Every regulatory check AIfa Works runs across client engagements — with direct links to the governing law, maximum fine exposure, and enforcement consequence.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
Showing 2000 of 2000 checks
#
Code
Check
Severity
Governing Law
Max Fine
001
ADA-001
Missing ALT Tags on Images
Images lack alternative text attributes, making visual content invisible to screen readers. This is the single most-filed ADA web accessibility complaint and the easiest to prove in court.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
002
ADA-002
Missing ARIA Labels on Interactive Elements
Buttons, links, and interactive controls lack accessible names via aria-label or aria-labelledby. Screen reader users cannot determine the purpose of these elements, creating a barrier to use.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
003
ADA-003
Insufficient Color Contrast Ratio
Text-to-background contrast falls below the 4.5:1 minimum ratio required for normal text. Low-vision users cannot read page content, and this is a measurable, automatable violation frequently cited in demand letters.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
004
ADA-004
No Skip Navigation Link
The page lacks a "skip to main content" link as the first focusable element. Keyboard and screen reader users must tab through the entire navigation on every page load, which is a documented accessibility barrier.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
005
ADA-005
Keyboard-Inaccessible Interactive Elements
Interactive elements such as dropdown menus, modals, or custom controls cannot be operated via keyboard alone. Users who cannot use a mouse are completely blocked from key functionality.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
006
ADA-006
Missing Form Field Labels
Form inputs lack associated <label> elements or aria-label attributes. Screen reader users cannot identify what information is being requested, preventing form completion.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
007
ADA-007
Broken Heading Hierarchy
The page is missing an H1 element or skips heading levels (e.g., H1 to H3). Screen readers rely on heading structure for page navigation; broken hierarchy makes content difficult to scan and understand.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
008
ADA-008
Missing HTML Lang Attribute
The <html> element lacks a lang attribute specifying the page language. Screen readers cannot determine correct pronunciation rules, causing garbled speech output for all page content.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
009
ADA-009
ADA Overlay Widget Installed
A third-party accessibility overlay widget (e.g., AccessiBe, UserWay) is installed. These overlays are considered a "red flag for troll lawyers," do not provide legal compliance, and have been explicitly rejected by disability advocacy organizations and courts.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
010
ADA-010
Inaccessible Careers/Job Application Portal
The careers page or job application portal is not accessible to users with disabilities. This creates liability under both ADA Title I (employment) and Title III (public accommodation) and is a frequent target of serial ADA plaintiffs.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
011
HIPAA-001
Meta Pixel on Medical Booking Pages
The Facebook/Meta tracking pixel is firing on appointment scheduling or medical service pages, transmitting patient health condition data to Meta. HHS has issued explicit guidance that this constitutes impermissible PHI disclosure.
Google Analytics is collecting data on patient portal pages without a signed Business Associate Agreement. Google does not sign BAAs for standard Analytics, making any patient portal tracking an automatic HIPAA violation.
The website does not provide information about patients\' right to receive a Good Faith Estimate of expected charges as required by the No Surprises Act. Self-pay and uninsured patients must be informed of this right before scheduling services.
TikTok, Snapchat, or other social media tracking pixels are active on pages describing specific health conditions or treatments. These pixels transmit URL paths that reveal the health conditions users are researching.
Patient intake or contact forms are processed through a third-party SaaS platform (e.g., Typeform, JotForm) without a signed Business Associate Agreement. All patient data submitted through these forms is an unsecured PHI disclosure.
Medical Chatbot Collecting Symptoms Without Consent
An AI-powered or scripted chatbot is collecting symptom information, health complaints, or medical history without presenting a HIPAA authorization or Notice of Privacy Practices. This creates an uncontrolled PHI collection point.
Patient intake forms are submitted over unencrypted HTTP connections or stored without encryption at rest. HIPAA requires technical safeguards including encryption for electronic PHI in transit and at rest.
The website does not provide a mechanism for patients to request access to or download their protected health information. HIPAA grants patients the right to access their PHI, and the process must be clearly communicated.
Telehealth Across State Lines Without License Filter
Telehealth services are offered to patients in states where the provider is not licensed, without a geographic eligibility filter. Corporate Practice of Medicine (CPOM) laws and state licensure requirements may be violated.
A health or wellness website is tracking user behavior without consent as required by Washington\'s My Health My Data Act (MHMDA). This law applies to any entity collecting health data from Washington residents, not just HIPAA-covered entities.
The website lacks a "Do Not Sell or Share My Personal Information" link in the footer. CCPA requires this link to be clear, conspicuous, and available on every page for California consumers.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
022
CCPA-002
Email Discount Popup Without Financial Incentive Notice
An email signup popup offers a discount (e.g., "10% off for subscribing") without a Financial Incentive notice. CCPA/CPRA requires businesses to disclose the material terms of any financial incentive program linked to data collection.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
023
CCPA-003
Third-Party Trackers Firing Before Cookie Consent
Analytics, advertising, and social media tracking scripts execute before the user has provided consent. Under CCPA/CPRA, third-party data sharing for cross-context behavioral advertising requires opt-out capability at minimum.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
024
CCPA-004
Missing or Inadequate Privacy Policy
The website lacks a comprehensive privacy policy or the existing policy fails to disclose required CCPA categories: types of personal information collected, purposes, third-party sharing, and consumer rights.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
025
CCPA-005
Careers Page Missing Applicant Privacy Notice
The careers or job application page collects resumes and personal data without an Applicant Privacy Notice. CPRA extended privacy rights to job applicants and employees, requiring disclosure at the point of collection.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
026
CCPA-006
No Data Deletion Request Mechanism
The website provides no way for consumers to request deletion of their personal information. CCPA requires at least two methods for submitting consumer requests, including a toll-free number for larger businesses.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
027
CCPA-007
Third-Party Data Sharing Without Disclosure
Personal information is shared with third-party advertising, analytics, or data enrichment services without disclosure in the privacy policy. Each undisclosed sharing relationship is a separate violation.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
028
CCPA-008
Missing Cookie Consent Banner for California Users
No cookie consent mechanism is presented to California visitors. While CCPA does not mandate cookie banners specifically, the CPPA has signaled enforcement priority for sites that deploy tracking cookies without honoring opt-out signals.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
029
CCPA-009
Auto-Opt-In to Marketing Communications
Users are automatically opted into marketing emails or SMS during account creation or checkout without affirmative consent. Pre-checked marketing consent boxes violate both CCPA principles and CAN-SPAM requirements.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
030
CCPA-010
Operating as Data Broker Without Registration
The business collects and sells personal information of consumers with whom it has no direct relationship, meeting the definition of a data broker, without registering with the state as required by Texas SB 2105 and California\'s Delete Act.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
031
FTC-001
Fake Countdown Timer (Dark Pattern)
A "limited time offer" countdown timer resets when the page is reloaded, revealing it is fabricated urgency. The FTC classifies fake countdown timers as a deceptive dark pattern subject to enforcement under Section 5.
A crossed-out "original" price is displayed that was never the actual selling price, creating a phantom discount. The FTC\'s Guides Against Deceptive Pricing prohibit fictitious former prices.
A "X people are viewing this right now" or "only Y left in stock" counter displays fabricated or unverifiable numbers. The FTC considers manufactured social proof to be a deceptive trade practice.
Customer reviews are displayed without verification of purchase or authenticity. The FTC\'s 2024 Rule on the Use of Consumer Reviews prohibits fake, purchased, or incentivized reviews without clear disclosure.
Canceling a subscription requires more steps, phone calls, or obstacles than the original signup process. The FTC\'s Click-to-Cancel Rule requires cancellation to be as easy as enrollment.
Affiliate links and referral commissions are not disclosed clearly and conspicuously above the first affiliate link on the page. The FTC requires material connection disclosure before the consumer encounters the endorsement.
Customer or influencer testimonials are displayed without disclosing that the reviewer received compensation, free products, or other incentives. Each undisclosed paid endorsement can incur fines up to $50,000.
Marketing copy uses terms like "eco-friendly," "carbon neutral," or "sustainable" without third-party certification or substantiation. The FTC\'s Green Guides require competent and reliable scientific evidence for environmental claims.
A free trial automatically converts to a paid subscription without clear, conspicuous disclosure of the conversion terms, billing date, and amount before the consumer provides payment information.
The price shown in advertising or search results differs from the price displayed at checkout due to added fees, different product versions, or changed terms. This constitutes classic bait-and-switch deception.
The contact or lead generation form collects phone numbers without an explicit opt-in checkbox for SMS communications. A2P 10DLC carrier requirements and the TCPA mandate prior express written consent for marketing texts.
Automated marketing text messages are sent outside permitted hours. Florida\'s Telephone Solicitation Act (FTSA) restricts texts to 8 AM–8 PM local time, with other states imposing similar windows.
Marketing text messages do not include opt-out instructions (e.g., "Reply STOP to unsubscribe"). CTIA guidelines and the TCPA require every marketing SMS to include a clear opt-out mechanism.
Commercial email messages do not include the sender\'s valid physical postal address. CAN-SPAM requires every commercial email to contain the sender\'s current street address or registered P.O. box.
Commercial emails lack a functioning unsubscribe mechanism. CAN-SPAM requires a clear, conspicuous opt-out method in every commercial message, and opt-out requests must be honored within 10 business days.
Abandoned cart recovery text messages are sent to consumers who did not provide prior express written consent for marketing texts. Cart abandonment does not constitute consent under the TCPA.
An automatic telephone dialing system (ATDS) is used to place calls or send texts without obtaining prior express consent. The TCPA prohibits unsolicited autodialed or prerecorded calls to cell phones.
Business SMS messages are sent via long codes (10-digit numbers) without proper A2P 10DLC campaign registration with carriers. Unregistered campaigns face message filtering, blocking, and per-message carrier fines.
The bulk SMS system does not automatically process STOP keyword responses to immediately cease messaging. Failure to honor opt-out keywords exposes the business to TCPA class-action liability at $500–$1,500 per message.
Pre-recorded or artificial voice marketing messages are delivered to consumers without prior express written consent. The TCPA\'s robocall provisions carry statutory damages of $500–$1,500 per call.
The Facebook/Meta tracking pixel loads and transmits user data before the visitor has interacted with the cookie consent banner. Under GDPR, non-essential tracking requires prior, informed, and affirmative consent.
The website displays no cookie consent mechanism to visitors from EU member states. The ePrivacy Directive and GDPR require informed consent before placing non-essential cookies or tracking technologies.
Google Analytics collects visitor data from EU users without obtaining prior consent. Multiple EU Data Protection Authorities have ruled that Google Analytics transfers constitute unlawful processing and cross-border data transfer.
Third-party services processing personal data on behalf of the controller operate without a signed Data Processing Agreement. GDPR mandates written contracts specifying processing scope, purpose, and security obligations.
The organization has no documented procedure for notifying the supervisory authority within 72 hours of becoming aware of a personal data breach. Failure to notify is a separate, independently finable violation.
Personal data of EU residents is transferred to US-based servers or services without Standard Contractual Clauses (SCCs), adequacy decisions, or other approved transfer mechanisms following the Schrems II ruling.
Standard YouTube embeds combined with tracking pixels create a video viewing data leak similar to VPPA violations. YouTube\'s standard embed shares viewing habits with Google before consent is obtained.
The website provides no way for data subjects to request erasure of their personal data. GDPR\'s Right to Erasure requires controllers to delete personal data upon request when no overriding legal basis exists.
The privacy policy does not specify how long personal data is retained or the criteria used to determine retention periods. GDPR requires transparent communication of retention periods at the point of collection.
The cookie consent banner presents pre-checked consent boxes for analytics or marketing cookies. The CJEU ruled in Planet49 that pre-ticked checkboxes do not constitute valid consent under GDPR.
The website does not set a Content-Security-Policy HTTP header, leaving it vulnerable to cross-site scripting (XSS) and data injection attacks. CSP is a critical defense layer for preventing unauthorized script execution.
API keys for services like Google Maps, Stripe, or SendGrid are visible in client-side JavaScript source code. Exposed secret keys can be harvested by bots and used for unauthorized API access, billing fraud, or data exfiltration.
Credit card numbers are collected directly into form fields on the merchant\'s server rather than through a PCI-compliant tokenization service (e.g., Stripe Elements, Braintree). This places the entire site in PCI-DSS scope.
Pages containing forms, login fields, or payment inputs are served over unencrypted HTTP. All data submitted on these pages can be intercepted in transit by any network intermediary.
The page is served over HTTPS but loads sub-resources (images, scripts, stylesheets) over insecure HTTP. Mixed content undermines the security guarantee of HTTPS and can be exploited for man-in-the-middle attacks.
Server directories such as /wp-content/uploads/ are browsable, exposing uploaded files, internal documents, and potentially sensitive data. Directory listing must be disabled on all web-accessible paths.
The WordPress XML-RPC endpoint (xmlrpc.php) is publicly accessible and responding to requests. This endpoint is a known vector for brute-force amplification attacks and DDoS abuse.
The content management system (WordPress, Magento, Drupal) is running an outdated version with publicly disclosed security vulnerabilities. Unpatched CMS installations are the primary vector for website compromises.
External JavaScript files are loaded without Subresource Integrity (SRI) hashes. If a third-party CDN or script host is compromised, malicious code could be injected into the page without detection.
Contact forms, login pages, and registration forms lack CAPTCHA or bot-detection mechanisms. Unprotected forms are vulnerable to credential stuffing, spam injection, and automated abuse at scale.
A third-party chatbot records and stores conversation transcripts without informing users and obtaining consent. Under California\'s Invasion of Privacy Act (CIPA), this constitutes illegal wiretapping at $5,000 per dialog.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
072
STATE-002
BIPA: Virtual Try-On Without Biometric Consent
A virtual try-on or face-scanning feature collects biometric identifiers without obtaining informed written consent as required by Illinois BIPA. Violations carry statutory damages of $1,000–$5,000 per scan.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
073
STATE-003
Utah AI Act: AI Chatbot Not Disclosing AI Identity
An AI-powered chatbot or virtual assistant fails to identify itself as artificial intelligence when directly asked by a user. Utah\'s AI Policy Act requires AI systems to disclose their non-human nature upon inquiry.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
074
STATE-004
CA BOT Act: AI Using Human Name Without Disclosure
An AI chatbot or automated account uses a human name, avatar, or persona without disclosing that it is not a human. California\'s BOT Act (SB 1001) requires clear disclosure when AI impersonates a human in online interactions.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
075
STATE-005
Proposition 65: Missing Toxic Substance Warning
Products shipped to California contain chemicals listed under Proposition 65 without the required "known to cause cancer or reproductive harm" warning. Violations carry penalties of $2,500 per day per violation.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
076
STATE-006
CA Auto-Renewal: No Reminder Before Annual Charge
Annual subscriptions renew without sending a reminder email before the charge. California\'s Automatic Renewal Law requires businesses to provide a clear reminder with cancellation instructions before each renewal.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
077
STATE-007
Inadequate Age-Gate for Restricted Products
Age verification for alcohol, vape, or CBD products relies on a simple "Yes I\'m 21" button without real identity verification. Multiple states require robust age verification beyond self-attestation for restricted product sales.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
078
STATE-008
SB 478: Hidden Service Fees at Checkout
Mandatory fees, service charges, or surcharges are revealed only at checkout rather than being included in the advertised price. California\'s SB 478 (Junk Fee Ban) prohibits hidden fees not disclosed upfront.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
079
STATE-009
NY SHIELD Act: Inadequate Data Security
The business collects private information of New York residents without implementing reasonable data security safeguards as required by the SHIELD Act. Administrative, technical, and physical safeguards must be documented.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
080
STATE-010
Job Postings Without Salary Range
Job listings do not include compensation ranges as required by pay transparency laws in California, New York, Colorado, and Washington. Penalties range up to $10,000 per non-compliant posting.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
081
FIN-001
GLBA: Sensitive Financial Docs via Unsecured Email
The business accepts sensitive financial documents (tax returns, bank statements, SSNs) via standard unencrypted email. GLBA\'s Safeguards Rule requires financial institutions to implement secure transmission methods for customer data.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
082
FIN-002
FinCEN BOI: Missing Beneficial Ownership Report
The LLC or corporation has not filed a Beneficial Ownership Information report with FinCEN as required by the Corporate Transparency Act. Non-compliance carries penalties of $500 per day, up to $10,000, plus potential criminal liability.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
083
FIN-003
FINRA: Personal Email for Investment Communications
An investment advisor or broker-dealer uses personal Gmail or unarchived email for client communications instead of a supervised, archived corporate email system. FINRA requires retention and supervision of all business communications.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
084
FIN-004
Missing Contractor License Number on Website
A licensed contractor\'s website does not display the state contractor license number. Most states require the license number to appear on all advertising and business communications, with penalties of $2,000–$5,000.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
085
FIN-005
No DMCA Agent or Takedown Policy
The website has no registered DMCA agent with the U.S. Copyright Office and does not publish a DMCA takedown policy page. Without these, the business loses safe harbor protection for user-generated content.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
086
FIN-006
Missing Arbitration Clause in Terms of Service
The Terms of Service lack a class action waiver and mandatory arbitration clause. Without these provisions, the business is exposed to class-action litigation for any consumer dispute.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
087
FIN-007
Return Policy Not Prominently Displayed
California law requires a no-return or limited-return policy to be conspicuously displayed at the point of sale. If not displayed, consumers are entitled to a full refund within 30 days regardless of the merchant\'s intended policy.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
088
FIN-008
Credit Card Surcharge Without Advance Notice
A credit card surcharge or convenience fee is added at checkout without prior notice at the point of entry. Multiple states require advance signage/disclosure, and card network rules limit surcharges to 3% with mandatory disclosure.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
089
FIN-009
SEC Form CRS Missing for Investment Advisors
A registered investment advisor\'s website does not publish Form CRS (Client Relationship Summary) as required by SEC Regulation Best Interest. Form CRS must be delivered to retail investors and made publicly available.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
090
FIN-010
Insurance Lead Generation Without Required Disclosures
The website generates insurance quotes or leads without state-required disclosures about the nature of the service, compensation arrangements, and licensure status. Multiple states require specific disclosures for insurance lead generators.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
091
OPS-001
Missing DMARC Record
The domain lacks a DMARC (Domain-based Message Authentication, Reporting & Conformance) DNS record. Without DMARC, emails are increasingly rejected or spam-foldered by Gmail, Yahoo, and other major providers enforcing DMARC policies.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
092
OPS-002
Missing SPF Record
The domain has no SPF (Sender Policy Framework) DNS record, making it vulnerable to email spoofing. Attackers can send emails appearing to come from the domain, enabling phishing attacks against customers and partners.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
093
OPS-003
Broken Outbound Links to Expired Domains
The website contains links pointing to expired, parked, or potentially malicious domains. Broken outbound links damage SEO authority and can redirect users to phishing or malware sites if the expired domain is re-registered by bad actors.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
094
OPS-004
Orphaned Tracking Scripts from Discontinued Services
The website loads JavaScript from services that have been discontinued, acquired, or abandoned. These zombie scripts waste page load time, may break functionality, and pose a supply-chain security risk if the domain is re-registered.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
095
OPS-005
Missing DKIM Email Authentication
The domain does not publish DKIM (DomainKeys Identified Mail) records for email authentication. Without DKIM, receiving mail servers cannot verify that email content was not altered in transit, reducing deliverability.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
096
OPS-006
Outdated Copyright Year in Footer
The website footer displays an outdated copyright year, signaling to visitors, search engines, and potential litigants that the site may be abandoned or unmaintained. This erodes trust and can negatively impact search rankings.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
097
OPS-007
Missing robots.txt and Sitemap
The website lacks a robots.txt file and/or XML sitemap. Without these, search engines may crawl the site inefficiently, index sensitive pages, or miss important content entirely, directly impacting organic search visibility.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
098
OPS-008
Poor Mobile Tap Targets
Interactive elements (buttons, links, form fields) are smaller than 48x48 CSS pixels or positioned too close together, causing frequent mis-taps on mobile devices. This is both a UX issue and a WCAG 2.5.5 accessibility violation.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
099
OPS-009
Contact Form Without Rate Limiting
The contact form has no rate limiting, honeypot, or abuse prevention mechanism. Unprotected forms are routinely exploited for spam injection, phishing relay, and denial-of-service attacks against the form handler.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
100
OPS-010
Missing or Expired SSL Certificate
The website lacks a valid SSL/TLS certificate or the certificate has expired. Browsers display prominent security warnings that drive away visitors, and search engines penalize non-HTTPS sites in rankings.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
101
ADA-101
Missing Accessibility Information on Products/Services
EAA-regulated digital services fail to provide clear accessibility information and features in their digital interface, violating EU Directive 2019/882 requirements for e-commerce and banking.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
102
ADA-102
Non-Compliant Public Feedback Processes
The website's feedback mechanism is not accessible to persons with disabilities, violating AODA customer service standards for Ontario-based organizations.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
103
COP-101
Illegal Personal Information Collection from Children
The website collects personal data (names, emails, tracking cookies) from users under 13 without obtaining verifiable parental consent, violating COPPA regulations.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
105
PIP-102
Vague Purposes for Personal Data Collection
Form fields collect data without clearly identifying the specific, limited purpose of collection at or before the time of collection under PIPEDA requirements.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
108
POP-101
Direct Marketing Without Opt-In Consent
Website deploys pre-checked consent boxes or opt-out forms for electronic direct marketing, violating POPIA opt-in regulations for South African consumers.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
109
POP-102
Unlawful Cross-Border Data Transfer Disclosures
South African website transfers personal data outside of South Africa without ensuring the recipient country has adequate data protection laws or disclosing it to the user.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
110
APP-101
Non-Compliant Overseas Data Disclosure Statement
Australian-targeted site fails to state in its privacy policy whether it is likely to disclose personal information to overseas recipients and, if so, in which countries.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
111
APP-102
Lack of Anonymous/Pseudonymous Interaction Option
The website forces users to identify themselves for general inquiries where it is not practically or legally necessary, violating Australian Privacy Principle 2.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
114
AIA-101
Unmarked Generative AI Output / Deepfakes
Website presents AI-generated text, audio, or video (deepfakes) without marking it in a machine-readable format as AI-generated, violating EU AI Act transparency rules.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
115
AIA-102
Lack of Disclosure on AI User Interaction
The website uses an AI system (like a customer support chatbot) to interact with natural persons without informing them that they are interacting with an AI, violating transparency mandates.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
116
DSA-101
Deceptive UI Patterns (Dark Patterns) in Design
The website employs dark patterns that distort or impair the user's ability to make autonomous, informed choices (e.g., difficult unsubscribe flows, deceptive consent popups).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
118
DMA-101
Unlawful Data Combination Across Services
Gatekeeper-scale platforms combine personal data from their core platform with data from other services without specific user consent, violating DMA regulations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
120
STA-102
Absence of Consumer Appeal Rights Process
The privacy policy fails to explain the process for consumers to appeal a refusal to take action on a privacy rights request, violating Virginia VCDPA and Texas TDPSA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
121
STA-103
Lack of Sensitive Data Processing Opt-In
The website processes sensitive personal data (e.g., precise geolocation, health data, racial info) without obtaining affirmative opt-in consent from Colorado or Virginia residents.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
122
NYD-101
Lack of Cybersecurity Multi-Factor Auth (MFA)
Financial services website does not enforce multi-factor authentication for access to corporate email or customer portal databases, violating NY DFS requirements.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
125
DOR-101
Inadequate ICT Third-Party Risk Disclosures
Financial entity fails to maintain a comprehensive register of information on its contractual arrangements with ICT third-party service providers, violating DORA guidelines.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
126
VPPA-001
Video Tracking Pixel Fires Without VPPA Consent
Website embeds video content (HTML5 video, YouTube, Vimeo iframes) alongside Meta Pixel, Google Analytics, or other tracking pixels that transmit video viewing data to third parties without obtaining separate, explicit written consent. Under the VPPA, knowingly disclosing a consumer\'s PII linked to video viewing habits without prior consent is a violation.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
127
EAA-001
No Accessibility Statement Published Under European Accessibility Act
E-commerce or digital service website targeting EU consumers lacks a publicly accessible accessibility statement describing conformance status with EN 301 549 / WCAG 2.1 AA. The European Accessibility Act (Directive 2019/882), enforceable since June 28, 2025, requires private-sector businesses providing covered services to publish accessibility declarations.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
128
NIS2-001
No Security.txt or Vulnerability Disclosure Policy (NIS2)
Website of an essential or important entity (energy, health, transport, digital infrastructure) lacks a /.well-known/security.txt file or any publicly accessible vulnerability disclosure policy. NIS2 Directive requires covered entities to implement incident handling and vulnerability management measures.
Health Data Shared Without FTC Health Breach Notification Compliance
Non-HIPAA health website or app (wellness, fitness, symptom checker) collects identifiable health information and transmits it to third-party analytics/advertising platforms without displaying a breach notification policy. The FTC Health Breach Notification Rule (amended July 2024) treats unauthorized sharing of health data as a breach.
Cookie Wall Blocks Access Without Valid Reject Option
Website displays a cookie consent banner that blocks all content access until cookies are accepted, with no \"Reject All\" option or equivalent free-access alternative. The EDPB and CJEU have ruled that cookie walls conditioning service access on acceptance of non-essential cookies do not constitute freely given consent under GDPR.
