes (California)
Signs that information obtained from chats read in transit is used for other purposes — for example to train models or target advertising — although California's wiretap provision also prohibits using, or attempting to use, information so obtained. Confirmed by audit of the vendor's data use.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
Up to $7,500 per violation (VA, TX) / up to $20,000 (CO) / up to $5,000 (NY SHIELD)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1981
LKSG-001
Missing Supply Chain Grievance Channel
A company covered by the German Supply Chain Due Diligence Act (1,000 or more employees in Germany) gives no publicly accessible, clear information on how to reach and use its complaints procedure for human rights and environmental risks in its own operations or at direct suppliers. Failing to set up the procedure can be fined up to €800,000.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1982
LKSG-002
Complaints Procedure Rules Not Publicly Available (Germany)
The company has not published, in text form, the rules of procedure for its supply chain complaints procedure, although the German Supply Chain Due Diligence Act requires them to be publicly accessible.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1983
LKSG-003
Annual Due Diligence Report Not Published on the Website (Germany)
The company has not published on its website, free of charge and within four months after the end of the financial year, its annual report on meeting its supply chain due diligence obligations (risks identified, measures taken, their assessment and conclusions), to remain available for seven years. Fine up to €100,000.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1984
LKSG-004
No Policy Statement on Human Rights Strategy (Germany)
No sign of a policy statement issued by senior management on the company's human rights strategy — describing its due diligence procedure, priority human rights and environmental risks, and expectations of employees and suppliers — which the German Supply Chain Due Diligence Act requires once a risk is identified. Confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1985
LKSG-005
Complaints Procedure Not Reviewed Annually (Germany)
An outdated or non-functional complaints channel (for example a dead link or unanswered contact address) suggests the company does not review the effectiveness of its complaints procedure at least once a year and when its risk situation changes, as the German Supply Chain Due Diligence Act requires. Fine up to €500,000; confirmed by audit.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1986
LKSG-006
No Homepage Link to Supply Chain Slavery Disclosure (California)
A retail seller or manufacturer doing business in California with worldwide gross receipts over $100 million has no conspicuous, easily understood homepage link to its disclosure of efforts to eradicate slavery and human trafficking from its direct supply chain (verification, audits, certification, internal accountability and training).
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1987
LKSG-007
Modern Slavery Statement Not Linked From the Homepage (UK)
A commercial organisation above the UK turnover threshold that has a website does not publish its annual slavery and human trafficking statement there, or does not place a link to it in a prominent place on the homepage.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1988
LKSG-008
Modern Slavery Statement Not Approved or Signed (UK)
The published slavery and human trafficking statement of a company does not show approval by the board of directors (or equivalent) and signature by a director, as the UK Modern Slavery Act requires (for LLPs and partnerships — by the members or partners specified).
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1989
LKSG-009
Forced Labour Report Not Published Prominently on the Website (Canada)
An entity required to report to the Minister by 31 May each year on steps to prevent forced and child labour in its supply chains does not make the report public, including in a prominent place on its website. Failing to comply is an offence with a fine of up to $250,000.
Legal basis: Fighting Against Forced Labour and Child Labour in Supply Chains Act (S.C. 2023, c. 9) s. 13(1), 19(1) (Canada)
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1990
LKSG-010
Forced Labour Report Missing Required Content (Canada)
The published report does not describe the entity's structure, activities and supply chains, its policies and due diligence on forced and child labour, the parts of its business and supply chains at risk and the steps taken, as the Canadian supply chains act requires.
Legal basis: Fighting Against Forced Labour and Child Labour in Supply Chains Act (S.C. 2023, c. 9) s. 11(3) (Canada)
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1991
CSRD-001
Management Report Not in the Single Electronic Reporting Format (EU)
An undertaking subject to EU sustainability reporting publishes its management report only as a PDF or web page, suggesting it is not prepared in the single electronic reporting format (XHTML under Delegated Regulation (EU) 2019/815) that the Accounting Directive requires; mark-up of the sustainability section becomes mandatory only once the tagging rules are adopted. Confirmed through the official filing.