Minor\'s Data Used for Targeted Advertising Without Opt-In (CTDPA)
Website directs content at minors (under 18) or collects age data indicating minor users, but continues to fire targeted advertising pixels without obtaining affirmative opt-in consent. Connecticut SB 3 (amending CTDPA) prohibits processing minors\' data for targeted advertising or profiling without explicit consent.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
132
OCPA-001
Website Does Not Honor Global Privacy Control Signal (Oregon CPA)
Website targeting Oregon consumers does not detect or honor the Global Privacy Control (GPC) browser signal as a valid opt-out request for targeted advertising and personal data sales. The Oregon Consumer Privacy Act mandates recognition of universal opt-out preference signals as of January 1, 2026.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
133
COAI-001
High-Risk AI System Without Public Transparency Disclosure (Colorado AI Act)
Website uses AI-driven systems for consequential decisions (hiring, lending, insurance, housing) but lacks a publicly accessible statement disclosing which high-risk AI systems are deployed and how algorithmic discrimination risks are managed. Colorado SB 24-205 requires deployers to maintain such disclosures.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
134
JPAP-001
Cookie Data Shared With Third Parties Without Japan APPI Disclosure
Website targeting Japanese users transfers cookie/tracking data to third-party advertising or analytics vendors that can combine it to identify individuals, without disclosing these transfers or confirming third-party consent. Japan\'s APPI and the Telecommunications Business Act require transparency and consent confirmation for such transfers.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
135
KRPI-001
Non-Essential Cookies Set Before Consent for South Korean Users
Website targeting South Korean users sets tracking or advertising cookies before obtaining explicit, informed consent. South Korea\'s PIPA requires prior opt-in consent before collecting personal information including behavioral tracking data. Violations carry fines up to 3% of total revenue.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
136
FERP-001
Education Website Tracking Pixels Transmitting Student Data
Educational institution website embeds Meta Pixel, Google Analytics, or similar tracking technologies on student-facing pages (portals, enrollment forms, course catalogs) that transmit potentially identifiable student data to third parties. FERPA prohibits unauthorized disclosure of PII from education records.
Website uses electronic signatures or agreements for transactions but fails to provide required pre-consent disclosures including: the right to receive paper copies, the right to withdraw consent and procedures for doing so, and the hardware/software requirements for accessing records.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
138
IDDP-001
Privacy Notice Not Available in Required Languages (India DPDP Act)
Website collecting personal data from Indian users does not provide a privacy notice in English and at least one of the 22 scheduled Indian languages as required by the Digital Personal Data Protection Act 2023. The notice must include itemized descriptions of data collected, purposes, and user rights.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
139
FACT-001
Full Credit Card Number Shown on Electronic Receipt (FACTA Violation)
Website displays more than the last five digits of a credit/debit card number or shows the expiration date on electronic order confirmations, receipts, or account pages. FACTA mandates truncation of card numbers to no more than five digits and prohibits printing the expiration date on electronically printed receipts.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
140
DLDP-001
No Clear Opt-Out Mechanism for Delaware Consumers (DPDPA)
Website targeting Delaware consumers lacks a clear, conspicuous opt-out link for targeted advertising and personal data sales, or fails to recognize universal opt-out signals (GPC). The Delaware Personal Data Privacy Act (effective January 1, 2025) requires both mechanisms.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
141
THPD-001
Non-Essential Cookies Firing Without Opt-In Consent (Thailand PDPA)
Website targeting Thai users fires non-essential cookies (analytics, advertising, social) before obtaining explicit opt-in consent via a compliant consent banner. Thailand\'s PDPA requires express, active opt-in consent before processing personal data including cookies. Pre-ticked boxes are explicitly non-compliant.
Website of an SEC-reporting public company does not include or link to cybersecurity risk management disclosures (board oversight, management expertise, risk assessment processes) as required in 10-K filings. Corporate websites must reference or link to these disclosures for investor relations compliance.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
143
TRKV-001
Missing Data Controller Registration Notice (Turkey KVKK)
Website processing personal data of Turkish residents does not disclose the identity of the data controller, VERBIS (Data Controllers Registry) registration number, or provide a compliant privacy notice identifying purposes of processing, third-party transfers, and data subject rights per KVKK requirements.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
144
NZPR-001
Cross-Border Data Transfer Without NZ Privacy Act IPP 12 Compliance
Website collects personal data from New Zealand users and transfers it overseas (evidenced by US/EU-based tracking scripts) without disclosing in the privacy policy that data may be transferred overseas and what safeguards are in place per Information Privacy Principle 12.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
145
MNDP-001
Privacy Notice Missing Data Retention Periods (Minnesota MCDPA)
Website targeting Minnesota consumers has a privacy policy that does not disclose data retention periods or policies for personal data collected. The Minnesota Consumer Data Privacy Act (effective July 31, 2025) uniquely requires retention policy disclosure in the privacy notice.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
146
EIDS-001
Very Large Online Platform Not Prepared for EUDI Wallet Acceptance
Very Large Online Platform (VLOP) requiring strong customer authentication for login, age verification, or KYC does not support or indicate readiness for EU Digital Identity Wallet acceptance. eIDAS 2.0 mandates VLOPs accept EUDI Wallet by December 2027.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
147
AMLK-001
AML/KYC Customer Identification Notice Missing on Financial Site
Website of a financial institution, fintech, or money services business that opens accounts online does not display the required customer notification explaining that personal information is being collected to comply with federal identity verification (CIP) requirements under the USA PATRIOT Act/BSA.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
148
CTHL-001
Geofencing Near Health Facility for Data Collection (CT SB 3)
Website or associated mobile app uses geofencing technology within 1,750 feet of a mental, reproductive, or sexual health facility to identify, track, or send push notifications to consumers for health data collection purposes. Connecticut SB 3 specifically prohibits this practice.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
149
IDDG-001
Missing Grievance Redressal Mechanism for Indian Data Principals
Website collecting personal data from Indian users does not provide a designated grievance officer\'s contact details or a complaint mechanism for data principals. The India DPDP Act 2023 requires Data Fiduciaries to establish an accessible grievance redressal mechanism on their website.
Website\'s cookie consent banner makes the \"Accept All\" button visually prominent (larger, colored, higher placement) while the \"Reject All\" or \"Manage Preferences\" option is obscured, smaller, or requires additional clicks. European DPAs (CNIL, AEPD, Belgian DPA) have ruled that asymmetric cookie banners constitute dark patterns undermining freely given consent.
Biometric Capture Without Prior Notification and Consent (Texas CUBI)
Website captures biometric identifiers (such as facial geometry scans from virtual try-ons or photos, or voiceprints) without informing the individual prior to capture and without obtaining their explicit consent, violating Texas CUBI.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
152
EUAI-003
Missing Machine-Readable Metadata/Watermark in AI-Generated Content (EU AI Act)
Providers of AI systems that generate or manipulate image, audio, or video content (synthetic content/deepfakes) must ensure that the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
153
QC25-002
Missing Data Protection Officer (DPO) Contact Details on Website (Quebec Act 25)
Website collecting personal information from Quebec residents fails to publish the title and contact details of the person in charge of personal information protection (DPO/Responsable) on the website, violating Section 3.1 of Quebec's Act 25.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
154
COPA-001
Failure to Recognize Global Privacy Control (GPC) Opt-Out Signal (Colorado CPA)
Website targeting Colorado consumers fails to recognize and process the Global Privacy Control (GPC) universal opt-out signal to automatically opt users out of the processing of their personal data for targeted advertising or sale, which is mandatory as of July 1, 2024.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
155
MHMDA-002
Missing Consumer Health Privacy Policy Link on Homepage (WA MHMDA)
Website collecting consumer health data (e.g., searches for symptoms, reproductive wellness trackers, fitness registrations) fails to display a separate, distinct link on its homepage footer or header titled "Consumer Health Privacy Policy", as required by Washington State's MHMDA.
Missing Separate Consent for Sensitive Personal Information Processing (China PIPL)
Website targeting Chinese residents collects sensitive personal information (such as financial accounts, medical records, biometrics, or precise location) without obtaining separate, specific consent for each category of sensitive data, violating PIPL Article 29.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
157
DSA-001
Dark Patterns in User Interfaces (EU DSA Article 25)
Website uses deceptive design techniques or dark patterns that distort, impair, or manipulate the user's ability to make free and informed decisions (e.g., making subscription cancellation significantly harder than signing up), violating DSA Article 25.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
158
KRPA-001
Bundling Consent for Third-Party Data Transfers (South Korea PIPA)
Website collects personal data of South Korean residents and shares it with third parties (such as marketing networks, CRM tools, or analytics) but bundles the third-party transfer agreement with the general privacy policy or terms of service, violating South Korea PIPA Article 17.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
159
UKOSA-001
Inadequate Age Verification for Regulated Content (UK OSA)
Website publishes content harmful to children (such as adult content, gambling, or highly sensitive violent content) but fails to implement robust age verification, relying instead on simple click-through "I am 18" age gates, violating the UK Online Safety Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
160
EUAI-004
Missing Emotion Recognition / Biometric Categorization Disclosure (EU AI Act)
Providers or deployers of emotion recognition or biometric categorization systems must inform natural persons exposed thereto of the operation of the system, violating transparency obligations under EU AI Act Article 52(2).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
161
CAAD-002
Default Geolocation Disabled for Under-18 Users (CA AADC)
Website likely to be accessed by minors fails to disable precise geolocation tracking by default, violating California's Age-Appropriate Design Code Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
162
BIPA-002
Missing Biometric Retention and Destruction Policy (BIPA)
Website collecting or utilizing biometric data (virtual try-on, authentication) fails to publish a publicly available retention schedule and destruction guidelines as mandated by Illinois BIPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
164
VCDP-002
Geofencing Around Healthcare Facilities for Data Collection (VCDPA)
Website or app uses geofencing within 1,750 feet of any healthcare facility to track, identify, or target consumers for health data collection, which is prohibited under Virginia's amended VCDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
165
TDPS-001
Sensitive Data Consent Violation (Texas TDPSA)
Website targeting Texas consumers collects sensitive personal data, including biometric or genetic identifiers, without obtaining explicit prior opt-in consent as mandated by the Texas Data Privacy and Security Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
166
MTDP-001
Missing Parent Consent Verification for Minors under 13 (Montana MCDPA)
Website targeting Montana consumers collects personal data of minors under 13 without obtaining verifiable parental consent in accordance with the Montana Consumer Data Privacy Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
167
FDBR-001
Failure to Disclose Facial Recognition Surveillance (Florida FDBR)
Website or associated web application utilizes active facial recognition or surveillance software without providing a clear, conspicuous front-end notice and obtaining opt-in consent as required by the Florida Digital Bill of Rights.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
168
NJPA-001
Missing Privacy Disclosures for Children's Data (New Jersey Privacy Act)
Website targeting New Jersey consumers collects data from minors (under 18) without providing the required heightened privacy notice detailing specific processing and sharing policies.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
169
NEDP-001
Inadequate Notice of Consumer Profiling (Nebraska NDPA)
Website targeting Nebraska consumers utilizes automated decision-making or profiling for employment, finance, or housing without disclosing the profiling logic in its privacy notice.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
170
NHPA-001
Missing Direct Marketing Opt-Out Link (New Hampshire Privacy Act)
Website targeting New Hampshire consumers fails to provide an easily accessible opt-out link for targeted advertising or personal data sale on its homepage, violating the New Hampshire Privacy Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
171
GDPR-011
Inaccessible Format for Data Portability Requests (GDPR)
Website's data download tools output personal data in a proprietary or unstructured format (e.g., PDF reports) rather than a structured, commonly used, machine-readable format (e.g., JSON or CSV) as required by GDPR.
Non-Layered Privacy Policy Information Structure (GDPR)
Website displays a single, dense, unnavigable blocks-of-text privacy policy without employing a multi-layered, tabbed, or expandable design structure to ensure transparency and readability.
Missing Ad Repository and Transparency Log (EU DSA)
Online platform displaying advertisements to EU users fails to provide a publicly accessible ad library containing search filters, advertiser identities, and targeting parameters, violating DSA Article 39.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
174
DSA-003
Missing Single Point of Contact for Authorities (EU DSA)
Digital platform targeting EU users fails to publish a dedicated, easily accessible email address and communication channel for direct contact by EU authorities, violating DSA Article 11.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
175
DMA-001
Involuntary Gatekeeper Data Bundling (EU DMA)
Gatekeeper online platforms bundle personal data collected from a core platform service with data from other services without obtaining explicit, separate consent from the user, violating DMA Article 5(2).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
176
EUDAT-001
Smart Contract Access Lack of Deactivation Capability (EU Data Act)
Web panels administering smart contracts or IoT systems fail to provide mechanisms for safe, authorized deactivation and termination of smart contracts, violating EU Data Act Article 30.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
177
GDPR-013
Missing Consent Status Logging and Audit Trails (GDPR)
Website collecting personal data fails to record, log, and maintain audit trails of the exact timestamp, consent version, and user action for cookie consent agreements, violating GDPR Article 7(1).
Website runs non-essential analytics or advertising tracking scripts (e.g., Google Analytics, Meta Pixel) prior to the user interacting with the cookie consent banner, violating the ePrivacy Directive.
Lack of Operational Resilience Disclosures (EU DORA)
Website of a financial entity or critical third-party provider fails to disclose cybersecurity operational risk management frameworks and emergency contact paths, violating DORA Article 30.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
180
GDPR-014
Missing Retention Timelines in Privacy Disclosures (GDPR)
Privacy policy fails to specify concrete retention periods or criteria used to determine retention durations for distinct categories of personal data, violating GDPR transparency principles.
Data Disposal Standards Infraction (Australia Privacy Act)
Website holding personal data of Australian residents fails to implement automated scripts or schedules to permanently de-identify or destroy data that is no longer needed, violating APP 11.2.
Website collecting data of Singapore residents fails to provide an easily accessible online tool or form allowing users to withdraw consent for marketing or data processing, violating Singapore PDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
183
SGPD-002
Missing Data Protection Officer Visibility (Singapore PDPA)
Website targeting Singapore users fails to publish the contact information (such as a direct email address) of the designated Data Protection Officer, violating Section 20 of Singapore PDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
184
DPDP-002
Missing Right to Nominate Representative Notice (India DPDP Act)
Website targeting Indian residents fails to inform users in its privacy policy of their right to nominate any other individual to act on their behalf in the event of death or incapacity, violating DPDP Act Section 14.
Website fails to support or link to authorized Consent Managers to allow Indian data principals to give, manage, review, and withdraw consent through an automated portal, violating DPDP Act Section 6(7).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
186
JPAP-002
Missing Disclosures for Handling Anonymized Data (Japan APPI)
Website utilizing anonymized data of Japanese residents fails to publish the items of personal information included in the anonymized data and the security measures taken, violating APPI Article 36.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
187
NZPR-002
Missing Contact Link for Privacy Officer (New Zealand Privacy Act)
Website collects data of New Zealand residents but fails to display contact paths for its designated Privacy Officer, violating NZ Privacy Act Section 201.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
188
THPD-002
Missing DPO Contact Details in Consent Flows (Thailand PDPA)
Website collects personal data of Thai residents but fails to provide the contact details of the Data Protection Officer or representative in its consent banners or policies, violating Thailand PDPA Section 42.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
189
VNDP-001
Missing Local Data Protection Officer for Sensitive Data (Vietnam Decree 13)
Website collecting sensitive personal data (e.g., location, health, financial) of Vietnamese residents fails to establish a local data protection department or appoint a DPO as mandated by Decree 13.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
190
PHDP-001
Bundled Consent for Profiling and Automated Decision-Making (Philippines DPA)
Website collects data of Philippine residents and conducts automated profiling or decision-making without obtaining separate, express consent, violating the Philippines Data Privacy Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
191
LGPD-002
Missing Data Subject Rights Portal Link (Brazil LGPD)
Website fails to display a clear, separate link on its main page allowing Brazilian residents to submit direct requests to access, correct, delete, or anonymize their personal data, violating LGPD Article 18.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
192
POPI-001
Missing Prior Authorization for Processing Credit Data (South Africa POPIA)
Website of a financial or credit evaluation service targeting South African residents processes consumer credit reports or history without prior registration or authorization, violating POPIA Section 57.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
193
SAPD-001
Missing Opt-in Consent for Direct Marketing (Saudi Arabia PDPL)
Website targeting Saudi Arabian residents sends promotional communications or tracks behavior for advertising purposes without obtaining prior explicit opt-in consent, violating PDPL Article 28.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
194
ILPA-001
Failure to Disclose Database Registration Status (Israel Privacy Act)
Website collecting personal data of Israeli residents fails to specify whether the database is registered with the Database Registrar, the registration number, and the purposes of data collection, violating Israel Privacy Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
195
DIFC-001
Missing Separate Consent for Direct Marketing (Dubai DIFC)
Website operating under DIFC jurisdiction collects personal data and bundles consent for marketing or profiling with the general terms, violating DIFC Data Protection Law Article 12.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
196
NDPA-001
Missing Cross-Border Data Transfer Disclosures (Nigeria NDPA)
Website collecting data of Nigerian residents transfers it to foreign servers (e.g., US/EU analytics engines) without disclosing the target countries and verifying adequacy, violating Nigeria Data Protection Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
197
KEDP-001
Unauthorized Cross-Border Transfer of Health Data (Kenya DPA)
Website collects sensitive health or medical records of Kenyan residents and stores them on servers located outside Kenya without obtaining explicit approval and consent, violating Kenya DPA Section 50.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
198
EGDP-001
Lack of License for Electronic Marketing Messages (Egypt DPA)
Website targeting Egyptian users sends promotional emails or texts without obtaining the necessary electronic marketing license from the Data Protection Center, violating Egypt Law 151.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
199
MRDP-001
Unauthorized International Data Transfer (Morocco CNDP Law 09-08)
Website collects personal data of Moroccan residents and transfers it outside Morocco (evidenced by external script endpoints) without obtaining prior written authorization from the CNDP.
Website collecting personal data fails to disclose the specific administrative and technical security measures deployed to safeguard user data, violating transparency mandates under LGPD Article 46.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
201
FTCS-001
Insecure Transmission of Financial Customer Info (FTC Safeguards)
Fintech or financial portal targeting consumers transmits customer data over unencrypted channels or fails to enforce HTTPS across all login and API endpoints, violating FTC Safeguards Rule.
Financial service website failing to provide a clear, visible link to its annual Gramm-Leach-Bliley Act privacy notice on all account management or client onboarding pages, violating FTC GLBA regulations.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
203
CTAC-001
Lack of Corporate Transparency Disclosures (CTA)
Corporate website fails to mention or display required beneficial ownership reporting notices or filing confirmations as required for compliance under the Corporate Transparency Act.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
204
SEC-002
Missing Electronic Record Archiving Verification (SEC Rule 17a-4)
Broker-dealer or financial investment portal does not disclose or link to its electronic record archiving systems (WORM storage compliance), violating SEC recordkeeping regulations.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
205
DORA-003
Lack of ICT Risk Management System Disclosures (EU DORA)
Website of an EU financial entity or service fails to display cybersecurity certifications or disclosures outlining digital operational resilience mechanisms, violating DORA Article 6.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
206
FTCR-001
Missing Identity Theft Prevention Disclosures (FTC Red Flags)
Creditor or financial utility portal failing to display or link to its Identity Theft Prevention Program (ITPP) or show active identity verification steps during account sign-up, violating FTC Red Flags Rule.
Missing BrokerCheck Link and Regulatory Disclosures (FINRA)
Investment advisory or broker-dealer website fails to display a direct, prominent link to the FINRA BrokerCheck tool on its homepage and profile pages, violating FINRA Rule 2210.
Missing Subresource Integrity (SRI) on Payment Gateway (PCI-DSS v4.0)
Website embeds payment forms or scripts from external CDNs or third-party gateways without utilizing Subresource Integrity (SRI) hashes, leaving payments open to formjacking, violating PCI-DSS Req 11.6.1.
Website advertising credit or loan options states finance rates or promotional fees without prominently disclosing the Annual Percentage Rate (APR) next to the rate, violating Truth in Lending Act Z Regulation.
Website uses dark patterns to make subscription cancellation significantly harder, requiring multiple phone calls or complex navigation paths compared to the one-click signup process.
Website displays countdown timers or dynamic text claiming low stock, high demand, or limited deals that are synthetic and do not reflect real transactional metrics, deceiving consumers.
Website displays marketing or subscription opt-out options where the reject button uses emotionally manipulative language (e.g., "No thanks, I hate saving money") to discourage users from opting out.
Missing Smart Contract Auditing Disclosures on dApp (SEC Framework)
Web3 decentralized application launching tokens or NFTs fails to publish or link to external security audit certificates for its smart contracts, violating SEC transparency guidelines.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
215
W3CR-002
Blind Signing Vulnerability in Web3 dApp Interface (NIST SP 800-95)
Web3 application wallet integration requests raw transaction signature payloads without rendering readable transaction details (functions, targets, arguments) in the web UI, enabling blind signing.
Missing Recommender System Algorithmic Transparency (EU DSA)
Website utilizing algorithmic recommender systems (e.g., personalized feed, product suggestions) fails to explain the main parameters used in the algorithms in its terms and conditions, violating DSA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
217
EUAI-005
Missing High-Risk AI System Logging Capability (EU AI Act)
Deployer of a high-risk AI system fails to ensure that logs generated by the system are automatically kept for at least six months to ensure traceability and auditability, violating EU AI Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
218
UKCR-001
Auto-Renewal Terms Without Plain Language Summary (UK CRA)
Website charging recurring subscriptions fails to provide a conspicuous, plain language summary of billing terms, price changes, and renewal dates, violating the UK Consumer Rights Act.
Privacy policy fails to detail the identities, roles, and countries of third-party SaaS processors handling user personal data, violating PIPEDA transparency guidelines.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
220
TDDD-001
Analytics Cookie Consent Bypass (Germany TDDDG)
Website targeting German users fires analytics, heatmap, or performance cookies before obtaining explicit consent, violating Section 25 of the Telecommunications Digital Services Data Protection Act.
Social Media Chat Enabled by Default for Minors (Texas SCOPE)
Social networking or platform site fails to disable direct messaging and chat features by default for users verified or suspected to be minors, violating the Texas SCOPE Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
222
UTSM-001
Missing Age Verification for Social Platforms (Utah SMRA)
Social media platform fails to verify the age of Utah residents attempting to create accounts or fails to obtain verifiable parental consent for minors, violating the Utah Social Media Regulation Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
223
FLDB-001
Missing Age Gate for Restricted Social Platform (Florida FDBR)
Social media platform accessible to minors fails to deploy an accredited, secure age-verification mechanism, violating young consumer safety provisions under the Florida Digital Bill of Rights.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
224
CTDP-002
Geofencing Around Mental Health Centers (Connecticut SB 3)
Website or app uses geofencing within 1,750 feet of any mental, reproductive, or sexual health facility to collect health-related data, violating Connecticut SB 3.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
225
VCDP-003
Missing Consent Verification for Child Sensitive Data (Virginia VCDPA)
Website collecting sensitive personal data of child consumers under 13 fails to obtain parental verification conforming to COPPA prior to data collection, violating VCDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
226
CAAD-003
Profiling Enabled by Default for Minor Accounts (CA AADC)
Website likely to be accessed by children has profiling, personalized ads, or algorithmic feeds turned on by default for accounts of minors, violating the California Age-Appropriate Design Code Act.
Website or application likely to be accessed by children fails to conduct and file a Data Protection Impact Assessment (DPIA) regarding risks to minors, violating the Maryland AADCA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
228
COPA-002
Missing Parental Consent for Child Personal Data (Colorado CPA)
Website collects or processes personal data of consumers known to be under 13 without obtaining prior verifiable parental consent, violating the Colorado Privacy Act Rules.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
229
INDP-001
Missing Opt-In Consent for Child Sensitive Data (Indiana CDPA)
Website targeting Indiana residents collects sensitive data of minors under 13 without prior affirmative opt-in consent matching COPPA requirements, violating the Indiana Consumer Data Protection Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
230
TNIP-001
Missing Privacy Policy Rights Appeals Process (Tennessee TIPA)
Website privacy notice targeting Tennessee residents fails to provide a clear description of the process to appeal a refusal to act on a privacy rights request, violating the Tennessee Information Protection Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
231
TCPA-011
Inaccessible or Delayed Email Unsubscribe Mechanism (CAN-SPAM)
Website's marketing unsubscribe link fails to process immediately, or requires more than 10 business days to remove the user from lists, violating CAN-SPAM Act rules.
Missing Valid Sender Identity and Postal Address (CAN-SPAM)
Website marketing emails do not contain a valid physical postal address of the sender or utilize misleading headers, violating federal CAN-SPAM requirements.
Missing Written Consent for Marketing Robocalls (TCPA)
Lead collection forms collect phone numbers and use them for automated marketing call campaigns without obtaining express prior written consent containing required TCPA disclosures.
Checkout page or shopping cart widget contains keyboard focus traps or cannot be operated via keyboard alone, violating European Accessibility Act requirements for e-commerce.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
235
EAA-004
Lack of Alternative Media Formats in E-Commerce (EAA)
Website showcases products via video or audio media without providing captions or audio descriptions, violating e-commerce accessibility rules under the European Accessibility Act.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
236
AODA-002
Inaccessible Document Downloads (Ontario AODA)
Website offers public document downloads (PDFs, user manuals) that do not conform to WCAG 2.0 Level AA tagging and accessibility, violating Ontario AODA Section 14.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
238
ADA-103
Inaccessible Media Players (ADA Title III)
Web media players lack accessible control labels or keyboard controls, blocking screen reader and keyboard users, violating ADA Title III requirements.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
239
EPRIV-003
Consent Bypass on Mobile Responsive Layouts (ePrivacy)
Website consent banner does not render or is hidden on mobile layouts while tracking scripts are executed, bypassing user consent, violating ePrivacy Directive.
Fake AI Testimonials and Reviews (FTC Consumer Review Rule)
Website displays customer reviews or testimonials that are AI-generated or synthetic without displaying a clear, conspicuous disclosure indicating they are not genuine consumer reviews, violating the FTC Unfair Deceptive Review Rule.
Medical booking or client communication portal incorporates third-party social media chat widgets (e.g. Facebook Messenger) that transmit patient identifiers, violating HIPAA Privacy Rule.
Unsecure Transmission of Patient Records via SMS/Email (HIPAA)
Telehealth or medical intake forms send unencrypted patient health summaries via standard email or SMS networks, violating HIPAA Security Rule standards.
Insecure Storage of Credit Card Data in LocalStorage (PCI-DSS v4.0)
Website saves primary account numbers (PAN), cardholder names, or CVVs in browser LocalStorage or SessionStorage, violating PCI-DSS data storage mandates.
Lack of Health Provider Verification for Sensitive Data (WA MHMDA)
Website collects sensitive physical/mental health data of Washington residents without verifying whether the recipient is a licensed healthcare provider, violating MHMDA.
Missing Web Portal Authentication Session Timeouts (NIST SP 800-53)
Customer portal or system panel does not automatically terminate inactive authenticated sessions after a reasonable period, violating NIST security controls.
Missing System Availability Disclosures (SOC 2 Type II)
SaaS portal fails to provide a publicly accessible status or uptime tracking page, violating SOC 2 Trust Services Criteria regarding operational availability.
SaaS website or underlying framework utilizes unsupported, end-of-life platforms without disclosing the risks to cyber underwriters, violating cyber insurance terms.
Missing Consumer Data Portability Format Option (Delaware DPDPA)
Website targeting Delaware consumers fails to provide personal data downloads in a portable, technically feasible, and readily usable format, violating Delaware's DPDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
252
MAPD-001
Sale of Sensitive Personal Data Prohibited (Maryland MODPA)
Website collects and sells sensitive personal data (e.g. precise location, health, race) of Maryland consumers, which is strictly prohibited under the Maryland Online Data Privacy Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
253
KYPD-001
Missing Consumer Right of Access Disclosure (Kentucky KCDPA)
Website targeting Kentucky residents fails to outline the clear, accessible process for consumers to confirm whether their data is processed and to access it, violating KCDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
254
RIPD-001
Failure to Disclose Third-Party Sales in Privacy Notice (Rhode Island RIDTPPA)
Website targeting Rhode Island consumers fails to explicitly list all third parties to whom personal data is sold or shared in its privacy notice, violating RIDTPPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
255
IAPD-001
Missing Consumer Right to Opt-Out of Data Sale (Iowa ICDPA)
Website targeting Iowa consumers fails to provide a clear, conspicuous link allowing users to opt-out of the sale of their personal data, violating the Iowa Consumer Data Protection Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
256
FTCH-001
Unlawful Sharing of Health Metrics with Trackers (FTC Health Breach Rule)
Website collects health, symptom, or wellness queries and shares them with third-party advertising trackers without explicit authorization, triggering FTC Health Breach Notification violations.
Missing Multi-Factor Authentication on Financial Portals (NYDFS)
Financial dashboard or client web panel under NYDFS jurisdiction fails to enforce multi-factor authentication (MFA) for all web logins, violating cybersecurity regulation 23 NYCRR Part 500.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
258
BIPA-003
Missing Written Release for Biometric Collection (Illinois BIPA)
Website collects biometric identifiers (e.g. faceprints, voiceprints) without obtaining a signed, written release from the user prior to collection, violating BIPA Section 15(b).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
259
AADA-001
Keyboard Focus Obscured by Sticky Elements (WCAG 2.2)
Website layout permits sticky headers, footers, or overlays to obscure the focus indicator of active input fields or buttons during keyboard navigation, violating WCAG 2.2 SC 2.4.11.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
260
AADA-002
Insufficient Target Size for Interactive Elements (WCAG 2.2)
Interactive target elements (buttons, links, form inputs) are smaller than 24x24 CSS pixels without sufficient spacing, violating WCAG 2.2 Level AA guidelines for touch and pointer input.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
261
EUAI-006
Missing Human Oversight Disclosures for High-Risk AI (EU AI Act)
Website deploying high-risk AI decision systems (e.g. candidate screening, credit evaluation) fails to disclose mechanisms for human oversight and intervention, violating AI Act Article 14.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
262
EUAI-007
Lack of Post-Market Monitoring Plans for AI Systems (EU AI Act)
Provider of regulated AI systems fails to host or link to a publicly accessible post-market monitoring plan and incident reporting path, violating EU AI Act requirements.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
263
DSA-005
Missing Non-Profiling Option for Recommender Systems (EU DSA)
Online platform utilizing recommender systems fails to provide users with at least one option that is not based on profiling (e.g. chronological feed instead of algorithmic feed), violating DSA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
264
DSA-006
Missing Age Verification for Minor Protection (EU DSA)
Online platform accessible to minors fails to implement appropriate and proportionate age verification measures to ensure child safety online, violating DSA Article 28.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
265
NIS2-002
Missing Incident Notification and Contact Channels (NIS2)
Website of a critical infrastructure or digital service provider fails to display clear incident notification procedures or contact paths for reporting cyber incidents, violating NIS2 requirements.
Missing Right to Restrict Processing Action Path (GDPR)
Website fails to provide users with a direct, online mechanism (form, switch, or email path) to exercise their right to restrict processing of personal data under GDPR Article 18.
Cookie Lifespan Exceeds Maximum Limits (ePrivacy Guidelines)
Website consent mechanism sets non-essential tracking cookies with expiration periods longer than 12 months without automated consent renewal prompts, violating ePrivacy guidelines.
Missing Records of Processing Activities Disclosure summary (GDPR)
Website privacy notice fails to state that the company maintains records of processing activities (ROPA) and does not provide a summary for user visibility, violating GDPR Article 30.
Lack of Qualified Electronic Signatures Support (eIDAS 2.0)
Digital platform requiring signatures from EU citizens fails to recognize or support Qualified Electronic Signatures (QES) verified through European Trust Lists, violating eIDAS 2.0.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
270
GDPR-017
Missing Data Protection Impact Assessment (DPIA) Disclosures (GDPR)
Website privacy notice conducting high-risk processing (e.g. monitoring public areas or massive tracking) fails to state that a DPIA has been conducted and logged with the DPA.
Missing Right to Rectification Portal (Argentina Law 25.326)
Website collecting data of Argentine residents fails to provide a dedicated path or clear instructions to request rectification or destruction of personal data, violating Law 25.326.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
272
COPD-001
Bundled Consent for Commercial Messaging (Colombia Law 1581)
Website collects data of Colombian residents and bundles marketing communications consent with the general registration agreement, violating Habeas Data Law 1581.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
273
MXPD-001
Missing Separate ARCO Rights Actions (Mexico LFPDPPP)
Website collecting data of Mexican consumers fails to provide clear, actionable steps for users to exercise their ARCO (Access, Rectification, Cancellation, Opposition) rights, violating LFPDPPP.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
274
CHPD-001
Missing Cross-Border Transfer Disclosures (Switzerland FADP)
Website collects Swiss residents' data and transfers it internationally (e.g. via external tracking APIs) without disclosing countries and security safeguards in its privacy policy.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
275
POPI-002
Default Opt-in Marketing Violation (South Africa POPIA)
Website sends electronic direct marketing to South African residents without getting explicit prior opt-in consent or sends it to users who have never consented, violating POPIA Section 69.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
276
TRKV-002
Unauthorized Cross-Border Transfer without Adequate Safeguards (Turkey KVKK)
Website transfers personal data of Turkish residents to servers outside Turkey without obtaining explicit consent or demonstrating compliant standard contractual clauses, violating KVKK.
Privacy policy targeting Australian users lacks details on how individuals can access their personal data, seek correction, or complain about a breach of the APPs, violating APP 1.4.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
278
SGPD-003
Lack of Data Access and Correction Request Tracking System (Singapore PDPA)
Website fails to provide Singapore residents with a dedicated email or automated portal to request confirmation of their data processed within the past year, violating Singapore PDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
279
THPD-003
Cross-Border Transfer to Non-Adequate Countries without Consent (Thailand PDPA)
Website transfers personal data of Thai residents to third countries that do not have adequate data protection standards without obtaining explicit consent, violating PDPA Section 28.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
280
PHDP-002
Inadequate Disclosure of Right to Object to Processing (Philippines DPA)
Website privacy notice targeting Philippines residents fails to explicitly state the user's right to object to the processing of their personal data, including for marketing purposes.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
281
FTCD-004
Deceptive Subscription Price Increases Without Consent (FTC)
Website implements automated subscription renewals at higher rates without notifying users and obtaining explicit consent prior to billing the updated price, violating FTC rules.
Failure to Maintain Internal Do Not Call (DNC) Registry (TCPA)
Lead capture website fails to maintain and document an internal Do Not Call (DNC) list and procedures for managing marketing contact requests, violating TCPA rules.
Unsubscribe Requests Require Fees or Logins (CAN-SPAM)
Website marketing unsubscribe links force users to log in, fill complex surveys, or pay processing fees to opt-out of emails, violating CAN-SPAM regulations.
Inaccessible Digital Invoice/Receipt Outputs for E-Commerce (EAA)
Online store generates order confirmation pages or downloadable receipts that are formatted as flat images or inaccessible PDFs, blocking screen reader access, violating EAA.
Website fails to provide an accessible online path or form specifically dedicated to receiving feedback regarding accessibility issues from disabled users, violating AODA.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
287
ADA-104
Text Scaling Breaks Page Layout at 200% (ADA Title III)
Website layout breaks, overlaps, or truncates text when browser zoom is set to 200% without assistive tech, violating WCAG 2.1 SC 1.4.4 scaling standards.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
288
ADA-105
Inability to Adjust or Extend Form Session Limits (ADA Title III)
Forms with timing restrictions (e.g. checkout ticket reservations) do not allow users to disable, adjust, or extend the limit before timeout, violating WCAG 2.1 SC 2.2.1.
Cookie consent banner and its 'Manage Settings' panel cannot be fully closed or navigated via keyboard TAB keys, rendering the website functionally non-compliant.
Unlabeled Affiliate Links and Sponsored Content (FTC Endorsement Guides)
Website displays product links earning commission or sponsored content blocks without displaying clear, immediate labels (e.g. 'Affiliate Link' or 'Sponsored') near the links.
Missing Risks Disclosure for Token Transactions in dApp (SEC)
Web3 interface facilitating token swaps or financial transactions fails to display a clear risk disclosure regarding token volatility and regulatory status on its swap panel.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
292
W3CR-004
dApp Fails to Validate API Endpoint Integrity (NIST SP 1800-34)
Decentralized web application connects to RPC nodes or APIs without verifying response signatures, allowing man-in-the-middle attacks to show false wallet balances.
Front-end Execution of Scripts from Non-Authorized Domains (PCI-DSS v4.0)
Checkout or payment interfaces load and run JavaScript files hosted on non-whitelisted domains, violating strict payment interface security rules under PCI-DSS v4.0.
Customer Portal Session Replay Scripts Enabled on Password Inputs (PCI-DSS)
Session recording tools (e.g. Hotjar, FullStory) run on customer portals without masking or excluding sensitive input fields like password, cardholder, or CVV inputs.
Missing Incident Response Plan Reference (Cyber Insurance)
SaaS system interface fails to display a mechanism for users to request security incident disclosure reports, which is required for cyber liability insurance underwriting.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
296
DORA-005
ICT Systems Major Incident Log Reporting Lack (EU DORA)
EU financial entity web console fails to provide or link to logs of major ICT related incidents for transparency to users and regulatory authorities, violating DORA Article 18.
Financial or fintech portal fails to publish or reference in its security notices that it conducts periodic risk assessments on customer data storage databases.
Inadequate Access Revocation Notification (SOC 2 Type II)
Customer console does not record logs of revoked administrative tokens or display active sessions with direct termination paths, violating SOC 2 CC6.3 security controls.
Missing Identity Verification Prior to Accessing PHI (HIPAA)
Patient intake portal or symptom tracker allows users to access historical records or Protected Health Information (PHI) without executing verified multi-step identity validation.
Missing Consumer Right to Correct Inaccurate Personal Data (Minnesota MCDPA)
Website privacy flow fails to provide Minnesota consumers with an accessible path to correct inaccuracies in their collected personal data, violating the MCDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
303
UTSM-002
Default DM Block Between Minors and Non-Parents (Utah SMRA)
Social media web application fails to block direct messaging features between minor accounts and accounts of users who are not verified parents/guardians, violating Utah SMRA.
Search engine or directory platform targeting Florida residents fails to disclose the parameters used to rank search results when algorithmic filtering is active, violating FDBR.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
305
CTDP-003
Profiling Minors for Commercial Purposes (Connecticut SB 3)
Website targeting Connecticut minors compiles personal profiles for targeted marketing or product recommendations without express written consent from the minor or guardian.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
306
CAAD-004
Non-Obvious Interactive Dark Patterns Targeting Children (CA AADC)
Website likely to be accessed by minors uses deceptive game mechanics or styling to nudge children into spending money or disclosing email addresses, violating AADC.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
307
MDAD-002
Default Tracking Active for Children (Maryland MODPA)
Online service targeting Maryland residents fails to deactivate behavioral trackers by default for users identified as under 18 years old, violating MODPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
308
INDP-002
Lack of Sensitive Data Processing Disclosures (Indiana CDPA)
Privacy notice targeting Indiana residents fails to explicitly state the categories of sensitive personal data processed and the specific purposes, violating the CDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
309
TNIP-002
Inadequate Response Time for Data Rights Requests (Tennessee TIPA)
Website privacy workflow fails to guarantee and execute response to consumer privacy rights requests within the mandated 45-day window, violating TIPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
310
NHPA-002
Missing Right to Deletion Actions for New Hampshire Consumers (NHPA)
Website fails to provide New Hampshire residents with a clear, automated method to delete personal data collected, violating the New Hampshire Privacy Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
311
AADA-003
Redundant Data Entry Required in Multi-step Forms (WCAG 2.2)
Multi-step registration or checkout forms require users to re-enter previously provided information in the same session without offering auto-fill, violating WCAG 2.2 SC 3.3.7.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
313
AADA-005
Inconsistent Location of Help and Support Contacts (WCAG 2.2)
Website displays support contacts, chats, or FAQ paths in different locations on different pages (e.g. top right on homepage, bottom left on checkout), violating WCAG 2.2 SC 3.2.6.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
316
AADA-008
Text Spacing Adjustments Lead to Overlapping Text (WCAG 2.1)
Custom client-side font spacing adjustments (line height, letter spacing) cause page text elements to overlap or truncate, violating WCAG 2.1 SC 1.4.12.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
317
AADA-009
Unstoppable Auto-playing Media and Carousels (WCAG 2.1)
Website includes auto-playing sliders, banners, or video background media that cannot be paused, stopped, or hidden by the user, violating WCAG 2.1 SC 2.2.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
318
AADA-010
Missing Input Placeholders or Context Clues (WCAG 2.1)
Form inputs requiring specific formats (e.g. dates, phone numbers) do not provide placeholders, description hints, or context instructions, violating WCAG 2.1 SC 3.3.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
319
AADA-011
Status Messages Not Announced by Screen Readers (WCAG 2.1)
Dynamic status updates (e.g. 'Saved successfully' notifications or inline validation messages) appear in DOM without `role="status"` or `aria-live="polite"`, hiding them from screen readers.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
320
AADA-012
Illogical Tab Navigation Order (WCAG 2.1)
Keyboard navigation focus path traverses the page in an illogical or random order, failing to match visual reading layouts, violating WCAG 2.1 SC 2.4.3.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
321
GDPR-018
Encryption Standards for Collected Data Not Disclosed (GDPR)
Website privacy notice collects sensitive personal data but fails to state the encryption methods (e.g. AES-256) used during storage and transport, violating GDPR Article 32.
Missing Adequacy Decision Disclosures for External Transfers (GDPR)
Privacy notice transfers data outside the EEA but fails to disclose whether destination countries are subject to an EC adequacy decision or state the specific safeguards deployed.
Lack of Data Breach Mitigation Instructions for Users (GDPR)
Website fails to display instructions, direct email forms, or contact details explaining how users will be notified and what actions they should take during a personal data breach.
Missing Specific Storage Location Disclosures (Canada PIPEDA)
Privacy policy targeting Canadian residents collects personal data but fails to disclose the specific geographic locations (provinces/countries) where data is stored, violating PIPEDA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
325
PIPD-004
Missing Data Access Request Processing Costs Notice (Canada PIPEDA)
Website privacy notice targeting Canadian residents fails to state whether there are processing costs associated with formal personal data access requests, violating PIPEDA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
326
JPAP-003
Failure to Disclose Purposes of Shared Cookie Identifiers (Japan APPI)
Website targeting Japanese users shares third-party advertising identifiers or cookies without disclosing the exact advertising and analytical purposes of the recipients in its cookie statement.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
327
NZPR-003
Unlawful Retention of Personal Data Beyond Needed Duration (New Zealand Privacy Act)
Website targeting New Zealand residents lacks automated policies or disclosures specifying that personal data will not be kept for longer than is required for lawful purposes, violating IPP 4.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
328
THPD-004
Inadequate Disclosure of Right to Request Data Deletion (Thailand PDPA)
Website targeting Thai users has a privacy policy that does not state the consumer's right to request erasure, destruction, or de-identification of their personal data under the PDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
329
PHDP-003
Failure to Disclose Procedures for Filing Complaints with DPA (Philippines DPA)
Website privacy policy targeting Philippines consumers fails to explain how users can file a formal complaint regarding data breaches with the National Privacy Commission (NPC).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
330
LGPD-004
Privacy Policy Updates Not Prominently Notified (Brazil LGPD)
Website makes significant changes to processing methods or privacy policies without notifying Brazilian users through clear site alerts or emails, violating LGPD Article 9.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
331
GLBA-003
Missing Consumer Right to Opt-Out of Sharing with Non-Affiliates (GLBA)
Fintech or financial dashboard under GLBA jurisdiction fails to provide users with an opt-out path before sharing nonpublic personal info with non-affiliated third parties.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
332
SEC-003
Missing Administrative Policies Safeguarding Customer Information Disclosures (SEC)
Website of a SEC-registered investment advisor fails to display or link to policies outlining physical and technical safeguards for client records, violating Regulation S-P.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
333
PCI-017
Inventory of External Software Components Missing (PCI-DSS v4.0)
Website payment flow uses external software libraries, frames, or scripts without maintaining an active, documented inventory of all software components, violating PCI-DSS Req 6.3.2.
Failure to Document Cryptographic Key Management (PCI-DSS v4.0)
Website handling cardholder transactions fails to document or publish summaries of cryptographical algorithms and key management procedures used to encrypt card data.
Lack of Vulnerability Disclosure Program Notice (Cyber Insurance)
Corporate website fails to publish a Vulnerability Disclosure Program (VDP) or safe harbor policy for white-hat security researchers, which is required for cyber insurance compliance.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
336
DORA-006
Lack of Third-Party ICT Provider Criticality Level Disclosures (EU DORA)
Web dashboard of a financial system does not list or categorise the criticality levels of its third-party cloud and infrastructure providers, violating DORA transparency rules.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
337
FTCS-004
Missing Employee Security Training Reference (FTC Safeguards)
Financial dashboard privacy notice fails to state that the company conducts annual employee security training regarding consumer data protection, violating the FTC Safeguards Rule.
Inadequate Patch Management Disclosures (SOC 2 Type II)
Customer-facing SaaS portal fails to reference or document patch management timelines and procedures for resolving known system vulnerabilities, violating SOC 2 CC7.1.
Lack of Web Traffic and Intrusion Monitoring Disclosures (NIST SP 800-53)
Security notice of a digital platform does not state whether it employs active intrusion detection or web application firewalls (WAF) to monitor incoming network traffic, violating NIST SI-4.
Patient onboarding application fails to confirm in its privacy policy that it conducts periodic risk analyses to assess potential security vulnerabilities to PHI, violating HIPAA Security Rule.
Profiling Children for Targeted Ads (Maryland MODPA)
Website targeting Maryland consumers enables targeted advertising profiling on accounts of users known to be under 18 years old, violating the Online Data Privacy Act.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
342
TXSC-003
Collection of Minor Location History Without Parent Verification (Texas SCOPE)
Web application collects and maintains historical location tracking records of users verified or suspected to be minors without obtaining verified parental consent, violating SCOPE.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
343
UTSM-003
Algorithmic Recommendations to Minors (Utah SMRA)
Social media platform targeting Utah minors utilizes predictive algorithms or personalized recommendations on minor accounts without verified parental consent, violating SMRA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
344
FLDB-003
Missing Personal Data Sales Clear Opt-out Link (Florida FDBR)
Website targeting Florida consumers fails to host a clear, conspicuous link titled "Do Not Sell My Personal Information" on its homepage, violating Florida FDBR.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
345
CTDP-004
Geolocation Data Selling Without Consent (Connecticut SB 3)
Website targeting Connecticut consumers sells precise geolocation coordinates collected from mobile or web interfaces without obtaining prior explicit opt-in consent.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
346
CAAD-005
Absence of Child Safety Impact Assessment Rationale Disclosures (CA AADC)
Website likely to be accessed by minors fails to detail in its privacy notice the security safeguards implemented based on child data impact assessments, violating AADC.
Website selling or sharing biometric data (e.g. voice templates, face recognition markers) of Illinois residents for commercial profit, which is strictly prohibited under BIPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
348
HIPAA-015
Inadequate De-identification of Patient Research Records (HIPAA Privacy)
Health portal publishes clinical summaries or symptom databases containing zip codes or exact birth dates, failing to meet strict Safe Harbor de-identification rules under HIPAA.
Financial dashboard fails to disclose that its contracts with critical ICT providers contain mandatory security and data portability clauses, violating DORA Article 30.2.
Fintech portal fails to reference or display in its security disclosures a summary of its written Incident Response Plan (IRP) for customer data breaches, violating FTC Safeguards.
The website's keyboard focus indicator lacks the minimum area or contrast against adjacent colors, making it difficult for keyboard-only users to see which element is active, violating WCAG 2.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
352
ADA-107
Focus Obscured by Sticky Elements
Interactive elements focused via keyboard are fully or partially covered by sticky headers, footers, or floating overlays, preventing screen visibility, violating WCAG 2.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
354
ADA-109
Sub-Minimum Interactive Target Size
Interactive targets (buttons, links) are smaller than 24x24 CSS pixels without sufficient spacing, causing mis-clicks for touch and motor-impaired users, violating WCAG 2.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
355
ADA-110
Redundant Form Data Entry Requirement
Forms require users to re-enter information previously submitted in the same session instead of auto-populating or providing selection options, violating WCAG 2.2.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
357
ADA-112
Focus Obscured (Enhanced Level)
Interactive elements are fully visible when focused, without any overlap from layouts under stricter accessibility audits, violating WCAG 2.2 AAA standards.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
359
ADA-114
Missing Accessible Video Transcripts
Embedded videos with educational or commercial info lack synchronized or linked full text transcripts, creating barriers for deaf-blind users, violating ADA Title III.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
360
ADA-115
Missing Captions for Pre-recorded Media
Marketing or product preview videos fail to offer accurate closed captions (CC), blocking access for deaf or hard-of-hearing site visitors, violating ADA Title III.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
361
HIPAA-016
Insecure Patient Appointment Forms
Online booking interfaces pass Protected Health Information (PHI) like medical conditions or physician names within unencrypted URL parameters, violating HIPAA Security standards.
Patient schedule systems execute analytics or advertising trackers (e.g. Meta Pixel) without obtaining explicit, signed HIPAA authorizations from patients, leading to massive regulatory fines.
Health portal database fails to log viewer identity, timestamp, and actions when sensitive patient records or lab results are loaded, violating HIPAA Security Rule auditing requirements.
The Notice of Privacy Practices (NPP) hosted on a medical clinic's website fails to prominently display its effective date, violating HIPAA Privacy Rule disclosure mandates.
Health portal fails to honor consumer deletion requests for collected non-HIPAA health tracking details within the statutory 30-day window under Washington My Health My Data Act.
A health-tracking website collects wellness indices or condition queries from Washington consumers without obtaining a separate, explicit opt-in consent banner, violating MHMDA.
Portal file uploads for prescriptions or doctor notes are placed in public cloud directories or accessible via easily guessable URLs, violating HIPAA security standards.
Electronic medical portal sessions remain active indefinitely after user inactivity, exposing patient charts to unauthorized physical access, violating HIPAA Security Rule protocols.
Medical clinic staff access patient portal backends using a shared generic login ID, making audits of record alterations impossible, violating HIPAA's Unique User requirement.
The required 'Do Not Sell or Share My Personal Information' option is formatted in a way that is hard to click or styled to look inactive compared to the accept buttons, violating CCPA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
372
CCPA-012
Lack of Global Privacy Control (GPC) Verification Logs
The website's consent manager fails to maintain internal logs showing that user GPC signals were honored and processing scripts deactivated, violating California CPPA audit readiness.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
373
CCPA-013
Missing Notice of Financial Incentive
E-commerce popups offer discounts in exchange for newsletter signup (email collection) without providing a linked, detailed Notice of Financial Incentive, violating CCPA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
374
CCPA-014
Non-Compliant Employee & Applicant Privacy Notice
Job application forms and internal intranet portals lack a detailed privacy disclosure specifically outlining how employee and applicant personal data is handled under CPRA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
375
CCPA-015
Missing Sensitive Data Retention Periods
Privacy policy fails to state the specific retention period (or criteria used to determine it) for each category of collected sensitive personal information, violating California Civ. Code.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
376
CCPA-016
Lack of Portal for Right to Correct
User account cabinet fails to offer a clear, self-service interface or form allowing California consumers to correct inaccurate personal data on record, violating CPRA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
377
CCPA-017
Implicit Sensitive Geolocation Tracking
The web app tracks precise coordinates within a 1,850-foot radius without presenting a clear prompt to restrict the use of sensitive personal information, violating CCPA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
378
CCPA-018
Incomplete Authorized Agent Procedural Disclosure
The privacy policy fails to explain verification procedures and forms required when a consumer exercises rights via a third-party authorized agent, violating CCPA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
379
CCPA-019
Missing Privacy Request Annual Metrics
Businesses processing personal details of 10,000,000+ California consumers fail to compile and publish annual statistics of received and handled requests, violating CCPA regulations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
381
FTC-011
Subscription Deceptive Auto-Renewal Obstacles
Web checkout enrolls users in recurring billing but fails to offer an easy, client-side button to cancel online, violating ROSCA and FTC enforcement guidelines.
E-commerce checkout renders countdown timers claiming 'offer expires soon' that reset automatically on page reload, classified by the FTC as deceptive dark patterns.
Product landing pages display customer reviews hardcoded in JavaScript bundles with randomized dates to appear recent, violating the FTC rule on deceptive reviews.
Online payment flows conceal service fees, transaction surcharges, or hidden admin costs until the final transaction confirmation screen, violating FTC Section 5 standards.
Lack of Multi-Factor Authentication for Financial Portals
Web consoles providing access to consumer credit information fail to mandate Multi-Factor Authentication (MFA) for internal staff access, violating the FTC Safeguards Rule.
Portals aimed at children collect data using simple checkboxes or unverified email returns for parental approval instead of statutory verification methods under COPPA rules.