Legal basis: Directive 2013/34/EU Art. 29d(1) (as amended by CSRD)
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1992
CSRD-002
No Sustainability Reporting by an In-Scope Undertaking (EU)
An undertaking that appears to exceed both a net turnover of €450 million and an average of 1,000 employees publishes a management report without the sustainability information needed to understand its impacts on sustainability matters and how they affect its development, performance and position. Confirmed by the undertaking's size data and official report.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1993
CSRD-003
Sustainability Information Not in a Dedicated Section (EU)
The published management report of an in-scope undertaking scatters sustainability information across the document instead of presenting it in a clearly identifiable, dedicated section, as the Accounting Directive requires.
Legal basis: Directive 2013/34/EU Art. 19a(1) second subparagraph
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1994
CSRD-004
No Transition Plan Toward 1.5 °C (EU)
The sustainability section does not describe the undertaking's plans, including implementing actions and related financial and investment plans, to make its business model and strategy compatible with the transition to a sustainable economy, limiting global warming to 1.5 °C under the Paris Agreement and climate neutrality by 2050. Confirmed by review of the official report.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1995
CSRD-005
No Time-Bound Sustainability Targets or Progress (EU)
The sustainability section gives no time-bound targets — including, where appropriate, absolute greenhouse gas reduction targets for at least 2030 and 2050 — no progress towards them, and no statement on whether environmental targets rest on conclusive scientific evidence. Confirmed by review of the official report.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1996
CSRD-006
No Description of Sustainability Due Diligence and Adverse Impacts (EU)
The sustainability section does not describe the due diligence process on sustainability matters, the principal actual or potential adverse impacts connected with own operations and the value chain, and actions taken to prevent, mitigate or remediate them. Confirmed by review of the official report.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1997
CSRD-007
No Consolidated Sustainability Reporting by an In-Scope Group (EU)
The parent of a group that appears to exceed, on a consolidated basis, a net turnover of €450 million and an average of 1,000 employees publishes a consolidated management report without a dedicated section on the group's sustainability impacts and how sustainability matters affect the group. Confirmed by the group's data and official report.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1998
CSRD-008
No Limited Assurance Opinion on Sustainability Reporting (EU)
The published report shows no statutory auditor's opinion, based on a limited assurance engagement, on whether the sustainability reporting complies with the Directive and the reporting standards, including the Taxonomy Regulation Article 8 disclosures. Confirmed by review of the audit report.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1999
CSRD-009
Management Report Not Published Within 12 Months (EU)
The duly approved financial statements and management report, with the auditor's opinion, do not appear to have been published within 12 months after the balance sheet date, in the electronic reporting format where applicable, as the Accounting Directive requires. Confirmed through the business register.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
2000
CSRD-010
No Description of Principal Sustainability Risks (EU)
The sustainability section does not describe the principal risks to the undertaking related to sustainability matters, its principal dependencies on those matters, and how it manages those risks. Confirmed by review of the official report.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
Up to 1% of average daily worldwide turnover per day, for up to 6 months (DORA) / no amount set in the Act (GLBA) / US companies exempt (CTA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
AIfaFocus v2.1 · Live
Terminal Threat Scanner
Drop in any domain. AIfaFocus runs 2000 checks against WCAG 2.1 AA, ADA, GDPR, CCPA and PCI-DSS, plus external indicators that commonly signal gaps in SOC 2 and ISO 27001 controls, and returns a live score in seconds.
oracle-threat-scanner — bash
$
Enter a domain above and click Initiate Scan to run the AIfaFocus compliance audit.
Disclaimer: The results of this automated scan are for informational and educational purposes only and do not constitute official legal advice. The specified fine amounts reflect the maximum possible legislative sanctions for the respective types of violations.