Non-HIPAA wellness platforms transmit condition searches, queries, or selections to advertising networks via trackers, violating the FTC Health Breach Notification Rule.
E-commerce blog posts or reviews that contain paid affiliate links fail to display clear and conspicuous disclosure labels (like 'Sponsored'), violating FTC endorsement rules.
Registration forms pre-check checkboxes subscribing consumers to promotional SMS messages, violating TCPA requirements for prior express written consent.
Lead forms collecting telephone numbers lack clear statutory language specifying that 'Message and data rates may apply' and listing sending frequency, violating TCPA guidelines.
Automated text campaign integrations fail to recognize and process standard opt-out keyword replies (such as STOP, CANCEL, or UNSUBSCRIBE), violating TCPA.
Marketing emails dispatched automatically by portal registrations fail to display the organization's valid physical street address, violating CAN-SPAM.
Unsubscribe links inside system notification emails lead to broken server paths or force users to log in before processing requests, violating CAN-SPAM regulations.
Database systems fail to remove unsubscribed emails from active promotional lists within the statutory 10-business-day window, violating CAN-SPAM rules.
Robocalls and Automatic Texting Without Written Consent
Web landing pages collect telephone contacts for automated dialing systems without obtaining prior express written signatures of Florida consumers, violating Florida FTSA.
Telemarketing databases fail to preserve records of consumer Do Not Call (DNC) requests for the statutory minimum of five years from the date of submission, violating TCPA.
The website sets non-essential analytics or advertising cookies before receiving active, affirmative consent from the EU visitor, violating ePrivacy and GDPR.
The cookie banner uses design tricks to hide the 'Reject' button or forces the visitor to open submenus to reject tracking while allowing single-click acceptance, violating GDPR.
The website's privacy disclosure fails to display the official contact details of the designated Data Protection Officer (DPO) under GDPR requirements.
Data forms collect European personal inputs but fail to verify and link Data Processing Agreements (DPA) completed with cloud hosts and backend subprocessors, violating GDPR Art 28.
The platform fails to provide a secure, authenticated pathway for processing Subject Access Requests (SAR), risking accidental disclosure of personal records, violating GDPR.
Portal support systems refuse or delay consumer 'Right to be Forgotten' requests without valid statutory justifications, violating GDPR Article 17 requirements.
User profile dashboards default to sharing personal profiles, location files, or usage histories with other users or partners upon registration, violating Privacy by Default rules.
Website contact forms transmit personal user messages and identifiers over unencrypted HTTP channels instead of secure HTTPS, violating GDPR security of processing requirements.
Web applications tracking large-scale behavioral data fail to complete and record a Data Protection Impact Assessment (DPIA), violating GDPR requirements.
User records are transmitted to servers located in third-party countries (lacking adequacy decisions) without established Standard Contractual Clauses (SCCs) in place, violating GDPR.
The e-commerce payment server accepts TLS 1.0 or TLS 1.1 connections containing insecure ciphers, failing PCI requirements for data encryption in transit.
The system backend or connected merchant dashboards run default manufacturer passwords or standard administrator logins, violating PCI secure deployment protocols.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
422
STATE-012
Virginia VCDPA Rights Appeal Escalation
Privacy policy fails to outline a clear process for consumers to appeal a refusal to act on data rights requests, violating Virginia VCDPA regulations.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
424
STATE-014
Delaware DPDPA Non-Consensual Health Transfers
Consumer health databases transmit search queries for off-label health diagnostics to third-party ad brokers without explicit consent, violating Delaware DPDPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
425
STATE-015
Oregon OCPA Incomplete Third-Party Listing
Privacy policy discloses general categories of processors instead of listing the specific legal names of third parties receiving user records, violating Oregon OCPA.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
426
STATE-016
New Jersey NJPA Sensitive Selling Disclosures
The portal sells New Jersey consumer records containing sensitive info without showing a clear notice and obtaining opt-in consent, violating NJPA directives.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
437
FIN-017
DORA Third-Party Risk Registers Exclusions
Financial applications link to external APIs or services without preserving a consolidated register of third-party ICT providers and security certifications, violating DORA.
Consumer banking portals omit clear instructions on yearly opt-out options regarding sharing non-public personal information with affiliates, violating GLBA rules.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
439
FIN-019
FINRA Rule 4511 Non-WORM Log Format
Broker trading systems record transactions and customer communication logs in standard databases instead of write-once-read-many (WORM) storage, violating FINRA.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
440
FIN-020
CFTC Rule 1.31 Electronic History Deletions
Trading portals fail to configure electronic recordkeepings to enforce a strict five-year retention policy for financial logs and confirmations, violating CFTC Rule 1.31.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
441
OPS-011
AI Sentiment Analysis Warnings Missing
AI-powered customer service chatbots use emotion-detection or sentiment analysis algorithms on user message inputs without displaying clear warnings, violating EU AI Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
442
OPS-012
Prohibited AI Biometric Categorization Systems
Online user onboarding interfaces categorize users based on biometrics derived from uploaded facial photos without explicit, statutory legal grounds, violating EU AI Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
443
OPS-013
Missing AI Image & Text Metadata Watermarks
Gen-AI interfaces outputting images or texts fail to embed standard metadata watermarks showing the content is AI-generated, violating EU AI Act mandates.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
444
OPS-014
EU DSA Algorithmic Feed Disclosures
Social feeds or content portals fail to disclose the primary parameters and ranking criteria used by their recommender systems, violating Digital Services Act rules.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
445
OPS-015
EU DSA Missing Advertisements Repository
Large publishing platforms fail to host a public, searchable repository displaying active ads, sponsoring names, and target metrics, violating Digital Services Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
446
OPS-016
Lack of Shadow Banning Redress Portal
Community portals restricting user content (shadow banning) fail to notify authors and offer a clear internal complaint handling portal, violating Digital Services Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
447
OPS-017
Failing to Accept eIDAS 2.0 Wallets
Identity-gated platforms fail to integrate mechanisms accepting official European Digital Identity Wallets for verification, violating eIDAS 2.0 mandates.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
448
OPS-018
Missing CRA Vulnerability Reporting Gateway
Digital hardware or software portals fail to provide a conspicuous, functional interface to report security vulnerabilities, violating the Cyber Resilience Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
449
OPS-019
Missing DPO ANPD Registry for Brazilian Portals
Brazilian-facing portals collect customer information but fail to publish and register their designated DPO details with the national ANPD authority, violating LGPD.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
450
OPS-020
Lack of Guardian Consent Verification for India DPDP
Portals collecting data of Indian citizens under the age of 18 fail to implement verified parental or guardian consent structures, violating Digital Personal Data Protection Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
451
UAEPD-001
Lack of Explicit Consent for Cross-Border Data Transfers
The website transfers personal data of UAE residents to servers outside the UAE without obtaining explicit consent or demonstrating adequacy measures, violating UAE Federal Decree-Law No. 45.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
452
UAEPD-002
Missing Local Data Protection Officer (DPO) Contact Details
The website targeting UAE consumers fails to designate and publish contact details of a localized DPO when processing high-volume personal details, violating UAE PDPL.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
453
UAEPD-003
Non-Compliant UAE Child Consent Flow
The portal collects personal details of children in the UAE without verifying parental or guardian consent structures, violating UAE child protection laws.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
454
UAEPD-004
Failure to Maintain UAE Data Processing Registers
The organization's backend fails to document and maintain a record of personal data processing activities (ROPA) for UAE-facing operations, violating UAE PDPL requirements.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
455
UAEPD-005
Inadequate Data Breach Notification Timelines for UAE
The website's terms and security policy fail to commit to notifying the UAE Data Office immediately of any security breach that threatens data privacy.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
456
UAEPD-006
Lack of Direct Opt-Out for Marketing Profiling in UAE
The client cabinet fails to provide a clear, one-click mechanism for UAE users to opt out of automated decisions and marketing profiling, violating UAE PDPL.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
457
SDPD-001
Missing Registration on Saudi National Data Portal
Organizations processing Saudi personal records fail to register their databases with the Saudi Data and Artificial Intelligence Authority (SDAIA) portal, violating KSA PDPL.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
458
SDPD-002
Lack of Explicit Consent for Direct Marketing in KSA
Marketing subscription forms targeting Saudi consumers fail to obtain separate, explicit consent before dispatching promotional offers, violating Saudi PDPL.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
459
SDPD-003
Illegal Storage of Sensitive Personal Data Outside KSA
Websites transferring health or sensitive financial records of Saudi nationals to cloud servers outside the Kingdom fail to secure statutory SDAIA authorization, committing a major violation.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
460
SDPD-004
Failure to Disclose Processing Purpose to KSA Consumers
The privacy policy fails to explicitly link data collection fields to the specific, lawful purposes of processing required for compliance in Saudi Arabia.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
461
SDPD-005
Non-Compliant Data Erasure Response Timeframe in KSA
The customer support portal fails to process and confirm personal data deletion requests submitted by Saudi residents within the statutory timeframes under KSA regulations.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
462
SDPD-006
Lack of Explicit Opt-In for Tracking KSA Citizens
The website executes behavioral trackers or analytics scripts targeting KSA visitors before obtaining explicit, active opt-in consent, violating Saudi PDPL.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
463
ILPA-002
Missing Database Registration under Israeli Law
The platform processes personal information of Israeli citizens in databases containing over 10,000 individuals without statutory registration, violating the Israeli Privacy Act.
Failure to Disclose Duty of Delivery under Israeli Law
Web forms fail to explicitly notify Israeli consumers whether they are legally obligated to provide personal details or if it is voluntary, violating the Israeli Privacy Protection Act.
Non-Compliant Cross-Border Data Transfers from Israel
User databases transfer Israeli records to third countries that fail to ensure equal privacy protections without meeting statutory exceptions under Israeli transfer regulations.
Lack of Data Security Audits under Israeli Regulations
The enterprise processing Israeli user records fails to perform and log annual, independent security audits of database processing infrastructure, violating Israeli regulations.
Illegal Direct Mailing Advertising without Registration in Israel
The e-commerce site sends automated marketing emails to Israeli citizens based on character profiling without registering the target database for direct mailing, violating Israeli law.
Missing Explicit Consent for Cookie Tracking in Turkey
Cookie consent managers fail to block analytical or advertising scripts for Turkish visitors before obtaining explicit, active opt-in consent, violating Turkey's KVKK guidelines.
Missing Registration on Turkish VERBIS Database Registry
Foreign companies processing personal data of Turkish residents above statutory thresholds fail to register with the Data Controllers Registry (VERBIS), violating KVKK rules.
Inadequate Data Breach Reporting Windows for Turkey
The security incident protocol fails to mandate reporting data breaches to the Turkish Personal Data Protection Board (KVKK) within the statutory 72-hour window.
Web forms fail to present Turkish consumers with a dedicated 'Clarification Text' (Aydınlatma Metni) outlining rights and processing channels as separate from general policies, violating KVKK.
Illegal Cross-Border Transfers without Turkish Board Consent
Website database hosting routes personal records of Turkish users to servers outside Turkey without obtaining explicit consent or demonstrating standard undertaking protocols, violating KVKK.
Lack of Explicit Disclosures for Automated Decisions in Switzerland
The website deploys automated user scoring or decision systems targeting Swiss residents without displaying clear disclosures and offering human review interfaces, violating Swiss FADP.
Missing Representative for Foreign Controllers in Switzerland
Foreign organisations processing high volumes of Swiss consumer records fail to designate a localized representative in Switzerland, violating Swiss FADP.
Failure to Disclose Swiss Processing Register entries
Corporate systems failing to maintain a record of processing activities (ROPA) under Swiss standards face regulatory compliance liabilities under the revised FADP.
Inadequate Data Transfer Exclusions for Switzerland
Website database backups transfer Swiss personal files to servers in non-adequate countries without implementing verified contractual clauses, violating Swiss FADP.
Forms collecting sensitive details (e.g. religious views, political opinions, union statuses) from Swiss nationals fail to obtain active, explicit consent, violating FADP.
Lack of Swiss Data Breach Reporting (Rapid Windows)
System incident logs fail to support rapid notification to the Federal Data Protection and Information Commissioner (FDPIC) of any data breach resulting in high risk to Swiss users, violating FADP.
Website database services transfer UK user records to international servers without implementing the mandatory UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs.
Foreign companies processing personal data of UK citizens fail to register and pay the data protection fee to the UK Information Commissioner's Office (ICO), violating UK laws.
Foreign companies targeting UK customers fail to designate and publish a UK representative to act on behalf of the controller under UK GDPR requirements.
Non-Compliant Children's Data Processing under UK Age-Appropriate Code
The website targeting UK users collects information from children under 18 without establishing a high level of privacy by default, violating the UK Children's Code.
Lack of Age Verification Mechanisms for Harmful Content (UK OSA)
Content portals displaying user-generated media fail to deploy robust age-assurance verification procedures to restrict minors from accessing harmful files, violating UK OSA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
484
UKOSA-003
Missing UK Online Safety Reporting Channels
Websites offering interactive user communication fail to display a prominent, functional portal allowing UK users to report illegal or harmful content, violating Online Safety mandates.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
485
AUSPA-001
Failure to Honor Australia Privacy Act Erasure Requests
The support system fails to provide a dedicated, statutory channel for Australian citizens to request destruction or de-identification of personal records, violating APPs.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
486
AUSPA-002
Non-Compliant Cross-Border Disclosures for Australia
Personal records of Australian citizens are transferred to international hosting targets without establishing reasonable steps to ensure recipient compliance, violating APP 8.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
487
AUSPA-003
Lack of Explicit Opt-In for Marketing Cookies in Australia
The e-commerce site executes tracking pixels for targeted advertising to Australian users before obtaining explicit, active opt-in consent, violating recent Privacy Act reforms.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
488
AUSPA-004
Missing Australia Privacy Policy Disclosure of Third Party Hosting Locations
The privacy policy fails to explicitly disclose the list of countries where personal records are likely to be disclosed or hosted, violating Australian APP 1.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
489
AUSPA-005
Australia Spam Act Opt-Out Violation
The email marketing infrastructure continues sending promotional messages to Australian citizens past the statutory 5-business-day processing window after unsubscribing, violating the Spam Act.
Illegal Direct Marketing without Opt-Out under APP 7
The website promotes services to Australian consumers using personal profiles without providing a prominent, free opt-out mechanism in every marketing context, violating APP 7.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
491
AUSPA-007
Lack of Data Quality Verifications for Australian Records
The database fails to run automated verification checks to ensure personal data collected from Australian residents remains accurate, complete, and up-to-date, violating APP 10.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
492
NZPR-004
Failure to Disclose NZ Privacy Officer Details
Websites processing personal details of New Zealand citizens fail to designate and publish the contact information of a statutory Privacy Officer, violating NZ Privacy Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
493
NZPR-005
Lack of Immediate Breach Notification for New Zealand
Security systems fail to support rapid notification to the NZ Privacy Commissioner of any data breach likely to cause serious harm to New Zealand residents, violating the Privacy Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
494
NZPR-006
Missing NZ Consumer Access Portal (IPP 6)
The account dashboard fails to offer New Zealand users a clear path to access and download a complete copy of all personal files stored on record, violating IPP 6.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
495
NZPR-007
Illegal Storage of NZ Records in Non-Adequate Jurisdictions (IPP 12)
Personal records of NZ consumers are stored on cloud server locations abroad that fail to guarantee protection comparable to New Zealand's laws, violating IPP 12.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
496
NZPR-008
Collection of Excessive Personal Data from NZ Residents
Online forms demand unnecessary personal details from NZ residents that are not directly required for the business transaction, violating New Zealand IPP 1.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
497
SGPD-004
Lack of Mandatory DPO Contact Disclosures in Singapore
The website targeting Singaporean users fails to list the business address or email of its designated Data Protection Officer (DPO) in its privacy page, violating PDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
498
SGPD-005
Failure to Document Deemed Consent Rules for Singapore
The portal processes user data under Singapore's 'deemed consent by notification' rules without conducting a prior Assessment of Impact or documenting notification structures.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
499
SGPD-006
Non-Compliant Data Portability Actions under Singapore PDPA
Customer dashboards processing Singaporean data fail to offer automated data portability transmission pathways for user profiles upon requested exports, violating PDPA.
Incident response protocols fail to mandate notifying the Singapore PDPC within 3 calendar days of identifying a reportable data breach, violating statutory timelines.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
501
SGPD-008
Singapore Do Not Call (DNC) Registry Violations
Telemarketing integrations dispatch promotional calls or texts to Singapore phone numbers without validating records against the national DNC Registry, violating Singapore PDPA.
Lack of Dual-Language Privacy Notice under Malaysian PDPA
The website targeting Malaysian users fails to present its privacy policy in both national languages (Malay and English), violating explicit Malaysian PDPA requirements.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
503
MYPD-002
Illegal Cross-Border Transfers under Malaysian PDPA
User databases transfer personal records of Malaysian citizens to server locations outside Malaysia without statutory exceptions or explicit consent, violating PDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
504
MYPD-003
Lack of Verification Controls for Data Correctness in Malaysia
The website database fails to implement mechanisms to ensure personal records collected from Malaysian users are processed accurately and kept up-to-date, violating PDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
505
MYPD-004
Non-Compliant Processing of Sensitive Personal Data in Malaysia
Web forms collect sensitive personal detail fields (such as health or political affiliations) of Malaysian users without obtaining explicit, signed consent, violating PDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
506
THPD-005
Failure to Disclose Thai DPO Contact Protocols
The website targeting Thai consumers fails to prominently publish contact options for its designated Data Protection Officer (DPO) under Thai PDPA requirements.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
507
THPD-006
Missing Thai Consent Revocation Interface
The user cabinet fails to offer a simple mechanism for Thai citizens to withdraw consent that is as easy as the mechanism used to grant it, violating PDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
508
THPD-007
Illegal Cross-Border Transfers of Thai Personal Data
Database backups route personal details of Thai users to servers located abroad without complying with adequacy rules or obtaining consent, violating Thai PDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
509
THPD-008
Missing Thai Data Processing Register Entries
Corporate controllers processing Thai citizen records fail to document and preserve logs of database operations and purpose evaluations, violating PDPA mandates.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
510
THPD-009
Collection of Thai Sensitive Personal Data without Explicit Consent
Online intake forms collect criminal records, biological, or health data of Thai residents without securing active, explicit consent, violating PDPA regulations.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
511
VNDP-002
Lack of Prior Impact Assessment for Vietnam Data Transfers
Organizations transferring Vietnamese personal data to server locations outside Vietnam fail to file a Transfer Impact Assessment with the Ministry of Public Security, violating Decree 13.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
512
VNDP-003
Non-Compliant Processing of Children's Data in Vietnam
Web applications collecting personal details of children in Vietnam aged 7 or older fail to verify child consent along with parental/guardian approval, violating Decree 13.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
513
VNDP-004
Lack of Localized Server Presence for Vietnam Operations
Enterprise systems fail to establish a local server presence to store user database records of Vietnamese citizens within Vietnamese territory when required by cybersecurity laws.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
514
VNDP-005
Failure to Disclose DPO Details under Vietnam Decree 13
Organizations processing sensitive personal details of Vietnamese citizens fail to designate a Data Protection Department or DPO contact in their privacy policies, violating Decree 13.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
515
VNDP-006
Lack of Verified Data Security Assessments in Vietnam
Platforms processing Vietnamese user records fail to perform annual database system security assessments and maintain verification logs for regulatory inspections under Decree 13.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
516
DPDP-004
Missing Multi-Language Privacy Notices for India
The website targeting Indian users fails to provide option toggles to view the privacy disclosures in all 22 scheduled languages of the Constitution of India, violating DPDP Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
517
DPDP-005
Lack of Localized Dispute Redressal Channels for India
The support portal fails to provide Indian consumers with a clear mechanism to file grievances and contact a localized Grievance Officer, violating DPDP Act mandates.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
518
DPDP-006
Incomplete Purpose-Specification Form Notices in India
Online input forms collect personal details of Indian residents without presenting a standalone, clear notification specifying exactly what details are collected and why, violating DPDP Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
519
DPDP-007
Failure to Disclose DPO and Consent Manager Contacts in India
The privacy disclosures targeting India omit publishing details of the DPO and fail to support appointing a certified Consent Manager, violating DPDP requirements.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
520
DPDP-008
Non-Compliant Processing of Children's Tracking Cookies in India
The website executes behavioral monitoring cookies or targets advertising algorithms towards users determined to be children under 18 in India, violating DPDP Act prohibitions.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
521
DPDP-009
Lack of Data Erasure Controls on Vendor Subprocessors in India
The database fails to automatically propagate data erasure requests submitted by Indian users to third-party vendor subprocessors and partners, violating DPDP Act mandates.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
522
JPAP-004
Lack of Cross-Border Information Disclosures under Japanese APPI
The privacy policy fails to inform Japanese users of the names of countries where their records are stored and the security systems implemented by recipient servers, violating APPI.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
523
JPAP-005
Incomplete Disclosure of Database Safety Measures in Japan
The corporate privacy policy fails to list specific administrative, technical, and physical safety management measures taken to protect stored Japanese records, violating APPI.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
524
JPAP-006
Lack of Consent for Pseudo-Personally Identifiable Information in Japan
The website tracks and processes pseudonymised user data (e.g. cookie IDs linked to server profiles) of Japanese visitors without meeting APPI disclosure requirements.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
525
JPAP-007
Non-Compliant Processing of Personally Referable Information in Japan
Web databases transfer user identifiers to third parties knowing they will be linked to identifiable personal records in Japan without validating consent, violating APPI.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
526
JPAP-008
Lack of Data Breach Notification System for PPC Japan
System incident tracking rules fail to mandate reporting significant data breach incidents (resulting in leaks of sensitive or high-volume files) to the Japanese Personal Information Protection Commission (PPC).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
527
JPAP-009
Illegal Direct Marketing over Phone without Verification in Japan
Lead forms capturing Japanese telephone numbers fail to display clear opt-out checkboxes and verify Do Not Call preferences before initiating sales calls, violating APPI guidelines.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
528
SKPA-001
Lack of Multi-Option Form Consent Separations in South Korea
Online input forms targeting South Korean users bundle optional marketing consents together with essential terms of service agreement checkmarks, violating South Korea's PIPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
529
SKPA-002
Non-Compliant Resident Registration Number Processing in S. Korea
Web applications process Resident Registration Numbers (RRN) of South Korean citizens without statutory legal authority or secure cryptographic measures, violating South Korea PIPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
530
SKPA-003
Lack of Native Language DPO Disclosures in South Korea
The privacy disclosures targeting South Korean users fail to specify the contact address or phone number of the DPO in Korean native text, violating PIPA mandates.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
531
SKPA-004
Missing Cross-Border Transfer Disclosures under Korean PIPA
The privacy policy fails to inform South Korean consumers of the date, destination country, and purpose of outbound personal data transfers to overseas servers, violating PIPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
532
SKPA-005
South Korea PIPC Breach Notification Violations
Incident response guidelines fail to mandate reporting significant data breach leaks (affecting 1,000+ users) to the Korean Personal Information Protection Commission (PIPC) within 24 hours.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
533
LGPD-005
Missing Brazilian DPO Registry with ANPD
Organizations processing Brazilian personal data fail to formally register and publish their designated DPO (Encarregado) contact details with the national ANPD authority, violating LGPD.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
534
LGPD-006
Lack of Explicit Consent for Processing Sensitive Brazilian Records
Online intake forms collect health, biometrics, or union status details from Brazilian consumers without obtaining a separate, explicit opt-in signature or verification checkbox, violating LGPD.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
535
LGPD-007
Non-Compliant Data Portability Path under Brazilian LGPD
The customer dashboard fails to provide Brazilian consumers with an automated interface to export and transfer their database profiles to competitor networks, violating LGPD.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
536
LGPD-008
Failure to Document Brazilian Processing Legal Bases
The corporate privacy policy fails to explicitly link each category of collected personal details to one of the ten statutory legal bases required for compliance under LGPD.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
537
LGPD-009
Failure to Honor Immediate Erasure Requests in Brazil
Support systems fail to instantly delete personal details and verify compliance upon receipt of erasure requests submitted by Brazilian users, violating LGPD regulations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
538
POPI-003
Missing Registration of South African Information Officer
Organizations processing personal details of South African residents fail to register their designated Information Officer with the Information Regulator, violating POPIA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
540
POPI-005
Insecure Storage of South African Identity Numbers
System databases store South African national identity numbers in unencrypted database columns or permit unauthorized access, failing POPIA security requirements.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
541
POPI-006
Failure to Audit South African Processing Purpose Boundaries
Web applications process details collected from South African citizens for reasons not compatible with the original collection purpose without consent, violating POPIA.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
542
POPI-007
Failure to File PAIA Manual on Corporate Portals
South African-facing business platforms fail to host a public, downloadable PAIA manual detailing access procedures for corporate information registries, violating statutory requirements.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
543
NDPA-002
Lack of Mandated Audit Disclosures under Nigerian NDPA
Large data controllers processing Nigerian records fail to file annual data protection audit reports with the Nigeria Data Protection Commission (NDPC), violating NDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
545
NDPA-004
Illegal Storage of Nigerian Data Outside Nigeria
User databases transfer records of Nigerian citizens to servers outside Nigeria without meeting adequacy rules or executing verified contractual terms, violating NDPA.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
547
MXPD-002
Missing Mexican Privacy Notice Structure (Aviso de Privacidad)
The privacy disclosures targeting Mexican consumers fail to provide the statutory structure of a formal Privacy Notice (Aviso de Privacidad), violating LFPDPPP.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
548
MXPD-003
Lack of Explicit Opt-In for Sensitive Data in Mexico
Online intake forms collect financial or sensitive wellness details from Mexican users without obtaining explicit, signed opt-in signatures or checkboxes, violating Mexican law.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
549
MXPD-004
Failure to Document ARCO Rights Redress Pathways in Mexico
The privacy policy fails to explain the specific procedures, timelines, and contact routes required to execute ARCO rights (Access, Rectification, Cancellation, Opposition) under Mexican law.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
550
MXPD-005
Insecure Security Disclosures for Mexican Customer Data
Customer database records processing Mexican resident data lack documented administrative, technical, and physical security measures required under LFPDPPP regulations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
551
ARGPD-001
Failure to Register Databases with AAIP (Argentina)
The data controller processes personal data of Argentine residents without registering its databases with the Access to Public Information Agency (AAIP).
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
553
ARGPD-003
Missing Local Security Safeguards for Argentine Data Subject Repositories
Database systems holding Argentine resident personal data fail to implement organizational and technical security measures mandated by AAIP regulations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
554
ARGPD-004
Illegal Direct Marketing without Opt-Out Verification under Argentine Law
The website engages in direct marketing to Argentine residents without verifying the national 'Do Not Call' registry or providing a direct opt-out link.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
555
ARGPD-005
Lack of Adequate Third-Country Transfer Safeguards for Argentine Citizens
The controller transfers Argentine resident data internationally to countries or entities that do not provide adequate protection levels under AAIP standards.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
557
COLPD-002
Absence of Explicit Prior Consent for Colombian Residents
The website collects and processes personal data of Colombian residents without obtaining explicit, prior, and informed consent that can be verified later.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
561
CHLPD-001
Failure to Honor Erasure or Correction Requests for Chilean Citizens
The website fails to provide automated or documented channels for Chilean residents to request deletion or rectification of their personal record data.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
562
CHLPD-002
Illegal Processing of Sensitive Personal Information without Written Authorization in Chile
The site collects sensitive data of Chilean citizens (health, ideology, union membership) without obtaining explicit written or equivalent digital consent.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
566
PERPD-001
Failure to Register Personal Data Banks in Peru (RNDP)
The data controller fails to register its personal databases containing Peruvian resident data with the National Registry for Personal Data Protection.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
577
ECUPD-002
Lack of Localized Redress Pathways for Ecuadorian Protection Agency
The privacy policy fails to document user redress rights or provide a clear path to submit complaints to the Ecuadorian Superintendent of Data Protection.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
587
PANPD-002
Lack of ARCO Rights Enforcement Pathways in Panama
The controller fails to provide a free and easily accessible email address or system to exercise access, rectification, opposition, and deletion in Panama.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
591
KENPD-001
Failure to Register as a Data Controller with Kenyan ODPC
The entity collects and processes personal data of Kenyan residents without registering as a data controller or processor with the Office of the Data Protection Commissioner (ODPC).
Absence of Local Representative for Foreign Controllers in Kenya
Foreign data controllers processing personal data of data subjects in Kenya fail to appoint a resident local representative to handle regulatory matters.
Failure to Report Personal Data Breaches within 72 Hours in Egypt
The controller fails to establish internal guidelines to report personal data breaches to the Egyptian regulator and affected subjects within 72 hours.
Unlawful Cross-Border Transfer of Egyptian Citizens' Data
The website transfers personal data of Egyptian residents to international entities without obtaining the necessary approval from the Egyptian Data Protection Center.
Inadequate Verification of Consent for Children's Data in Qatar
The website processes personal data of children in Qatar without obtaining explicit consent from their parents or legal guardians as required by PDPPL.
Lack of Written Consent for Sensitive Data in Bahrain
The website collects sensitive data (such as health status or biometrics) of Bahraini residents without obtaining prior, written, and explicit consent.
Failure to Respond to Omani Consumer Requests within Legal Timeline
The data controller's user request procedures do not mandate responding to access or rectification requests by Omani citizens within the statutory timeframe.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
631
PHLPD-001
Missing Registration of Data Processing Systems with Philippines NPC
The entity processes personal data of Philippine citizens but fails to register its data processing systems with the National Privacy Commission (NPC).
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
655
CANPD-005
Incomplete Third-Party Transfer Agreements for Canadian Data
The controller transfers Canadian resident data to third-party processors without implementing formal contract guarantees ensuring equivalent protection.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
660
BOLPD-005
Insecure Storage of Bolivian Data Subject Registries
Databases processing personal data of Bolivian residents fail to deploy encryption and technical security safeguards required under telecommunication standards.
Processing Ghanaian Sensitive Personal Data without Authorization
The website collects sensitive personal records (biometric, health, beliefs) of Ghanaian residents without obtaining prior written authorization from the DPC.
Incomplete Privacy Notice Disclosures under Swiss FADP
The website fails to provide comprehensive information about the identity of the controller, categories of data, and recipient countries in its privacy notice.
The controller exports personal data of Swiss residents to third countries without a Federal Council adequacy decision or standard contractual clauses.
Inadequate Subject Rights Access Channels under Swiss FADP
The website fails to provide Swiss residents with free, accessible, and transparent methods to exercise their rights to access, correct, or delete data.
Non-Compliant Direct Marketing Communications in Saudi Arabia
The website sends direct marketing materials or advertising cookies to Saudi subjects without obtaining prior opt-in consent and offering direct opt-out routes.
Unauthorized Cross-Border Transfer of Saudi Personal Data
The website exports personal data of Saudi residents to external hosting environments without ensuring compliance with national security and adequacy regulations.
Inadequate Access Controls and Security Logs under Israeli Regulations
The website database lacks compliance security log monitoring and access restrictions required for databases containing personal files under Israeli regulations.
Non-Compliant Direct Mail Marketing Registry in Israel
The web controller uses lists of contacts for direct mailing to Israeli citizens without disclosing the source of the database and providing opt-out routes.
Lack of Direct Access and Rectification Procedures in Israel
The privacy policy fails to detail the administrative processes or specific timelines for Israeli subjects to inspect, rectify, or request erasure of their records.
Lack of Consent for Processing Sensitive Data in Sri Lanka
The website processes sensitive personal data (biometrics, health, financial records) of Sri Lankan subjects without obtaining valid, explicit consent.
The website retains personal data of Sri Lankan users longer than necessary for the specified purposes, violating retention limits under Sri Lankan law.
Failure to Document Security Breach Notification Protocols in Tanzania
The data controller fails to document administrative procedures to notify the Commission and affected subjects of security breaches as soon as practicable.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
801
BHSPD-001
Unregistered Processing of Personal Data in Bahamas
The website collects sensitive personal records of Bahamian subjects without registering the processing registry with the Data Protection Commissioner.
Non-Compliant Cross-Border Data Transfer from Tunisia
The controller exports personal data of Tunisian users to external hosting environments without ensuring compliance with adequacy and regulatory approvals.
Lack of Explicit Consent for Sensitive Data in Ivory Coast
The website processes sensitive personal data (biometrics, health, financial records) of Ivorian subjects without obtaining valid, prior explicit consent.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
848
MNGPD-003
Lack of Data Subject Rectification and Erasure Rights in Mongolia
The website privacy policy fails to document accessible contact paths or specific procedures for Mongolian users to request correction or destruction of records.
Inadequate Subject Rights Access Channels in Liechtenstein
The website fails to provide Liechtenstein residents with free, accessible, and transparent methods to exercise rights of access, correction, or deletion.
Inadequate Subject Rights Access Channels in North Macedonia
The website fails to provide Macedonian residents with free, accessible, and transparent methods to exercise rights of access, correction, or deletion.
Unauthorized Cross-Border Transfer of Montenegrin Data
The website exports personal data of Montenegrin residents to external countries that do not ensure an adequate level of protection without AZLP approval.
Inadequate Subject Rights Access Channels in Montenegro
The website fails to provide Montenegrin residents with free, accessible, and transparent methods to exercise rights to check, rectify, or delete data.
Inadequate Subject Rights Access Channels in San Marino
The website fails to provide Sammarinese residents with free, accessible, and transparent methods to exercise rights of access, correction, or deletion.
Unauthorized Cross-Border Transfer of Faroese Data
The website exports personal data of Faroese residents to external countries that do not ensure an adequate level of protection without Datatilsynet approval.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
984
BMUPD-004
Lack of Formal Data Processor Agreements under Bermuda Law
The controller transfers personal records of Bermudian residents to third-party processors without a binding written contract ensuring equivalent protection.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
986
CYMPD-001
Lack of Explicit Consent for Sensitive Data under Cayman DPA
The website collects sensitive personal records (health, financial, genetic) of Caymanian residents without obtaining prior explicit written or digital consent.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
993
LCAPD-003
Inadequate Technical Database Safeguards in Saint Lucia
The database collects and processes personal files of Saint Lucian residents without employing mandatory technical encryption or administrative controls.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
995
LCAPD-005
Non-Compliant Cross-Border Transfer of Saint Lucian Data
The controller transfers data of Saint Lucian residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
998
KNAPD-003
Inadequate Technical Database Safeguards in St. Kitts & Nevis
The database collects and processes personal files of St. Kitts & Nevis residents without employing mandatory technical encryption or administrative controls.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
999
KNAPD-004
Non-Compliant Data Retention Cycles in St. Kitts & Nevis
The website retains personal records of St. Kitts & Nevis users longer than necessary for the designated processing purpose without deletion protocols.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1000
KNAPD-005
Non-Compliant Cross-Border Transfer of St. Kitts & Nevis Data
The controller transfers data of St. Kitts & Nevis residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1003
ATGPD-003
Inadequate Technical Database Safeguards in Antigua & Barbuda
The database collects and processes personal files of Antigua & Barbuda residents without employing mandatory technical encryption or administrative controls.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1004
ATGPD-004
Non-Compliant Data Retention Cycles in Antigua & Barbuda
The website retains personal records of Antigua & Barbuda users longer than necessary for the designated processing purpose without deletion protocols.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1005
ATGPD-005
Non-Compliant Cross-Border Transfer of Antigua & Barbuda Data
The controller transfers data of Antigua & Barbuda residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
Unauthorized Cross-Border Transfer of Seychelles Data
The website exports personal data of Seychelles residents to external countries that do not ensure an adequate level of protection without regulator approval.
Inadequate Subject Rights Access Channels in Seychelles
The website fails to provide Seychelles residents with free, accessible, and transparent methods to exercise rights of access, correction, or deletion.
Lack of Explicit Consent for Sensitive Data under Macau Law
The website collects sensitive personal records (health, financial, genetic) of Macau residents without obtaining prior explicit written or digital consent.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1115
GRNPD-005
Non-Compliant Cross-Border Transfer of Grenadian Data
The controller transfers data of Grenadian residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1116
VCTPD-001
Processing Sensitive Data without Consent in St. Vincent & Grenadines
The website collects sensitive personal records (health, financial details) of St. Vincent & Grenadines subjects without prior written explicit consent.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1118
VCTPD-003
Inadequate Technical Database Safeguards in St. Vincent & Grenadines
The database collects and processes personal files of St. Vincent & Grenadines residents without employing mandatory technical encryption or administrative controls.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1119
VCTPD-004
Non-Compliant Data Retention Cycles in St. Vincent & Grenadines
The website retains personal records of St. Vincent & Grenadines users longer than necessary for the designated processing purpose without deletion protocols.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1120
VCTPD-005
Non-Compliant Cross-Border Transfer of St. Vincent & Grenadines Data
The controller transfers data of St. Vincent & Grenadines residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1140
GUYPD-005
Non-Compliant Cross-Border Transfer of Guyanese Data
The controller transfers data of Guyanese residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1145
BLZPD-005
Non-Compliant Cross-Border Transfer of Belizean Data
The controller transfers data of Belizean residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1148
SURPD-003
Inadequate Technical Database Safeguards in Suriname
The database collects and processes personal files of Surinamese residents without employing mandatory technical encryption or administrative controls.
California Consumer Privacy Act (CCPA/CPRA) / California Age-Appropriate Design Code (AB 2273)
$2,500–$7,500 per violation / $7,500 per child (AB 2273)
California Privacy Protection Agency (CPPA) audits / California AG civil enforcement
1150
SURPD-005
Non-Compliant Cross-Border Transfer of Surinamese Data
The controller transfers data of Surinamese residents outside the country without ensuring adequate protection levels or obtaining required authorizations.
Processing Personal Data without Legal Basis in South Sudan
The website collects personal details of South Sudanese residents without establishing a valid lawful processing base or consent under South Sudan law.
Lack of Explicit Consent for Sensitive Data in Equatorial Guinea
The website processes sensitive personal records (health, biometric) of Equatorial Guinean residents without prior explicit written or digital consent.
Processing Personal Data without Legal Basis in CAR
The website collects personal details of Central African Republic residents without establishing a valid lawful processing base or consent under CAR law.
Lack of Explicit Consent for Sensitive Data in CAR
The website collects sensitive personal records (health, biometric) of Central African Republic residents without prior explicit written or digital consent.
The controller transfers personal records of Central African Republic subjects to external countries without ensuring adequacy or comparable protection.
Processing Personal Data without Legal Basis in Sierra Leone
The website collects personal details of Sierra Leonean residents without establishing a valid lawful processing base or consent under Sierra Leone law.
Processing Personal Data without Legal Basis in Guinea-Bissau
The website collects personal details of Guinea-Bissau residents without establishing a valid lawful processing base or consent under Guinea-Bissau law.
Processing Personal Data without Legal Basis in Solomon Islands
The website collects personal details of Solomon Islands residents without establishing a valid lawful processing base or consent under Solomon Islands law.
Processing Personal Data without Legal Basis in Marshall Islands
The website collects personal details of Marshall Islands residents without establishing a valid lawful processing base or consent under Marshall Islands law.
Processing Sensitive Data without Written Consent in China
The website collects sensitive personal records (health, financial details) of Chinese subjects without prior written explicit consent under the Personal Information Protection Law (PIPL).
Processing Personal Data without Authority Notification in China
The website controller collects personal details of Chinese residents without submitting a processing notification to the Cyberspace Administration of China (CAC).
The database collects and processes personal files of Chinese residents without employing mandatory technical encryption or administrative controls required under Personal Information Protection Law (PIPL).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1254
CHNPD-004
Non-Compliant Data Retention Cycles in China
The website retains personal records of Chinese users longer than necessary for the designated processing purpose without deletion protocols under Personal Information Protection Law (PIPL).
Non-Compliant Cross-Border Transfer of Chinese Data
The controller transfers data of Chinese residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Personal Information Protection Law (PIPL).
Processing Sensitive Data without Written Consent in Russia
The website collects sensitive personal records (health, financial details) of Russian subjects without prior written explicit consent under the Federal Law No. 152-FZ on Personal Data.
Inadequate Technical Database Safeguards in Russia
The database collects and processes personal files of Russian residents without employing mandatory technical encryption or administrative controls required under Federal Law No. 152-FZ on Personal Data.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1259
RUSPD-004
Non-Compliant Data Retention Cycles in Russia
The website retains personal records of Russian users longer than necessary for the designated processing purpose without deletion protocols under Federal Law No. 152-FZ on Personal Data.
Non-Compliant Cross-Border Transfer of Russian Data
The controller transfers data of Russian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Federal Law No. 152-FZ on Personal Data.
Processing Sensitive Data without Written Consent in Turkey
The website collects sensitive personal records (health, financial details) of Turkish subjects without prior written explicit consent under the Law on Protection of Personal Data No. 6698 (KVKK).
Inadequate Technical Database Safeguards in Turkey
The database collects and processes personal files of Turkish residents without employing mandatory technical encryption or administrative controls required under Law on Protection of Personal Data No. 6698 (KVKK).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1264
TURPD-004
Non-Compliant Data Retention Cycles in Turkey
The website retains personal records of Turkish users longer than necessary for the designated processing purpose without deletion protocols under Law on Protection of Personal Data No. 6698 (KVKK).
Non-Compliant Cross-Border Transfer of Turkish Data
The controller transfers data of Turkish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Law on Protection of Personal Data No. 6698 (KVKK).
Processing Sensitive Data without Written Consent in Nigeria
The website collects sensitive personal records (health, financial details) of Nigerian subjects without prior written explicit consent under the Nigeria Data Protection Act 2023 (NDPA).
Inadequate Technical Database Safeguards in Nigeria
The database collects and processes personal files of Nigerian residents without employing mandatory technical encryption or administrative controls required under Nigeria Data Protection Act 2023 (NDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1269
NGAPD-004
Non-Compliant Data Retention Cycles in Nigeria
The website retains personal records of Nigerian users longer than necessary for the designated processing purpose without deletion protocols under Nigeria Data Protection Act 2023 (NDPA).
Non-Compliant Cross-Border Transfer of Nigerian Data
The controller transfers data of Nigerian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Nigeria Data Protection Act 2023 (NDPA).
Processing Sensitive Data without Written Consent in Afghanistan
The website collects sensitive personal records (health, financial details) of Afghan subjects without prior written explicit consent under the Afghan local communications and telecommunications decrees.
Inadequate Technical Database Safeguards in Afghanistan
The database collects and processes personal files of Afghan residents without employing mandatory technical encryption or administrative controls required under Afghan local communications and telecommunications decrees.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1274
AFGPD-004
Non-Compliant Data Retention Cycles in Afghanistan
The website retains personal records of Afghan users longer than necessary for the designated processing purpose without deletion protocols under Afghan local communications and telecommunications decrees.
Non-Compliant Cross-Border Transfer of Afghan Data
The controller transfers data of Afghan residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Afghan local communications and telecommunications decrees.
Processing Sensitive Data without Written Consent in Azerbaijan
The website collects sensitive personal records (health, financial details) of Azerbaijani subjects without prior written explicit consent under the Law of Azerbaijan on Personal Data No. 998-IIIQ.
Processing Personal Data without Authority Notification in Azerbaijan
The website controller collects personal details of Azerbaijani residents without submitting a processing notification to the Ministry of Digital Development.
Inadequate Technical Database Safeguards in Azerbaijan
The database collects and processes personal files of Azerbaijani residents without employing mandatory technical encryption or administrative controls required under Law of Azerbaijan on Personal Data No. 998-IIIQ.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1279
AZEPD-004
Non-Compliant Data Retention Cycles in Azerbaijan
The website retains personal records of Azerbaijani users longer than necessary for the designated processing purpose without deletion protocols under Law of Azerbaijan on Personal Data No. 998-IIIQ.
Non-Compliant Cross-Border Transfer of Azerbaijani Data
The controller transfers data of Azerbaijani residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Law of Azerbaijan on Personal Data No. 998-IIIQ.
Processing Sensitive Data without Written Consent in Bangladesh
The website collects sensitive personal records (health, financial details) of Bangladeshi subjects without prior written explicit consent under the Information and Communication Technology Act / draft Data Protection Act.
Processing Personal Data without Authority Notification in Bangladesh
The website controller collects personal details of Bangladeshi residents without submitting a processing notification to the BTRC / Data Protection Authority.
Inadequate Technical Database Safeguards in Bangladesh
The database collects and processes personal files of Bangladeshi residents without employing mandatory technical encryption or administrative controls required under Information and Communication Technology Act / draft Data Protection Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1284
BGDPD-004
Non-Compliant Data Retention Cycles in Bangladesh
The website retains personal records of Bangladeshi users longer than necessary for the designated processing purpose without deletion protocols under Information and Communication Technology Act / draft Data Protection Act.
Non-Compliant Cross-Border Transfer of Bangladeshi Data
The controller transfers data of Bangladeshi residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Information and Communication Technology Act / draft Data Protection Act.
Processing Sensitive Data without Written Consent in Belarus
The website collects sensitive personal records (health, financial details) of Belarusian subjects without prior written explicit consent under the Law of Belarus No. 99-Z on Protection of Personal Data.
Processing Personal Data without Authority Notification in Belarus
The website controller collects personal details of Belarusian residents without submitting a processing notification to the National Center for Personal Data Protection.
Inadequate Technical Database Safeguards in Belarus
The database collects and processes personal files of Belarusian residents without employing mandatory technical encryption or administrative controls required under Law of Belarus No. 99-Z on Protection of Personal Data.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1289
BLRPD-004
Non-Compliant Data Retention Cycles in Belarus
The website retains personal records of Belarusian users longer than necessary for the designated processing purpose without deletion protocols under Law of Belarus No. 99-Z on Protection of Personal Data.
Non-Compliant Cross-Border Transfer of Belarusian Data
The controller transfers data of Belarusian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Law of Belarus No. 99-Z on Protection of Personal Data.
Processing Sensitive Data without Written Consent in Cameroon
The website collects sensitive personal records (health, financial details) of Cameroonian subjects without prior written explicit consent under the Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality.
Inadequate Technical Database Safeguards in Cameroon
The database collects and processes personal files of Cameroonian residents without employing mandatory technical encryption or administrative controls required under Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1294
CMRPD-004
Non-Compliant Data Retention Cycles in Cameroon
The website retains personal records of Cameroonian users longer than necessary for the designated processing purpose without deletion protocols under Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality.
Non-Compliant Cross-Border Transfer of Cameroonian Data
The controller transfers data of Cameroonian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Cameroon Law No. 2010/012 on Cybersecurity and Cybercriminality.
Processing Sensitive Data without Written Consent in Comoros
The website collects sensitive personal records (health, financial details) of Comorian subjects without prior written explicit consent under the Comoros local communications and transaction laws.
Inadequate Technical Database Safeguards in Comoros
The database collects and processes personal files of Comorian residents without employing mandatory technical encryption or administrative controls required under Comoros local communications and transaction laws.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1299
COMPD-004
Non-Compliant Data Retention Cycles in Comoros
The website retains personal records of Comorian users longer than necessary for the designated processing purpose without deletion protocols under Comoros local communications and transaction laws.
Non-Compliant Cross-Border Transfer of Comorian Data
The controller transfers data of Comorian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Comoros local communications and transaction laws.
Processing Sensitive Data without Written Consent in Cuba
The website collects sensitive personal records (health, financial details) of Cuban subjects without prior written explicit consent under the Cuban Decree-Law No. 370 on Informatization of Society.
The database collects and processes personal files of Cuban residents without employing mandatory technical encryption or administrative controls required under Cuban Decree-Law No. 370 on Informatization of Society.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1304
CUBPD-004
Non-Compliant Data Retention Cycles in Cuba
The website retains personal records of Cuban users longer than necessary for the designated processing purpose without deletion protocols under Cuban Decree-Law No. 370 on Informatization of Society.
The controller transfers data of Cuban residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Cuban Decree-Law No. 370 on Informatization of Society.
Processing Sensitive Data without Written Consent in DR Congo
The website collects sensitive personal records (health, financial details) of Congolese subjects without prior written explicit consent under the DRC Telecom Law No. 20/017 / Cybersecurity framework.
Inadequate Technical Database Safeguards in DR Congo
The database collects and processes personal files of Congolese residents without employing mandatory technical encryption or administrative controls required under DRC Telecom Law No. 20/017 / Cybersecurity framework.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1309
CODPD-004
Non-Compliant Data Retention Cycles in DR Congo
The website retains personal records of Congolese users longer than necessary for the designated processing purpose without deletion protocols under DRC Telecom Law No. 20/017 / Cybersecurity framework.
Non-Compliant Cross-Border Transfer of Congolese Data
The controller transfers data of Congolese residents outside the country without ensuring adequate protection levels or obtaining required authorizations under DRC Telecom Law No. 20/017 / Cybersecurity framework.
Processing Sensitive Data without Written Consent in Ethiopia
The website collects sensitive personal records (health, financial details) of Ethiopian subjects without prior written explicit consent under the Ethiopian draft Personal Data Protection Proclamation.
Inadequate Technical Database Safeguards in Ethiopia
The database collects and processes personal files of Ethiopian residents without employing mandatory technical encryption or administrative controls required under Ethiopian draft Personal Data Protection Proclamation.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1314
ETHPD-004
Non-Compliant Data Retention Cycles in Ethiopia
The website retains personal records of Ethiopian users longer than necessary for the designated processing purpose without deletion protocols under Ethiopian draft Personal Data Protection Proclamation.
Non-Compliant Cross-Border Transfer of Ethiopian Data
The controller transfers data of Ethiopian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Ethiopian draft Personal Data Protection Proclamation.
Processing Sensitive Data without Written Consent in Haiti
The website collects sensitive personal records (health, financial details) of Haitian subjects without prior written explicit consent under the Haitian Cyber Security guidelines / draft privacy rules.
The database collects and processes personal files of Haitian residents without employing mandatory technical encryption or administrative controls required under Haitian Cyber Security guidelines / draft privacy rules.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1319
HTIPD-004
Non-Compliant Data Retention Cycles in Haiti
The website retains personal records of Haitian users longer than necessary for the designated processing purpose without deletion protocols under Haitian Cyber Security guidelines / draft privacy rules.
Non-Compliant Cross-Border Transfer of Haitian Data
The controller transfers data of Haitian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Haitian Cyber Security guidelines / draft privacy rules.
Processing Sensitive Data without Written Consent in Iran
The website collects sensitive personal records (health, financial details) of Iranian subjects without prior written explicit consent under the Iran Cyber Space regulations / draft Personal Data protection.
The database collects and processes personal files of Iranian residents without employing mandatory technical encryption or administrative controls required under Iran Cyber Space regulations / draft Personal Data protection.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1324
IRNPD-004
Non-Compliant Data Retention Cycles in Iran
The website retains personal records of Iranian users longer than necessary for the designated processing purpose without deletion protocols under Iran Cyber Space regulations / draft Personal Data protection.
Non-Compliant Cross-Border Transfer of Iranian Data
The controller transfers data of Iranian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Iran Cyber Space regulations / draft Personal Data protection.
Processing Sensitive Data without Written Consent in Libya
The website collects sensitive personal records (health, financial details) of Libyan subjects without prior written explicit consent under the Libyan local telecom and cybercrime resolutions.
The database collects and processes personal files of Libyan residents without employing mandatory technical encryption or administrative controls required under Libyan local telecom and cybercrime resolutions.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1329
LBYPD-004
Non-Compliant Data Retention Cycles in Libya
The website retains personal records of Libyan users longer than necessary for the designated processing purpose without deletion protocols under Libyan local telecom and cybercrime resolutions.
Non-Compliant Cross-Border Transfer of Libyan Data
The controller transfers data of Libyan residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Libyan local telecom and cybercrime resolutions.
Processing Sensitive Data without Written Consent in Nauru
The website collects sensitive personal records (health, financial details) of Nauruan subjects without prior written explicit consent under the Nauru Cybersecurity Act / draft privacy rules.
Processing Personal Data without Authority Notification in Nauru
The website controller collects personal details of Nauruan residents without submitting a processing notification to the Ministry of Telecommunications.
The database collects and processes personal files of Nauruan residents without employing mandatory technical encryption or administrative controls required under Nauru Cybersecurity Act / draft privacy rules.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1334
NRUPD-004
Non-Compliant Data Retention Cycles in Nauru
The website retains personal records of Nauruan users longer than necessary for the designated processing purpose without deletion protocols under Nauru Cybersecurity Act / draft privacy rules.
Non-Compliant Cross-Border Transfer of Nauruan Data
The controller transfers data of Nauruan residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Nauru Cybersecurity Act / draft privacy rules.
Processing Sensitive Data without Written Consent in North Korea
The website collects sensitive personal records (health, financial details) of North Korean subjects without prior written explicit consent under the DPRK Cybersecurity and electronic transactions laws.
Processing Personal Data without Authority Notification in North Korea
The website controller collects personal details of North Korean residents without submitting a processing notification to the Ministry of Posts and Telecommunications.
Inadequate Technical Database Safeguards in North Korea
The database collects and processes personal files of North Korean residents without employing mandatory technical encryption or administrative controls required under DPRK Cybersecurity and electronic transactions laws.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1339
PRKPD-004
Non-Compliant Data Retention Cycles in North Korea
The website retains personal records of North Korean users longer than necessary for the designated processing purpose without deletion protocols under DPRK Cybersecurity and electronic transactions laws.
Non-Compliant Cross-Border Transfer of North Korean Data
The controller transfers data of North Korean residents outside the country without ensuring adequate protection levels or obtaining required authorizations under DPRK Cybersecurity and electronic transactions laws.
Processing Sensitive Data without Written Consent in Turkmenistan
The website collects sensitive personal records (health, financial details) of Turkmen subjects without prior written explicit consent under the Law of Turkmenistan No. 562-V on Information and its Protection.
Inadequate Technical Database Safeguards in Turkmenistan
The database collects and processes personal files of Turkmen residents without employing mandatory technical encryption or administrative controls required under Law of Turkmenistan No. 562-V on Information and its Protection.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1344
TKMPD-004
Non-Compliant Data Retention Cycles in Turkmenistan
The website retains personal records of Turkmen users longer than necessary for the designated processing purpose without deletion protocols under Law of Turkmenistan No. 562-V on Information and its Protection.
Non-Compliant Cross-Border Transfer of Turkmen Data
The controller transfers data of Turkmen residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Law of Turkmenistan No. 562-V on Information and its Protection.
Processing Sensitive Data without Written Consent in Tuvalu
The website collects sensitive personal records (health, financial details) of Tuvaluan subjects without prior written explicit consent under the Tuvalu Cybersecurity and draft privacy rules.
Inadequate Technical Database Safeguards in Tuvalu
The database collects and processes personal files of Tuvaluan residents without employing mandatory technical encryption or administrative controls required under Tuvalu Cybersecurity and draft privacy rules.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1349
TUVPD-004
Non-Compliant Data Retention Cycles in Tuvalu
The website retains personal records of Tuvaluan users longer than necessary for the designated processing purpose without deletion protocols under Tuvalu Cybersecurity and draft privacy rules.
Non-Compliant Cross-Border Transfer of Tuvaluan Data
The controller transfers data of Tuvaluan residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Tuvalu Cybersecurity and draft privacy rules.
Processing Sensitive Data without Written Consent in Vatican City
The website collects sensitive personal records (health, financial details) of Vatican subjects without prior written explicit consent under the Vatican local cybersecurity and administrative directives.
Inadequate Technical Database Safeguards in Vatican City
The database collects and processes personal files of Vatican residents without employing mandatory technical encryption or administrative controls required under Vatican local cybersecurity and administrative directives.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1354
VATPD-004
Non-Compliant Data Retention Cycles in Vatican City
The website retains personal records of Vatican users longer than necessary for the designated processing purpose without deletion protocols under Vatican local cybersecurity and administrative directives.
Non-Compliant Cross-Border Transfer of Vatican Data
The controller transfers data of Vatican residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Vatican local cybersecurity and administrative directives.
Processing Sensitive Data without Written Consent in Western Sahara
The website collects sensitive personal records (health, financial details) of Sahrawi subjects without prior written explicit consent under the Western Sahara local rules / cybersecurity draft.
Processing Personal Data without Authority Notification in Western Sahara
The website controller collects personal details of Sahrawi residents without submitting a processing notification to the Telecommunications authority.
Inadequate Technical Database Safeguards in Western Sahara
The database collects and processes personal files of Sahrawi residents without employing mandatory technical encryption or administrative controls required under Western Sahara local rules / cybersecurity draft.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1359
ESHPD-004
Non-Compliant Data Retention Cycles in Western Sahara
The website retains personal records of Sahrawi users longer than necessary for the designated processing purpose without deletion protocols under Western Sahara local rules / cybersecurity draft.
Non-Compliant Cross-Border Transfer of Sahrawi Data
The controller transfers data of Sahrawi residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Western Sahara local rules / cybersecurity draft.
Processing Sensitive Data without Written Consent in Bulgaria
The website collects sensitive personal records (health, financial details) of Bulgarian subjects without prior written explicit consent under the Bulgarian Personal Data Protection Act.
Inadequate Technical Database Safeguards in Bulgaria
The database collects and processes personal files of Bulgarian residents without employing mandatory technical encryption or administrative controls required under Bulgarian Personal Data Protection Act.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1364
BGRPD-004
Non-Compliant Data Retention Cycles in Bulgaria
The website retains personal records of Bulgarian users longer than necessary for the designated processing purpose without deletion protocols under Bulgarian Personal Data Protection Act.
Non-Compliant Cross-Border Transfer of Bulgarian Data
The controller transfers data of Bulgarian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Bulgarian Personal Data Protection Act.
Processing Sensitive Data without Written Consent in Croatia
The website collects sensitive personal records (health, financial details) of Croatian subjects without prior written explicit consent under the Croatian Act on the Implementation of the General Data Protection Regulation.
Inadequate Technical Database Safeguards in Croatia
The database collects and processes personal files of Croatian residents without employing mandatory technical encryption or administrative controls required under Croatian Act on the Implementation of the General Data Protection Regulation.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1369
HRVPD-004
Non-Compliant Data Retention Cycles in Croatia
The website retains personal records of Croatian users longer than necessary for the designated processing purpose without deletion protocols under Croatian Act on the Implementation of the General Data Protection Regulation.
Non-Compliant Cross-Border Transfer of Croatian Data
The controller transfers data of Croatian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Croatian Act on the Implementation of the General Data Protection Regulation.
Processing Sensitive Data without Written Consent in Estonia
The website collects sensitive personal records (health, financial details) of Estonian subjects without prior written explicit consent under the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
Inadequate Technical Database Safeguards in Estonia
The database collects and processes personal files of Estonian residents without employing mandatory technical encryption or administrative controls required under Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1374
ESTPD-004
Non-Compliant Data Retention Cycles in Estonia
The website retains personal records of Estonian users longer than necessary for the designated processing purpose without deletion protocols under Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
Non-Compliant Cross-Border Transfer of Estonian Data
The controller transfers data of Estonian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
Processing Sensitive Data without Written Consent in Latvia
The website collects sensitive personal records (health, financial details) of Latvian subjects without prior written explicit consent under the Latvian Personal Data Processing Law.
Inadequate Technical Database Safeguards in Latvia
The database collects and processes personal files of Latvian residents without employing mandatory technical encryption or administrative controls required under Latvian Personal Data Processing Law.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1379
LVAPD-004
Non-Compliant Data Retention Cycles in Latvia
The website retains personal records of Latvian users longer than necessary for the designated processing purpose without deletion protocols under Latvian Personal Data Processing Law.
Non-Compliant Cross-Border Transfer of Latvian Data
The controller transfers data of Latvian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Latvian Personal Data Processing Law.
Processing Sensitive Data without Written Consent in Lithuania
The website collects sensitive personal records (health, financial details) of Lithuanian subjects without prior written explicit consent under the Lithuanian Law on Legal Protection of Personal Data.
Inadequate Technical Database Safeguards in Lithuania
The database collects and processes personal files of Lithuanian residents without employing mandatory technical encryption or administrative controls required under Lithuanian Law on Legal Protection of Personal Data.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1384
LTUPD-004
Non-Compliant Data Retention Cycles in Lithuania
The website retains personal records of Lithuanian users longer than necessary for the designated processing purpose without deletion protocols under Lithuanian Law on Legal Protection of Personal Data.
Non-Compliant Cross-Border Transfer of Lithuanian Data
The controller transfers data of Lithuanian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Lithuanian Law on Legal Protection of Personal Data.
Processing Sensitive Data without Written Consent in Cyprus
The website collects sensitive personal records (health, financial details) of Cypriot subjects without prior written explicit consent under the Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law.
Processing Personal Data without Authority Notification in Cyprus
The website controller collects personal details of Cypriot residents without submitting a processing notification to the Commissioner for Personal Data Protection.
Inadequate Technical Database Safeguards in Cyprus
The database collects and processes personal files of Cypriot residents without employing mandatory technical encryption or administrative controls required under Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1389
CYPPD-004
Non-Compliant Data Retention Cycles in Cyprus
The website retains personal records of Cypriot users longer than necessary for the designated processing purpose without deletion protocols under Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law.
Non-Compliant Cross-Border Transfer of Cypriot Data
The controller transfers data of Cypriot residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Cyprus Protection of Natural Persons with regard to the Processing of Personal Data Law.
Processing Sensitive Data without Written Consent in Malta
The website collects sensitive personal records (health, financial details) of Maltese subjects without prior written explicit consent under the Malta Data Protection Act (Cap. 586).
The database collects and processes personal files of Maltese residents without employing mandatory technical encryption or administrative controls required under Malta Data Protection Act (Cap. 586).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1394
MLTPD-004
Non-Compliant Data Retention Cycles in Malta
The website retains personal records of Maltese users longer than necessary for the designated processing purpose without deletion protocols under Malta Data Protection Act (Cap. 586).
Non-Compliant Cross-Border Transfer of Maltese Data
The controller transfers data of Maltese residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Malta Data Protection Act (Cap. 586).
Processing Sensitive Data without Written Consent in Slovakia
The website collects sensitive personal records (health, financial details) of Slovak subjects without prior written explicit consent under the Slovak Act No. 18/2018 Coll. on Personal Data Protection.
Inadequate Technical Database Safeguards in Slovakia
The database collects and processes personal files of Slovak residents without employing mandatory technical encryption or administrative controls required under Slovak Act No. 18/2018 Coll. on Personal Data Protection.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1399
SVKPD-004
Non-Compliant Data Retention Cycles in Slovakia
The website retains personal records of Slovak users longer than necessary for the designated processing purpose without deletion protocols under Slovak Act No. 18/2018 Coll. on Personal Data Protection.
Non-Compliant Cross-Border Transfer of Slovak Data
The controller transfers data of Slovak residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Slovak Act No. 18/2018 Coll. on Personal Data Protection.
Processing Sensitive Data without Written Consent in Slovenia
The website collects sensitive personal records (health, financial details) of Slovenian subjects without prior written explicit consent under the Slovenian Personal Data Protection Act (ZVOP-2).
Inadequate Technical Database Safeguards in Slovenia
The database collects and processes personal files of Slovenian residents without employing mandatory technical encryption or administrative controls required under Slovenian Personal Data Protection Act (ZVOP-2).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1404
SVNPD-004
Non-Compliant Data Retention Cycles in Slovenia
The website retains personal records of Slovenian users longer than necessary for the designated processing purpose without deletion protocols under Slovenian Personal Data Protection Act (ZVOP-2).
Non-Compliant Cross-Border Transfer of Slovenian Data
The controller transfers data of Slovenian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Slovenian Personal Data Protection Act (ZVOP-2).
Processing Sensitive Data without Written Consent in Luxembourg
The website collects sensitive personal records (health, financial details) of Luxembourgish subjects without prior written explicit consent under the Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection.
Inadequate Technical Database Safeguards in Luxembourg
The database collects and processes personal files of Luxembourgish residents without employing mandatory technical encryption or administrative controls required under Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1409
LUXPD-004
Non-Compliant Data Retention Cycles in Luxembourg
The website retains personal records of Luxembourgish users longer than necessary for the designated processing purpose without deletion protocols under Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection.
Non-Compliant Cross-Border Transfer of Luxembourgish Data
The controller transfers data of Luxembourgish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Luxembourg Act of 1 August 2018 on the organization of the National Commission for Data Protection.
Processing Sensitive Data without Written Consent in Czech Republic
The website collects sensitive personal records (health, financial details) of Czech subjects without prior written explicit consent under the Czech Act No. 110/2019 Coll. on Personal Data Processing.
Inadequate Technical Database Safeguards in Czech Republic
The database collects and processes personal files of Czech residents without employing mandatory technical encryption or administrative controls required under Czech Act No. 110/2019 Coll. on Personal Data Processing.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1414
CZEPD-004
Non-Compliant Data Retention Cycles in Czech Republic
The website retains personal records of Czech users longer than necessary for the designated processing purpose without deletion protocols under Czech Act No. 110/2019 Coll. on Personal Data Processing.
The controller transfers data of Czech residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Czech Act No. 110/2019 Coll. on Personal Data Processing.
Processing Sensitive Data without Written Consent in Hungary
The website collects sensitive personal records (health, financial details) of Hungarian subjects without prior written explicit consent under the Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.
Inadequate Technical Database Safeguards in Hungary
The database collects and processes personal files of Hungarian residents without employing mandatory technical encryption or administrative controls required under Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1419
HUNPD-004
Non-Compliant Data Retention Cycles in Hungary
The website retains personal records of Hungarian users longer than necessary for the designated processing purpose without deletion protocols under Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.
Non-Compliant Cross-Border Transfer of Hungarian Data
The controller transfers data of Hungarian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.
Processing Sensitive Data without Written Consent in Romania
The website collects sensitive personal records (health, financial details) of Romanian subjects without prior written explicit consent under the Romanian Law No. 190/2018 on implementation measures of GDPR.
Inadequate Technical Database Safeguards in Romania
The database collects and processes personal files of Romanian residents without employing mandatory technical encryption or administrative controls required under Romanian Law No. 190/2018 on implementation measures of GDPR.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1424
ROUPD-004
Non-Compliant Data Retention Cycles in Romania
The website retains personal records of Romanian users longer than necessary for the designated processing purpose without deletion protocols under Romanian Law No. 190/2018 on implementation measures of GDPR.
Non-Compliant Cross-Border Transfer of Romanian Data
The controller transfers data of Romanian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Romanian Law No. 190/2018 on implementation measures of GDPR.
Processing Sensitive Data without Written Consent in Poland
The website collects sensitive personal records (health, financial details) of Polish subjects without prior written explicit consent under the Polish Act of 10 May 2018 on the Protection of Personal Data.
Inadequate Technical Database Safeguards in Poland
The database collects and processes personal files of Polish residents without employing mandatory technical encryption or administrative controls required under Polish Act of 10 May 2018 on the Protection of Personal Data.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1429
POLPD-004
Non-Compliant Data Retention Cycles in Poland
The website retains personal records of Polish users longer than necessary for the designated processing purpose without deletion protocols under Polish Act of 10 May 2018 on the Protection of Personal Data.
Non-Compliant Cross-Border Transfer of Polish Data
The controller transfers data of Polish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Polish Act of 10 May 2018 on the Protection of Personal Data.
Processing Sensitive Data without Written Consent in Ireland
The website collects sensitive personal records (health, financial details) of Irish subjects without prior written explicit consent under the Irish Data Protection Act 2018.
Inadequate Technical Database Safeguards in Ireland
The database collects and processes personal files of Irish residents without employing mandatory technical encryption or administrative controls required under Irish Data Protection Act 2018.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1434
IRLPD-004
Non-Compliant Data Retention Cycles in Ireland
The website retains personal records of Irish users longer than necessary for the designated processing purpose without deletion protocols under Irish Data Protection Act 2018.
The controller transfers data of Irish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Irish Data Protection Act 2018.
Processing Sensitive Data without Written Consent in Austria
The website collects sensitive personal records (health, financial details) of Austrian subjects without prior written explicit consent under the Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG).
Inadequate Technical Database Safeguards in Austria
The database collects and processes personal files of Austrian residents without employing mandatory technical encryption or administrative controls required under Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1439
AUTPD-004
Non-Compliant Data Retention Cycles in Austria
The website retains personal records of Austrian users longer than necessary for the designated processing purpose without deletion protocols under Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG).
Non-Compliant Cross-Border Transfer of Austrian Data
The controller transfers data of Austrian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Austrian Federal Act on the Protection of Personal Data (Datenschutzgesetz - DSG).
Processing Sensitive Data without Written Consent in Sweden
The website collects sensitive personal records (health, financial details) of Swedish subjects without prior written explicit consent under the Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning).
Inadequate Technical Database Safeguards in Sweden
The database collects and processes personal files of Swedish residents without employing mandatory technical encryption or administrative controls required under Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1444
SWEPD-004
Non-Compliant Data Retention Cycles in Sweden
The website retains personal records of Swedish users longer than necessary for the designated processing purpose without deletion protocols under Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning).
Non-Compliant Cross-Border Transfer of Swedish Data
The controller transfers data of Swedish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Swedish Data Protection Act (Lag med kompletterande bestämmelser till EU:s dataskyddsförordning).
Processing Sensitive Data without Written Consent in Finland
The website collects sensitive personal records (health, financial details) of Finnish subjects without prior written explicit consent under the Finnish Data Protection Act (Tietosuojalaki 1050/2018).
Processing Personal Data without Authority Notification in Finland
The website controller collects personal details of Finnish residents without submitting a processing notification to the Office of the Data Protection Ombudsman.
Inadequate Technical Database Safeguards in Finland
The database collects and processes personal files of Finnish residents without employing mandatory technical encryption or administrative controls required under Finnish Data Protection Act (Tietosuojalaki 1050/2018).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1449
FLNPD-004
Non-Compliant Data Retention Cycles in Finland
The website retains personal records of Finnish users longer than necessary for the designated processing purpose without deletion protocols under Finnish Data Protection Act (Tietosuojalaki 1050/2018).
Non-Compliant Cross-Border Transfer of Finnish Data
The controller transfers data of Finnish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Finnish Data Protection Act (Tietosuojalaki 1050/2018).
Processing Sensitive Data without Written Consent in Denmark
The website collects sensitive personal records (health, financial details) of Danish subjects without prior written explicit consent under the Danish Data Protection Act (Databeskyttelsesloven).
Inadequate Technical Database Safeguards in Denmark
The database collects and processes personal files of Danish residents without employing mandatory technical encryption or administrative controls required under Danish Data Protection Act (Databeskyttelsesloven).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1454
DNKPD-004
Non-Compliant Data Retention Cycles in Denmark
The website retains personal records of Danish users longer than necessary for the designated processing purpose without deletion protocols under Danish Data Protection Act (Databeskyttelsesloven).
Non-Compliant Cross-Border Transfer of Danish Data
The controller transfers data of Danish residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Danish Data Protection Act (Databeskyttelsesloven).
Processing Sensitive Data without Written Consent in Belgium
The website collects sensitive personal records (health, financial details) of Belgian subjects without prior written explicit consent under the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
Inadequate Technical Database Safeguards in Belgium
The database collects and processes personal files of Belgian residents without employing mandatory technical encryption or administrative controls required under Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1459
BELPD-004
Non-Compliant Data Retention Cycles in Belgium
The website retains personal records of Belgian users longer than necessary for the designated processing purpose without deletion protocols under Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
Non-Compliant Cross-Border Transfer of Belgian Data
The controller transfers data of Belgian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
Processing Sensitive Data without Written Consent in Greece
The website collects sensitive personal records (health, financial details) of Greek subjects without prior written explicit consent under the Greek Law No. 4624/2019 on Personal Data Protection Measures.
Inadequate Technical Database Safeguards in Greece
The database collects and processes personal files of Greek residents without employing mandatory technical encryption or administrative controls required under Greek Law No. 4624/2019 on Personal Data Protection Measures.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1464
GRCPD-004
Non-Compliant Data Retention Cycles in Greece
The website retains personal records of Greek users longer than necessary for the designated processing purpose without deletion protocols under Greek Law No. 4624/2019 on Personal Data Protection Measures.
The controller transfers data of Greek residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Greek Law No. 4624/2019 on Personal Data Protection Measures.
Processing Sensitive Data without Written Consent in Portugal
The website collects sensitive personal records (health, financial details) of Portuguese subjects without prior written explicit consent under the Portuguese Law No. 58/2019 on execution rules of GDPR.
Inadequate Technical Database Safeguards in Portugal
The database collects and processes personal files of Portuguese residents without employing mandatory technical encryption or administrative controls required under Portuguese Law No. 58/2019 on execution rules of GDPR.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1469
PRTPD-004
Non-Compliant Data Retention Cycles in Portugal
The website retains personal records of Portuguese users longer than necessary for the designated processing purpose without deletion protocols under Portuguese Law No. 58/2019 on execution rules of GDPR.
Non-Compliant Cross-Border Transfer of Portuguese Data
The controller transfers data of Portuguese residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Portuguese Law No. 58/2019 on execution rules of GDPR.
Processing Sensitive Data without Written Consent in Greenland
The website collects sensitive personal records (health, financial details) of Greenlandic subjects without prior written explicit consent under the Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland).
Inadequate Technical Database Safeguards in Greenland
The database collects and processes personal files of Greenlandic residents without employing mandatory technical encryption or administrative controls required under Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1474
GRLPD-004
Non-Compliant Data Retention Cycles in Greenland
The website retains personal records of Greenlandic users longer than necessary for the designated processing purpose without deletion protocols under Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland).
Non-Compliant Cross-Border Transfer of Greenlandic Data
The controller transfers data of Greenlandic residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Greenlandic Act on Processing of Personal Data (Persondataloven for Grønland).
Processing Sensitive Data without Written Consent in Falkland Islands
The website collects sensitive personal records (health, financial details) of Falkland Islands subjects without prior written explicit consent under the Falkland Islands Data Protection Ordinance 2018.
Processing Personal Data without Authority Notification in Falkland Islands
The website controller collects personal details of Falkland Islands residents without submitting a processing notification to the Data Protection Commissioner.
Inadequate Technical Database Safeguards in Falkland Islands
The database collects and processes personal files of Falkland Islands residents without employing mandatory technical encryption or administrative controls required under Falkland Islands Data Protection Ordinance 2018.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1479
FLKPD-004
Non-Compliant Data Retention Cycles in Falkland Islands
The website retains personal records of Falkland Islands users longer than necessary for the designated processing purpose without deletion protocols under Falkland Islands Data Protection Ordinance 2018.
Non-Compliant Cross-Border Transfer of Falkland Islands Data
The controller transfers data of Falkland Islands residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Falkland Islands Data Protection Ordinance 2018.
Processing Sensitive Data without Written Consent in French Polynesia
The website collects sensitive personal records (health, financial details) of French Polynesian subjects without prior written explicit consent under the French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés).
Inadequate Technical Database Safeguards in French Polynesia
The database collects and processes personal files of French Polynesian residents without employing mandatory technical encryption or administrative controls required under French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1484
PYFPD-004
Non-Compliant Data Retention Cycles in French Polynesia
The website retains personal records of French Polynesian users longer than necessary for the designated processing purpose without deletion protocols under French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés).
Non-Compliant Cross-Border Transfer of French Polynesian Data
The controller transfers data of French Polynesian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under French Data Protection Act applicable in French Polynesia (Loi Informatique et Libertés).
Processing Sensitive Data without Written Consent in New Caledonia
The website collects sensitive personal records (health, financial details) of New Caledonian subjects without prior written explicit consent under the French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés).
Inadequate Technical Database Safeguards in New Caledonia
The database collects and processes personal files of New Caledonian residents without employing mandatory technical encryption or administrative controls required under French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1489
NCLPD-004
Non-Compliant Data Retention Cycles in New Caledonia
The website retains personal records of New Caledonian users longer than necessary for the designated processing purpose without deletion protocols under French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés).
Non-Compliant Cross-Border Transfer of New Caledonian Data
The controller transfers data of New Caledonian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under French Data Protection Act applicable in New Caledonia (Loi Informatique et Libertés).
Processing Sensitive Data without Written Consent in Montserrat
The website collects sensitive personal records (health, financial details) of Montserratian subjects without prior written explicit consent under the Montserrat draft Data Protection Act / cybersecurity rules.
Processing Personal Data without Authority Notification in Montserrat
The website controller collects personal details of Montserratian residents without submitting a processing notification to the Data Protection Commissioner.
Inadequate Technical Database Safeguards in Montserrat
The database collects and processes personal files of Montserratian residents without employing mandatory technical encryption or administrative controls required under Montserrat draft Data Protection Act / cybersecurity rules.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1494
MSRPD-004
Non-Compliant Data Retention Cycles in Montserrat
The website retains personal records of Montserratian users longer than necessary for the designated processing purpose without deletion protocols under Montserrat draft Data Protection Act / cybersecurity rules.
Non-Compliant Cross-Border Transfer of Montserratian Data
The controller transfers data of Montserratian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Montserrat draft Data Protection Act / cybersecurity rules.
Processing Sensitive Data without Written Consent in Saint Helena
The website collects sensitive personal records (health, financial details) of Saint Helenian subjects without prior written explicit consent under the Saint Helena Data Protection Ordinance / draft privacy rules.
Processing Personal Data without Authority Notification in Saint Helena
The website controller collects personal details of Saint Helenian residents without submitting a processing notification to the Data Protection Commissioner.
Inadequate Technical Database Safeguards in Saint Helena
The database collects and processes personal files of Saint Helenian residents without employing mandatory technical encryption or administrative controls required under Saint Helena Data Protection Ordinance / draft privacy rules.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1499
SHNPD-004
Non-Compliant Data Retention Cycles in Saint Helena
The website retains personal records of Saint Helenian users longer than necessary for the designated processing purpose without deletion protocols under Saint Helena Data Protection Ordinance / draft privacy rules.
Non-Compliant Cross-Border Transfer of Saint Helenian Data
The controller transfers data of Saint Helenian residents outside the country without ensuring adequate protection levels or obtaining required authorizations under Saint Helena Data Protection Ordinance / draft privacy rules.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1601
TXDPS-001
Inaccessible Data Access Channel under Texas Data Privacy and Security Act (TDPSA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Texas Data Privacy and Security Act (TDPSA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1602
TXDPS-002
Missing Data Rectification Form under Texas Data Privacy and Security Act (TDPSA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Texas Data Privacy and Security Act (TDPSA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1603
TXDPS-003
Inaccessible Data Deletion Portal under Texas Data Privacy and Security Act (TDPSA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Texas Data Privacy and Security Act (TDPSA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1604
TXDPS-004
Lack of Data Portability Export under Texas Data Privacy and Security Act (TDPSA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Texas Data Privacy and Security Act (TDPSA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1606
TXDPS-006
Missing Opt-Out of Personal Data Sales under Texas Data Privacy and Security Act (TDPSA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Texas Data Privacy and Security Act (TDPSA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1608
TXDPS-008
Processing Sensitive Data without Consent under Texas Data Privacy and Security Act (TDPSA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Texas Data Privacy and Security Act (TDPSA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1609
TXDPS-009
Missing Data Protection Impact Assessment under Texas Data Privacy and Security Act (TDPSA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Texas Data Privacy and Security Act (TDPSA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1611
VCDPA-001
Inaccessible Data Access Channel under Virginia Consumer Data Protection Act (VCDPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Virginia Consumer Data Protection Act (VCDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1612
VCDPA-002
Missing Data Rectification Form under Virginia Consumer Data Protection Act (VCDPA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Virginia Consumer Data Protection Act (VCDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1613
VCDPA-003
Inaccessible Data Deletion Portal under Virginia Consumer Data Protection Act (VCDPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Virginia Consumer Data Protection Act (VCDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1614
VCDPA-004
Lack of Data Portability Export under Virginia Consumer Data Protection Act (VCDPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Virginia Consumer Data Protection Act (VCDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1615
VCDPA-005
Missing Opt-Out of Targeted Advertising under Virginia Consumer Data Protection Act (VCDPA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Virginia Consumer Data Protection Act (VCDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1616
VCDPA-006
Missing Opt-Out of Personal Data Sales under Virginia Consumer Data Protection Act (VCDPA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Virginia Consumer Data Protection Act (VCDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1617
VCDPA-007
Missing Opt-Out of Automated Profiling under Virginia Consumer Data Protection Act (VCDPA)
The website uses automated decision models for client eligibility without providing an opt-out under the Virginia Consumer Data Protection Act (VCDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1618
VCDPA-008
Processing Sensitive Data without Consent under Virginia Consumer Data Protection Act (VCDPA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Virginia Consumer Data Protection Act (VCDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1619
VCDPA-009
Missing Data Protection Impact Assessment under Virginia Consumer Data Protection Act (VCDPA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Virginia Consumer Data Protection Act (VCDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1620
VCDPA-010
Non-Compliant Notice at Collection under Virginia Consumer Data Protection Act (VCDPA)
The website collects personal details without presenting a compliant privacy disclosure notice under the Virginia Consumer Data Protection Act (VCDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1621
COPR-001
Inaccessible Data Access Channel under Colorado Privacy Act (CPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Colorado Privacy Act (CPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1631
CTDPA-001
Inaccessible Data Access Channel under Connecticut Data Privacy Act (CTDPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Connecticut Data Privacy Act (CTDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1632
CTDPA-002
Missing Data Rectification Form under Connecticut Data Privacy Act (CTDPA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Connecticut Data Privacy Act (CTDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1633
CTDPA-003
Inaccessible Data Deletion Portal under Connecticut Data Privacy Act (CTDPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Connecticut Data Privacy Act (CTDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1634
CTDPA-004
Lack of Data Portability Export under Connecticut Data Privacy Act (CTDPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Connecticut Data Privacy Act (CTDPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1641
UCPA-001
Inaccessible Data Access Channel under Utah Consumer Privacy Act (UCPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Utah Consumer Privacy Act (UCPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1651
ORCPA-001
Inaccessible Data Access Channel under Oregon Consumer Privacy Act (OCPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Oregon Consumer Privacy Act (OCPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1653
ORCPA-003
Inaccessible Data Deletion Portal under Oregon Consumer Privacy Act (OCPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Oregon Consumer Privacy Act (OCPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1654
ORCPA-004
Lack of Data Portability Export under Oregon Consumer Privacy Act (OCPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Oregon Consumer Privacy Act (OCPA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1661
FLORDB-001
Inaccessible Data Access Channel under Florida Digital Bill of Rights (FDBR)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Florida Digital Bill of Rights (FDBR).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1662
FLORDB-002
Missing Data Rectification Form under Florida Digital Bill of Rights (FDBR)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Florida Digital Bill of Rights (FDBR).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1663
FLORDB-003
Inaccessible Data Deletion Portal under Florida Digital Bill of Rights (FDBR)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Florida Digital Bill of Rights (FDBR).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1664
FLORDB-004
Lack of Data Portability Export under Florida Digital Bill of Rights (FDBR)
The website fails to offer a portable, structured format for users to download and transfer their records under the Florida Digital Bill of Rights (FDBR).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1666
FLORDB-006
Missing Opt-Out of Personal Data Sales under Florida Digital Bill of Rights (FDBR)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Florida Digital Bill of Rights (FDBR).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1671
PIPEDA-001
Inaccessible Data Access Channel under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1672
PIPEDA-002
Missing Data Rectification Form under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1673
PIPEDA-003
Inaccessible Data Deletion Portal under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1674
PIPEDA-004
Lack of Data Portability Export under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1675
PIPEDA-005
Missing Opt-Out of Targeted Advertising under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1676
PIPEDA-006
Missing Opt-Out of Personal Data Sales under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1677
PIPEDA-007
Missing Opt-Out of Automated Profiling under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website uses automated decision models for client eligibility without providing an opt-out under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1678
PIPEDA-008
Processing Sensitive Data without Consent under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1679
PIPEDA-009
Missing Data Protection Impact Assessment under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1680
PIPEDA-010
Non-Compliant Notice at Collection under Canada Personal Information Protection and Electronic Documents Act (PIPEDA)
The website collects personal details without presenting a compliant privacy disclosure notice under the Canada Personal Information Protection and Electronic Documents Act (PIPEDA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1691
TDDDG-001
Inaccessible Data Access Channel under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1692
TDDDG-002
Missing Data Rectification Form under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1693
TDDDG-003
Inaccessible Data Deletion Portal under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1694
TDDDG-004
Lack of Data Portability Export under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website fails to offer a portable, structured format for users to download and transfer their records under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1695
TDDDG-005
Missing Opt-Out of Targeted Advertising under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1696
TDDDG-006
Missing Opt-Out of Personal Data Sales under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1697
TDDDG-007
Missing Opt-Out of Automated Profiling under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website uses automated decision models for client eligibility without providing an opt-out under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1698
TDDDG-008
Processing Sensitive Data without Consent under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1699
TDDDG-009
Missing Data Protection Impact Assessment under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1700
TDDDG-010
Non-Compliant Notice at Collection under German Telecommunications-Telemedia Data Protection Act (TDDDG)
The website collects personal details without presenting a compliant privacy disclosure notice under the German Telecommunications-Telemedia Data Protection Act (TDDDG).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1701
SGPDPA-001
Inaccessible Data Access Channel under Singapore Personal Data Protection Act (PDPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Singapore Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1702
SGPDPA-002
Missing Data Rectification Form under Singapore Personal Data Protection Act (PDPA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Singapore Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1703
SGPDPA-003
Inaccessible Data Deletion Portal under Singapore Personal Data Protection Act (PDPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Singapore Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1704
SGPDPA-004
Lack of Data Portability Export under Singapore Personal Data Protection Act (PDPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Singapore Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1705
SGPDPA-005
Missing Opt-Out of Targeted Advertising under Singapore Personal Data Protection Act (PDPA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Singapore Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1706
SGPDPA-006
Missing Opt-Out of Personal Data Sales under Singapore Personal Data Protection Act (PDPA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Singapore Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1707
SGPDPA-007
Missing Opt-Out of Automated Profiling under Singapore Personal Data Protection Act (PDPA)
The website uses automated decision models for client eligibility without providing an opt-out under the Singapore Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1708
SGPDPA-008
Processing Sensitive Data without Consent under Singapore Personal Data Protection Act (PDPA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Singapore Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1709
SGPDPA-009
Missing Data Protection Impact Assessment under Singapore Personal Data Protection Act (PDPA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Singapore Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1710
SGPDPA-010
Non-Compliant Notice at Collection under Singapore Personal Data Protection Act (PDPA)
The website collects personal details without presenting a compliant privacy disclosure notice under the Singapore Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1711
AUSAPP-001
Inaccessible Data Access Channel under Australian Privacy Principles (APPs)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Australian Privacy Principles (APPs).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1712
AUSAPP-002
Missing Data Rectification Form under Australian Privacy Principles (APPs)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Australian Privacy Principles (APPs).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1713
AUSAPP-003
Inaccessible Data Deletion Portal under Australian Privacy Principles (APPs)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Australian Privacy Principles (APPs).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1714
AUSAPP-004
Lack of Data Portability Export under Australian Privacy Principles (APPs)
The website fails to offer a portable, structured format for users to download and transfer their records under the Australian Privacy Principles (APPs).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1721
NZPRIV-001
Inaccessible Data Access Channel under New Zealand Privacy Act 2020
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the New Zealand Privacy Act 2020.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1731
JPAPPI-001
Inaccessible Data Access Channel under Japan Act on the Protection of Personal Information (APPI)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Japan Act on the Protection of Personal Information (APPI).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1732
JPAPPI-002
Missing Data Rectification Form under Japan Act on the Protection of Personal Information (APPI)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Japan Act on the Protection of Personal Information (APPI).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1733
JPAPPI-003
Inaccessible Data Deletion Portal under Japan Act on the Protection of Personal Information (APPI)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Japan Act on the Protection of Personal Information (APPI).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1734
JPAPPI-004
Lack of Data Portability Export under Japan Act on the Protection of Personal Information (APPI)
The website fails to offer a portable, structured format for users to download and transfer their records under the Japan Act on the Protection of Personal Information (APPI).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1735
JPAPPI-005
Missing Opt-Out of Targeted Advertising under Japan Act on the Protection of Personal Information (APPI)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Japan Act on the Protection of Personal Information (APPI).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1736
JPAPPI-006
Missing Opt-Out of Personal Data Sales under Japan Act on the Protection of Personal Information (APPI)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Japan Act on the Protection of Personal Information (APPI).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1737
JPAPPI-007
Missing Opt-Out of Automated Profiling under Japan Act on the Protection of Personal Information (APPI)
The website uses automated decision models for client eligibility without providing an opt-out under the Japan Act on the Protection of Personal Information (APPI).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1738
JPAPPI-008
Processing Sensitive Data without Consent under Japan Act on the Protection of Personal Information (APPI)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Japan Act on the Protection of Personal Information (APPI).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1739
JPAPPI-009
Missing Data Protection Impact Assessment under Japan Act on the Protection of Personal Information (APPI)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Japan Act on the Protection of Personal Information (APPI).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1740
JPAPPI-010
Non-Compliant Notice at Collection under Japan Act on the Protection of Personal Information (APPI)
The website collects personal details without presenting a compliant privacy disclosure notice under the Japan Act on the Protection of Personal Information (APPI).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1741
KRPIPA-001
Inaccessible Data Access Channel under South Korea Personal Information Protection Act (PIPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the South Korea Personal Information Protection Act (PIPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1742
KRPIPA-002
Missing Data Rectification Form under South Korea Personal Information Protection Act (PIPA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the South Korea Personal Information Protection Act (PIPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1743
KRPIPA-003
Inaccessible Data Deletion Portal under South Korea Personal Information Protection Act (PIPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the South Korea Personal Information Protection Act (PIPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1744
KRPIPA-004
Lack of Data Portability Export under South Korea Personal Information Protection Act (PIPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the South Korea Personal Information Protection Act (PIPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1745
KRPIPA-005
Missing Opt-Out of Targeted Advertising under South Korea Personal Information Protection Act (PIPA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the South Korea Personal Information Protection Act (PIPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1746
KRPIPA-006
Missing Opt-Out of Personal Data Sales under South Korea Personal Information Protection Act (PIPA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the South Korea Personal Information Protection Act (PIPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1747
KRPIPA-007
Missing Opt-Out of Automated Profiling under South Korea Personal Information Protection Act (PIPA)
The website uses automated decision models for client eligibility without providing an opt-out under the South Korea Personal Information Protection Act (PIPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1748
KRPIPA-008
Processing Sensitive Data without Consent under South Korea Personal Information Protection Act (PIPA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the South Korea Personal Information Protection Act (PIPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1749
KRPIPA-009
Missing Data Protection Impact Assessment under South Korea Personal Information Protection Act (PIPA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the South Korea Personal Information Protection Act (PIPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1750
KRPIPA-010
Non-Compliant Notice at Collection under South Korea Personal Information Protection Act (PIPA)
The website collects personal details without presenting a compliant privacy disclosure notice under the South Korea Personal Information Protection Act (PIPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1751
VNDPD-001
Inaccessible Data Access Channel under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1752
VNDPD-002
Missing Data Rectification Form under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1753
VNDPD-003
Inaccessible Data Deletion Portal under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1754
VNDPD-004
Lack of Data Portability Export under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website fails to offer a portable, structured format for users to download and transfer their records under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1755
VNDPD-005
Missing Opt-Out of Targeted Advertising under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1756
VNDPD-006
Missing Opt-Out of Personal Data Sales under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1757
VNDPD-007
Missing Opt-Out of Automated Profiling under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website uses automated decision models for client eligibility without providing an opt-out under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1758
VNDPD-008
Processing Sensitive Data without Consent under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1759
VNDPD-009
Missing Data Protection Impact Assessment under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1760
VNDPD-010
Non-Compliant Notice at Collection under Vietnam Personal Data Protection Decree 13/2023/ND-CP
The website collects personal details without presenting a compliant privacy disclosure notice under the Vietnam Personal Data Protection Decree 13/2023/ND-CP.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1761
THPDPA-001
Inaccessible Data Access Channel under Thailand Personal Data Protection Act (PDPA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Thailand Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1762
THPDPA-002
Missing Data Rectification Form under Thailand Personal Data Protection Act (PDPA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Thailand Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1763
THPDPA-003
Inaccessible Data Deletion Portal under Thailand Personal Data Protection Act (PDPA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Thailand Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1764
THPDPA-004
Lack of Data Portability Export under Thailand Personal Data Protection Act (PDPA)
The website fails to offer a portable, structured format for users to download and transfer their records under the Thailand Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1765
THPDPA-005
Missing Opt-Out of Targeted Advertising under Thailand Personal Data Protection Act (PDPA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the Thailand Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1766
THPDPA-006
Missing Opt-Out of Personal Data Sales under Thailand Personal Data Protection Act (PDPA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Thailand Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1768
THPDPA-008
Processing Sensitive Data without Consent under Thailand Personal Data Protection Act (PDPA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Thailand Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1769
THPDPA-009
Missing Data Protection Impact Assessment under Thailand Personal Data Protection Act (PDPA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Thailand Personal Data Protection Act (PDPA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1771
INDPDP-001
Inaccessible Data Access Channel under India Digital Personal Data Protection Act 2023 (DPDP)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the India Digital Personal Data Protection Act 2023 (DPDP).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1772
INDPDP-002
Missing Data Rectification Form under India Digital Personal Data Protection Act 2023 (DPDP)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the India Digital Personal Data Protection Act 2023 (DPDP).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1773
INDPDP-003
Inaccessible Data Deletion Portal under India Digital Personal Data Protection Act 2023 (DPDP)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the India Digital Personal Data Protection Act 2023 (DPDP).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1774
INDPDP-004
Lack of Data Portability Export under India Digital Personal Data Protection Act 2023 (DPDP)
The website fails to offer a portable, structured format for users to download and transfer their records under the India Digital Personal Data Protection Act 2023 (DPDP).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1775
INDPDP-005
Missing Opt-Out of Targeted Advertising under India Digital Personal Data Protection Act 2023 (DPDP)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the India Digital Personal Data Protection Act 2023 (DPDP).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1776
INDPDP-006
Missing Opt-Out of Personal Data Sales under India Digital Personal Data Protection Act 2023 (DPDP)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the India Digital Personal Data Protection Act 2023 (DPDP).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1777
INDPDP-007
Missing Opt-Out of Automated Profiling under India Digital Personal Data Protection Act 2023 (DPDP)
The website uses automated decision models for client eligibility without providing an opt-out under the India Digital Personal Data Protection Act 2023 (DPDP).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1778
INDPDP-008
Processing Sensitive Data without Consent under India Digital Personal Data Protection Act 2023 (DPDP)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the India Digital Personal Data Protection Act 2023 (DPDP).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1779
INDPDP-009
Missing Data Protection Impact Assessment under India Digital Personal Data Protection Act 2023 (DPDP)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the India Digital Personal Data Protection Act 2023 (DPDP).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1780
INDPDP-010
Non-Compliant Notice at Collection under India Digital Personal Data Protection Act 2023 (DPDP)
The website collects personal details without presenting a compliant privacy disclosure notice under the India Digital Personal Data Protection Act 2023 (DPDP).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1781
BRLGPD-001
Inaccessible Data Access Channel under Brazil General Data Protection Law (LGPD)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the Brazil General Data Protection Law (LGPD).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1782
BRLGPD-002
Missing Data Rectification Form under Brazil General Data Protection Law (LGPD)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the Brazil General Data Protection Law (LGPD).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1783
BRLGPD-003
Inaccessible Data Deletion Portal under Brazil General Data Protection Law (LGPD)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the Brazil General Data Protection Law (LGPD).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1784
BRLGPD-004
Lack of Data Portability Export under Brazil General Data Protection Law (LGPD)
The website fails to offer a portable, structured format for users to download and transfer their records under the Brazil General Data Protection Law (LGPD).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1786
BRLGPD-006
Missing Opt-Out of Personal Data Sales under Brazil General Data Protection Law (LGPD)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the Brazil General Data Protection Law (LGPD).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1788
BRLGPD-008
Processing Sensitive Data without Consent under Brazil General Data Protection Law (LGPD)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the Brazil General Data Protection Law (LGPD).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1789
BRLGPD-009
Missing Data Protection Impact Assessment under Brazil General Data Protection Law (LGPD)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the Brazil General Data Protection Law (LGPD).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1791
ZAPOPI-001
Inaccessible Data Access Channel under South Africa Protection of Personal Information Act (POPIA)
The website provides no accessible mechanism or contact email for users to request access to their stored personal data under the South Africa Protection of Personal Information Act (POPIA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1792
ZAPOPI-002
Missing Data Rectification Form under South Africa Protection of Personal Information Act (POPIA)
The website fails to provide a form or procedure for users to correct inaccurate personal data collected under the South Africa Protection of Personal Information Act (POPIA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1793
ZAPOPI-003
Inaccessible Data Deletion Portal under South Africa Protection of Personal Information Act (POPIA)
The website lacks a clear deletion request mechanism for users seeking erasure of their personal profiles under the South Africa Protection of Personal Information Act (POPIA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1794
ZAPOPI-004
Lack of Data Portability Export under South Africa Protection of Personal Information Act (POPIA)
The website fails to offer a portable, structured format for users to download and transfer their records under the South Africa Protection of Personal Information Act (POPIA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1795
ZAPOPI-005
Missing Opt-Out of Targeted Advertising under South Africa Protection of Personal Information Act (POPIA)
The website deploys tracking pixels for behavioral advertising without offering an opt-out link under the South Africa Protection of Personal Information Act (POPIA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1796
ZAPOPI-006
Missing Opt-Out of Personal Data Sales under South Africa Protection of Personal Information Act (POPIA)
The website shares user details with marketing brokers without providing a prominent opt-out mechanism under the South Africa Protection of Personal Information Act (POPIA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1797
ZAPOPI-007
Missing Opt-Out of Automated Profiling under South Africa Protection of Personal Information Act (POPIA)
The website uses automated decision models for client eligibility without providing an opt-out under the South Africa Protection of Personal Information Act (POPIA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1798
ZAPOPI-008
Processing Sensitive Data without Consent under South Africa Protection of Personal Information Act (POPIA)
The website collects sensitive details (health, beliefs, finance) without affirmative opt-in consent under the South Africa Protection of Personal Information Act (POPIA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1799
ZAPOPI-009
Missing Data Protection Impact Assessment under South Africa Protection of Personal Information Act (POPIA)
The organization fails to conduct or document required risk assessments for high-risk web profiling under the South Africa Protection of Personal Information Act (POPIA).
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1800
ZAPOPI-010
Non-Compliant Notice at Collection under South Africa Protection of Personal Information Act (POPIA)
The website collects personal details without presenting a compliant privacy disclosure notice under the South Africa Protection of Personal Information Act (POPIA).
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1802
TXSBB-002
Unregistered Data Broker Operations Audit and Record Failures
The website sells consumer data to third parties without registering in the Texas Data Broker Registry. Inadequate audit trails or record preservation protocols fail to document configuration settings.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1803
TXSBB-003
Unregistered Data Broker Operations Interface Design Flaws
The website sells consumer data to third parties without registering in the Texas Data Broker Registry. User interfaces employ design components that restrict access or options for visitors.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1804
TXSBB-004
Unregistered Data Broker Operations Cryptographic Strengths
The website sells consumer data to third parties without registering in the Texas Data Broker Registry. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1805
TXSBB-005
Unregistered Data Broker Operations Vulnerability Scanning Failures
The website sells consumer data to third parties without registering in the Texas Data Broker Registry. Automated scanning tools fail to run periodically on public web paths.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1806
TXSBB-006
Unregistered Data Broker Operations Consent Logging Integrity
The website sells consumer data to third parties without registering in the Texas Data Broker Registry. Automated logging systems fail to store customer choices in an immutable storage registry.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1807
TXSBB-007
Unregistered Data Broker Operations Opt-Out Links Visibility
The website sells consumer data to third parties without registering in the Texas Data Broker Registry. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1808
TXSBB-008
Unregistered Data Broker Operations Privacy Notice Disclosures
The website sells consumer data to third parties without registering in the Texas Data Broker Registry. Disclosures fail to clearly state the reasons and scope of personal file processing.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1809
TXSBB-009
Unregistered Data Broker Operations Audit Control Verification
The website sells consumer data to third parties without registering in the Texas Data Broker Registry. Data transfer procedures operate without automated checks ensuring record validity.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1810
TXSBB-010
Unregistered Data Broker Operations Administrative Key Credentials
The website sells consumer data to third parties without registering in the Texas Data Broker Registry. Administrative consoles allow standard user credentials without enforcing MFA keys.
Unlawful Geofencing Around Health Facilities Audit and Record Failures
The mobile web app deploys geofencing tools around medical facilities to track visitor behavior without MHMDA consent. Inadequate audit trails or record preservation protocols fail to document configuration settings.
Unlawful Geofencing Around Health Facilities Interface Design Flaws
The mobile web app deploys geofencing tools around medical facilities to track visitor behavior without MHMDA consent. User interfaces employ design components that restrict access or options for visitors.
Unlawful Geofencing Around Health Facilities Cryptographic Strengths
The mobile web app deploys geofencing tools around medical facilities to track visitor behavior without MHMDA consent. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
Unlawful Geofencing Around Health Facilities Vulnerability Scanning Failures
The mobile web app deploys geofencing tools around medical facilities to track visitor behavior without MHMDA consent. Automated scanning tools fail to run periodically on public web paths.
Unlawful Geofencing Around Health Facilities Consent Logging Integrity
The mobile web app deploys geofencing tools around medical facilities to track visitor behavior without MHMDA consent. Automated logging systems fail to store customer choices in an immutable storage registry.
Unlawful Geofencing Around Health Facilities Opt-Out Links Visibility
The mobile web app deploys geofencing tools around medical facilities to track visitor behavior without MHMDA consent. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
Unlawful Geofencing Around Health Facilities Privacy Notice Disclosures
The mobile web app deploys geofencing tools around medical facilities to track visitor behavior without MHMDA consent. Disclosures fail to clearly state the reasons and scope of personal file processing.
Unlawful Geofencing Around Health Facilities Audit Control Verification
The mobile web app deploys geofencing tools around medical facilities to track visitor behavior without MHMDA consent. Data transfer procedures operate without automated checks ensuring record validity.
Unlawful Geofencing Around Health Facilities Administrative Key Credentials
The mobile web app deploys geofencing tools around medical facilities to track visitor behavior without MHMDA consent. Administrative consoles allow standard user credentials without enforcing MFA keys.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1822
NYDFS-002
Missing Financial Cybersecurity Certification Audit and Record Failures
The financial portal operates without annual cybersecurity compliance filings required by New York DFS. Inadequate audit trails or record preservation protocols fail to document configuration settings.
The financial portal operates without annual cybersecurity compliance filings required by New York DFS. User interfaces employ design components that restrict access or options for visitors.
The financial portal operates without annual cybersecurity compliance filings required by New York DFS. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
The financial portal operates without annual cybersecurity compliance filings required by New York DFS. Automated scanning tools fail to run periodically on public web paths.
The financial portal operates without annual cybersecurity compliance filings required by New York DFS. Automated logging systems fail to store customer choices in an immutable storage registry.
The financial portal operates without annual cybersecurity compliance filings required by New York DFS. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
The financial portal operates without annual cybersecurity compliance filings required by New York DFS. Disclosures fail to clearly state the reasons and scope of personal file processing.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1829
NYDFS-009
Missing Financial Cybersecurity Certification Audit Control Verification
The financial portal operates without annual cybersecurity compliance filings required by New York DFS. Data transfer procedures operate without automated checks ensuring record validity.
The financial portal operates without annual cybersecurity compliance filings required by New York DFS. Administrative consoles allow standard user credentials without enforcing MFA keys.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1832
PSD2-002
Non-Compliant Strong Customer Authentication (SCA) Audit and Record Failures
The checkout portal accepts credit card payments without enforcing multi-factor verification as required by PSD2. Inadequate audit trails or record preservation protocols fail to document configuration settings.
The checkout portal accepts credit card payments without enforcing multi-factor verification as required by PSD2. User interfaces employ design components that restrict access or options for visitors.
The checkout portal accepts credit card payments without enforcing multi-factor verification as required by PSD2. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
The checkout portal accepts credit card payments without enforcing multi-factor verification as required by PSD2. Automated scanning tools fail to run periodically on public web paths.
The checkout portal accepts credit card payments without enforcing multi-factor verification as required by PSD2. Automated logging systems fail to store customer choices in an immutable storage registry.
The checkout portal accepts credit card payments without enforcing multi-factor verification as required by PSD2. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
The checkout portal accepts credit card payments without enforcing multi-factor verification as required by PSD2. Disclosures fail to clearly state the reasons and scope of personal file processing.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1839
PSD2-009
Non-Compliant Strong Customer Authentication (SCA) Audit Control Verification
The checkout portal accepts credit card payments without enforcing multi-factor verification as required by PSD2. Data transfer procedures operate without automated checks ensuring record validity.
The checkout portal accepts credit card payments without enforcing multi-factor verification as required by PSD2. Administrative consoles allow standard user credentials without enforcing MFA keys.
Inadequate Client-Side Script Integrity Controls Audit and Record Failures
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Inadequate audit trails or record preservation protocols fail to document configuration settings.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. User interfaces employ design components that restrict access or options for visitors.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Automated scanning tools fail to run periodically on public web paths.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Automated logging systems fail to store customer choices in an immutable storage registry.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Disclosures fail to clearly state the reasons and scope of personal file processing.
Inadequate Client-Side Script Integrity Controls Audit Control Verification
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Data transfer procedures operate without automated checks ensuring record validity.
The checkout page loads external JavaScript modules without active subresource integrity (SRI) validation filters. Administrative consoles allow standard user credentials without enforcing MFA keys.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1852
GLBAS-002
Missing Secure Transmission Controls for Financial Data Audit and Record Failures
The loan application form transmits credit reports and SSNs over network paths without strong transport layer encryption. Inadequate audit trails or record preservation protocols fail to document configuration settings.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1853
GLBAS-003
Missing Secure Transmission Controls for Financial Data Interface Design Flaws
The loan application form transmits credit reports and SSNs over network paths without strong transport layer encryption. User interfaces employ design components that restrict access or options for visitors.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1854
GLBAS-004
Missing Secure Transmission Controls for Financial Data Cryptographic Strengths
The loan application form transmits credit reports and SSNs over network paths without strong transport layer encryption. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1855
GLBAS-005
Missing Secure Transmission Controls for Financial Data Vulnerability Scanning Failures
The loan application form transmits credit reports and SSNs over network paths without strong transport layer encryption. Automated scanning tools fail to run periodically on public web paths.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1856
GLBAS-006
Missing Secure Transmission Controls for Financial Data Consent Logging Integrity
The loan application form transmits credit reports and SSNs over network paths without strong transport layer encryption. Automated logging systems fail to store customer choices in an immutable storage registry.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1857
GLBAS-007
Missing Secure Transmission Controls for Financial Data Opt-Out Links Visibility
The loan application form transmits credit reports and SSNs over network paths without strong transport layer encryption. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1858
GLBAS-008
Missing Secure Transmission Controls for Financial Data Privacy Notice Disclosures
The loan application form transmits credit reports and SSNs over network paths without strong transport layer encryption. Disclosures fail to clearly state the reasons and scope of personal file processing.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1859
GLBAS-009
Missing Secure Transmission Controls for Financial Data Audit Control Verification
The loan application form transmits credit reports and SSNs over network paths without strong transport layer encryption. Data transfer procedures operate without automated checks ensuring record validity.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1860
GLBAS-010
Missing Secure Transmission Controls for Financial Data Administrative Key Credentials
The loan application form transmits credit reports and SSNs over network paths without strong transport layer encryption. Administrative consoles allow standard user credentials without enforcing MFA keys.
Fictitious Original Pricing Discounts Audit and Record Failures
The catalog displays crossed-out original prices that do not reflect actual historical sales averages, deceiving buyers. Inadequate audit trails or record preservation protocols fail to document configuration settings.
Fictitious Original Pricing Discounts Interface Design Flaws
The catalog displays crossed-out original prices that do not reflect actual historical sales averages, deceiving buyers. User interfaces employ design components that restrict access or options for visitors.
Fictitious Original Pricing Discounts Cryptographic Strengths
The catalog displays crossed-out original prices that do not reflect actual historical sales averages, deceiving buyers. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
Fictitious Original Pricing Discounts Vulnerability Scanning Failures
The catalog displays crossed-out original prices that do not reflect actual historical sales averages, deceiving buyers. Automated scanning tools fail to run periodically on public web paths.
Fictitious Original Pricing Discounts Consent Logging Integrity
The catalog displays crossed-out original prices that do not reflect actual historical sales averages, deceiving buyers. Automated logging systems fail to store customer choices in an immutable storage registry.
Fictitious Original Pricing Discounts Opt-Out Links Visibility
The catalog displays crossed-out original prices that do not reflect actual historical sales averages, deceiving buyers. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
Fictitious Original Pricing Discounts Privacy Notice Disclosures
The catalog displays crossed-out original prices that do not reflect actual historical sales averages, deceiving buyers. Disclosures fail to clearly state the reasons and scope of personal file processing.
Fictitious Original Pricing Discounts Audit Control Verification
The catalog displays crossed-out original prices that do not reflect actual historical sales averages, deceiving buyers. Data transfer procedures operate without automated checks ensuring record validity.
Fictitious Original Pricing Discounts Administrative Key Credentials
The catalog displays crossed-out original prices that do not reflect actual historical sales averages, deceiving buyers. Administrative consoles allow standard user credentials without enforcing MFA keys.
Asymmetric Subscription Cancellation Flow Audit and Record Failures
The membership portal requires users to contact support via telephone to cancel recurring credit billing contracts. Inadequate audit trails or record preservation protocols fail to document configuration settings.
The membership portal requires users to contact support via telephone to cancel recurring credit billing contracts. User interfaces employ design components that restrict access or options for visitors.
The membership portal requires users to contact support via telephone to cancel recurring credit billing contracts. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
The membership portal requires users to contact support via telephone to cancel recurring credit billing contracts. Automated scanning tools fail to run periodically on public web paths.
The membership portal requires users to contact support via telephone to cancel recurring credit billing contracts. Automated logging systems fail to store customer choices in an immutable storage registry.
The membership portal requires users to contact support via telephone to cancel recurring credit billing contracts. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
The membership portal requires users to contact support via telephone to cancel recurring credit billing contracts. Disclosures fail to clearly state the reasons and scope of personal file processing.
Asymmetric Subscription Cancellation Flow Audit Control Verification
The membership portal requires users to contact support via telephone to cancel recurring credit billing contracts. Data transfer procedures operate without automated checks ensuring record validity.
The membership portal requires users to contact support via telephone to cancel recurring credit billing contracts. Administrative consoles allow standard user credentials without enforcing MFA keys.
Undisclosed Compensated Review Incentives Audit and Record Failures
Product rating summaries display paid reviews without clearly stating that customers received promo rewards for feedback. Inadequate audit trails or record preservation protocols fail to document configuration settings.
Product rating summaries display paid reviews without clearly stating that customers received promo rewards for feedback. User interfaces employ design components that restrict access or options for visitors.
Product rating summaries display paid reviews without clearly stating that customers received promo rewards for feedback. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
Product rating summaries display paid reviews without clearly stating that customers received promo rewards for feedback. Automated scanning tools fail to run periodically on public web paths.
Product rating summaries display paid reviews without clearly stating that customers received promo rewards for feedback. Automated logging systems fail to store customer choices in an immutable storage registry.
Product rating summaries display paid reviews without clearly stating that customers received promo rewards for feedback. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
Product rating summaries display paid reviews without clearly stating that customers received promo rewards for feedback. Disclosures fail to clearly state the reasons and scope of personal file processing.
Undisclosed Compensated Review Incentives Audit Control Verification
Product rating summaries display paid reviews without clearly stating that customers received promo rewards for feedback. Data transfer procedures operate without automated checks ensuring record validity.
Product rating summaries display paid reviews without clearly stating that customers received promo rewards for feedback. Administrative consoles allow standard user credentials without enforcing MFA keys.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1892
EUDOR-002
Missing IT Vulnerability Audit Records Audit and Record Failures
The banking web interface operates without documented weekly network vulnerability reports required by DORA. Inadequate audit trails or record preservation protocols fail to document configuration settings.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1893
EUDOR-003
Missing IT Vulnerability Audit Records Interface Design Flaws
The banking web interface operates without documented weekly network vulnerability reports required by DORA. User interfaces employ design components that restrict access or options for visitors.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1894
EUDOR-004
Missing IT Vulnerability Audit Records Cryptographic Strengths
The banking web interface operates without documented weekly network vulnerability reports required by DORA. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1895
EUDOR-005
Missing IT Vulnerability Audit Records Vulnerability Scanning Failures
The banking web interface operates without documented weekly network vulnerability reports required by DORA. Automated scanning tools fail to run periodically on public web paths.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1896
EUDOR-006
Missing IT Vulnerability Audit Records Consent Logging Integrity
The banking web interface operates without documented weekly network vulnerability reports required by DORA. Automated logging systems fail to store customer choices in an immutable storage registry.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1897
EUDOR-007
Missing IT Vulnerability Audit Records Opt-Out Links Visibility
The banking web interface operates without documented weekly network vulnerability reports required by DORA. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1898
EUDOR-008
Missing IT Vulnerability Audit Records Privacy Notice Disclosures
The banking web interface operates without documented weekly network vulnerability reports required by DORA. Disclosures fail to clearly state the reasons and scope of personal file processing.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1899
EUDOR-009
Missing IT Vulnerability Audit Records Audit Control Verification
The banking web interface operates without documented weekly network vulnerability reports required by DORA. Data transfer procedures operate without automated checks ensuring record validity.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1900
EUDOR-010
Missing IT Vulnerability Audit Records Administrative Key Credentials
The banking web interface operates without documented weekly network vulnerability reports required by DORA. Administrative consoles allow standard user credentials without enforcing MFA keys.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1902
EUCTA-002
Missing Beneficial Ownership Details in Portal Footer Audit and Record Failures
The corporate profile footer lacks disclosures identifying the registered beneficial owners and registry IDs. Inadequate audit trails or record preservation protocols fail to document configuration settings.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1903
EUCTA-003
Missing Beneficial Ownership Details in Portal Footer Interface Design Flaws
The corporate profile footer lacks disclosures identifying the registered beneficial owners and registry IDs. User interfaces employ design components that restrict access or options for visitors.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1904
EUCTA-004
Missing Beneficial Ownership Details in Portal Footer Cryptographic Strengths
The corporate profile footer lacks disclosures identifying the registered beneficial owners and registry IDs. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1905
EUCTA-005
Missing Beneficial Ownership Details in Portal Footer Vulnerability Scanning Failures
The corporate profile footer lacks disclosures identifying the registered beneficial owners and registry IDs. Automated scanning tools fail to run periodically on public web paths.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1906
EUCTA-006
Missing Beneficial Ownership Details in Portal Footer Consent Logging Integrity
The corporate profile footer lacks disclosures identifying the registered beneficial owners and registry IDs. Automated logging systems fail to store customer choices in an immutable storage registry.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1907
EUCTA-007
Missing Beneficial Ownership Details in Portal Footer Opt-Out Links Visibility
The corporate profile footer lacks disclosures identifying the registered beneficial owners and registry IDs. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1908
EUCTA-008
Missing Beneficial Ownership Details in Portal Footer Privacy Notice Disclosures
The corporate profile footer lacks disclosures identifying the registered beneficial owners and registry IDs. Disclosures fail to clearly state the reasons and scope of personal file processing.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1909
EUCTA-009
Missing Beneficial Ownership Details in Portal Footer Audit Control Verification
The corporate profile footer lacks disclosures identifying the registered beneficial owners and registry IDs. Data transfer procedures operate without automated checks ensuring record validity.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1910
EUCTA-010
Missing Beneficial Ownership Details in Portal Footer Administrative Key Credentials
The corporate profile footer lacks disclosures identifying the registered beneficial owners and registry IDs. Administrative consoles allow standard user credentials without enforcing MFA keys.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1912
WCAG2-002
Inadequate Button Target Size Audit and Record Failures
Interactive navigation elements have a click target size smaller than 24x24 CSS pixels, blocking mobility-impaired users. Inadequate audit trails or record preservation protocols fail to document configuration settings.
Interactive navigation elements have a click target size smaller than 24x24 CSS pixels, blocking mobility-impaired users. User interfaces employ design components that restrict access or options for visitors.
Interactive navigation elements have a click target size smaller than 24x24 CSS pixels, blocking mobility-impaired users. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
Interactive navigation elements have a click target size smaller than 24x24 CSS pixels, blocking mobility-impaired users. Automated scanning tools fail to run periodically on public web paths.
Interactive navigation elements have a click target size smaller than 24x24 CSS pixels, blocking mobility-impaired users. Automated logging systems fail to store customer choices in an immutable storage registry.
Interactive navigation elements have a click target size smaller than 24x24 CSS pixels, blocking mobility-impaired users. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
Interactive navigation elements have a click target size smaller than 24x24 CSS pixels, blocking mobility-impaired users. Disclosures fail to clearly state the reasons and scope of personal file processing.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1919
WCAG2-009
Inadequate Button Target Size Audit Control Verification
Interactive navigation elements have a click target size smaller than 24x24 CSS pixels, blocking mobility-impaired users. Data transfer procedures operate without automated checks ensuring record validity.
Interactive navigation elements have a click target size smaller than 24x24 CSS pixels, blocking mobility-impaired users. Administrative consoles allow standard user credentials without enforcing MFA keys.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1922
EAAAX-002
Inaccessible E-Commerce Checkout Controls Audit and Record Failures
The digital store payment forms lack voice-assisted screen reader navigation support required by the EAA. Inadequate audit trails or record preservation protocols fail to document configuration settings.
The digital store payment forms lack voice-assisted screen reader navigation support required by the EAA. User interfaces employ design components that restrict access or options for visitors.
The digital store payment forms lack voice-assisted screen reader navigation support required by the EAA. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
The digital store payment forms lack voice-assisted screen reader navigation support required by the EAA. Automated scanning tools fail to run periodically on public web paths.
The digital store payment forms lack voice-assisted screen reader navigation support required by the EAA. Automated logging systems fail to store customer choices in an immutable storage registry.
The digital store payment forms lack voice-assisted screen reader navigation support required by the EAA. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
The digital store payment forms lack voice-assisted screen reader navigation support required by the EAA. Disclosures fail to clearly state the reasons and scope of personal file processing.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1929
EAAAX-009
Inaccessible E-Commerce Checkout Controls Audit Control Verification
The digital store payment forms lack voice-assisted screen reader navigation support required by the EAA. Data transfer procedures operate without automated checks ensuring record validity.
The digital store payment forms lack voice-assisted screen reader navigation support required by the EAA. Administrative consoles allow standard user credentials without enforcing MFA keys.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1932
ONADA-002
Missing Accessibility Feedback Channel Audit and Record Failures
The Ontario-targeted website fails to host a dedicated compliance channel for users to report digital accessibility barriers. Inadequate audit trails or record preservation protocols fail to document configuration settings.
The Ontario-targeted website fails to host a dedicated compliance channel for users to report digital accessibility barriers. User interfaces employ design components that restrict access or options for visitors.
The Ontario-targeted website fails to host a dedicated compliance channel for users to report digital accessibility barriers. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
The Ontario-targeted website fails to host a dedicated compliance channel for users to report digital accessibility barriers. Automated scanning tools fail to run periodically on public web paths.
The Ontario-targeted website fails to host a dedicated compliance channel for users to report digital accessibility barriers. Automated logging systems fail to store customer choices in an immutable storage registry.
The Ontario-targeted website fails to host a dedicated compliance channel for users to report digital accessibility barriers. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
The Ontario-targeted website fails to host a dedicated compliance channel for users to report digital accessibility barriers. Disclosures fail to clearly state the reasons and scope of personal file processing.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1939
ONADA-009
Missing Accessibility Feedback Channel Audit Control Verification
The Ontario-targeted website fails to host a dedicated compliance channel for users to report digital accessibility barriers. Data transfer procedures operate without automated checks ensuring record validity.
The Ontario-targeted website fails to host a dedicated compliance channel for users to report digital accessibility barriers. Administrative consoles allow standard user credentials without enforcing MFA keys.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1942
SEC50-002
Missing Closed Captions on Training Videos Audit and Record Failures
Embedded onboarding video files operate without synchronized text tracks or closed caption support for deaf users. Inadequate audit trails or record preservation protocols fail to document configuration settings.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1943
SEC50-003
Missing Closed Captions on Training Videos Interface Design Flaws
Embedded onboarding video files operate without synchronized text tracks or closed caption support for deaf users. User interfaces employ design components that restrict access or options for visitors.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1944
SEC50-004
Missing Closed Captions on Training Videos Cryptographic Strengths
Embedded onboarding video files operate without synchronized text tracks or closed caption support for deaf users. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1945
SEC50-005
Missing Closed Captions on Training Videos Vulnerability Scanning Failures
Embedded onboarding video files operate without synchronized text tracks or closed caption support for deaf users. Automated scanning tools fail to run periodically on public web paths.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1946
SEC50-006
Missing Closed Captions on Training Videos Consent Logging Integrity
Embedded onboarding video files operate without synchronized text tracks or closed caption support for deaf users. Automated logging systems fail to store customer choices in an immutable storage registry.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1947
SEC50-007
Missing Closed Captions on Training Videos Opt-Out Links Visibility
Embedded onboarding video files operate without synchronized text tracks or closed caption support for deaf users. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1948
SEC50-008
Missing Closed Captions on Training Videos Privacy Notice Disclosures
Embedded onboarding video files operate without synchronized text tracks or closed caption support for deaf users. Disclosures fail to clearly state the reasons and scope of personal file processing.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1949
SEC50-009
Missing Closed Captions on Training Videos Audit Control Verification
Embedded onboarding video files operate without synchronized text tracks or closed caption support for deaf users. Data transfer procedures operate without automated checks ensuring record validity.
ADA Title III / European Accessibility Act (EAA) / Ontario AODA
$75,000–$150,000 (ADA) / €100,000 (EAA) / $100,000 per day (AODA)
DOJ civil enforcement / National market surveillance penalties / Ministry of Ontario audits
1950
SEC50-010
Missing Closed Captions on Training Videos Administrative Key Credentials
Embedded onboarding video files operate without synchronized text tracks or closed caption support for deaf users. Administrative consoles allow standard user credentials without enforcing MFA keys.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1952
EEOC-002
Missing Automated Hiring Algorithmic Bias Audit Audit and Record Failures
The recruitment application ranks applicant profiles using AI tools without carrying out annual bias audits. Inadequate audit trails or record preservation protocols fail to document configuration settings.
The recruitment application ranks applicant profiles using AI tools without carrying out annual bias audits. User interfaces employ design components that restrict access or options for visitors.
The recruitment application ranks applicant profiles using AI tools without carrying out annual bias audits. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
The recruitment application ranks applicant profiles using AI tools without carrying out annual bias audits. Automated scanning tools fail to run periodically on public web paths.
The recruitment application ranks applicant profiles using AI tools without carrying out annual bias audits. Automated logging systems fail to store customer choices in an immutable storage registry.
The recruitment application ranks applicant profiles using AI tools without carrying out annual bias audits. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
The recruitment application ranks applicant profiles using AI tools without carrying out annual bias audits. Disclosures fail to clearly state the reasons and scope of personal file processing.
OPC Canada investigations / ANPD Brazil audits / OAIC Australia lawsuits / EU AI Office enforcement
1959
EEOC-009
Missing Automated Hiring Algorithmic Bias Audit Audit Control Verification
The recruitment application ranks applicant profiles using AI tools without carrying out annual bias audits. Data transfer procedures operate without automated checks ensuring record validity.
The recruitment application ranks applicant profiles using AI tools without carrying out annual bias audits. Administrative consoles allow standard user credentials without enforcing MFA keys.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1962
BIPAX-002
Missing Biometric Scanner Consent in Virtual Try-On Audit and Record Failures
The cosmetics portal deploys face-scanning virtual try-on software without obtaining prior written biometric consent. Inadequate audit trails or record preservation protocols fail to document configuration settings.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1963
BIPAX-003
Missing Biometric Scanner Consent in Virtual Try-On Interface Design Flaws
The cosmetics portal deploys face-scanning virtual try-on software without obtaining prior written biometric consent. User interfaces employ design components that restrict access or options for visitors.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1964
BIPAX-004
Missing Biometric Scanner Consent in Virtual Try-On Cryptographic Strengths
The cosmetics portal deploys face-scanning virtual try-on software without obtaining prior written biometric consent. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1965
BIPAX-005
Missing Biometric Scanner Consent in Virtual Try-On Vulnerability Scanning Failures
The cosmetics portal deploys face-scanning virtual try-on software without obtaining prior written biometric consent. Automated scanning tools fail to run periodically on public web paths.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1966
BIPAX-006
Missing Biometric Scanner Consent in Virtual Try-On Consent Logging Integrity
The cosmetics portal deploys face-scanning virtual try-on software without obtaining prior written biometric consent. Automated logging systems fail to store customer choices in an immutable storage registry.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1967
BIPAX-007
Missing Biometric Scanner Consent in Virtual Try-On Opt-Out Links Visibility
The cosmetics portal deploys face-scanning virtual try-on software without obtaining prior written biometric consent. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1968
BIPAX-008
Missing Biometric Scanner Consent in Virtual Try-On Privacy Notice Disclosures
The cosmetics portal deploys face-scanning virtual try-on software without obtaining prior written biometric consent. Disclosures fail to clearly state the reasons and scope of personal file processing.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1969
BIPAX-009
Missing Biometric Scanner Consent in Virtual Try-On Audit Control Verification
The cosmetics portal deploys face-scanning virtual try-on software without obtaining prior written biometric consent. Data transfer procedures operate without automated checks ensuring record validity.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1970
BIPAX-010
Missing Biometric Scanner Consent in Virtual Try-On Administrative Key Credentials
The cosmetics portal deploys face-scanning virtual try-on software without obtaining prior written biometric consent. Administrative consoles allow standard user credentials without enforcing MFA keys.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1972
CIPAX-002
Chatbot Live Transcription Without CIPA Warning Audit and Record Failures
The client chat script performs real-time text transcription and records dialogs without presenting a wiretapping warning. Inadequate audit trails or record preservation protocols fail to document configuration settings.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1973
CIPAX-003
Chatbot Live Transcription Without CIPA Warning Interface Design Flaws
The client chat script performs real-time text transcription and records dialogs without presenting a wiretapping warning. User interfaces employ design components that restrict access or options for visitors.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1974
CIPAX-004
Chatbot Live Transcription Without CIPA Warning Cryptographic Strengths
The client chat script performs real-time text transcription and records dialogs without presenting a wiretapping warning. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1975
CIPAX-005
Chatbot Live Transcription Without CIPA Warning Vulnerability Scanning Failures
The client chat script performs real-time text transcription and records dialogs without presenting a wiretapping warning. Automated scanning tools fail to run periodically on public web paths.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1976
CIPAX-006
Chatbot Live Transcription Without CIPA Warning Consent Logging Integrity
The client chat script performs real-time text transcription and records dialogs without presenting a wiretapping warning. Automated logging systems fail to store customer choices in an immutable storage registry.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1977
CIPAX-007
Chatbot Live Transcription Without CIPA Warning Opt-Out Links Visibility
The client chat script performs real-time text transcription and records dialogs without presenting a wiretapping warning. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1978
CIPAX-008
Chatbot Live Transcription Without CIPA Warning Privacy Notice Disclosures
The client chat script performs real-time text transcription and records dialogs without presenting a wiretapping warning. Disclosures fail to clearly state the reasons and scope of personal file processing.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1979
CIPAX-009
Chatbot Live Transcription Without CIPA Warning Audit Control Verification
The client chat script performs real-time text transcription and records dialogs without presenting a wiretapping warning. Data transfer procedures operate without automated checks ensuring record validity.
US State Privacy Acts (VA VCDPA, TX TDPSA, CO CPA) / NY DFS / NY SHIELD
$2,500–$7,500 per violation (States) / up to $250,000 (NY DFS)
State AG civil lawsuits / NY DFS financial enforcement / Class-action liability
1980
CIPAX-010
Chatbot Live Transcription Without CIPA Warning Administrative Key Credentials
The client chat script performs real-time text transcription and records dialogs without presenting a wiretapping warning. Administrative consoles allow standard user credentials without enforcing MFA keys.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1982
LKSG-002
Missing Supply Chain Grievance Channel Audit and Record Failures
The corporate website lacks a publicly accessible portal allowing suppliers to submit human rights violation complaints. Inadequate audit trails or record preservation protocols fail to document configuration settings.
The corporate website lacks a publicly accessible portal allowing suppliers to submit human rights violation complaints. User interfaces employ design components that restrict access or options for visitors.
The corporate website lacks a publicly accessible portal allowing suppliers to submit human rights violation complaints. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
The corporate website lacks a publicly accessible portal allowing suppliers to submit human rights violation complaints. Automated scanning tools fail to run periodically on public web paths.
The corporate website lacks a publicly accessible portal allowing suppliers to submit human rights violation complaints. Automated logging systems fail to store customer choices in an immutable storage registry.
The corporate website lacks a publicly accessible portal allowing suppliers to submit human rights violation complaints. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
The corporate website lacks a publicly accessible portal allowing suppliers to submit human rights violation complaints. Disclosures fail to clearly state the reasons and scope of personal file processing.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1989
LKSG-009
Missing Supply Chain Grievance Channel Audit Control Verification
The corporate website lacks a publicly accessible portal allowing suppliers to submit human rights violation complaints. Data transfer procedures operate without automated checks ensuring record validity.
The corporate website lacks a publicly accessible portal allowing suppliers to submit human rights violation complaints. Administrative consoles allow standard user credentials without enforcing MFA keys.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1992
CSRD-002
Missing Digital Sustainability Disclosures Audit and Record Failures
The corporate portal fails to publish annual sustainability audits in the machine-readable digital format. Inadequate audit trails or record preservation protocols fail to document configuration settings.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1993
CSRD-003
Missing Digital Sustainability Disclosures Interface Design Flaws
The corporate portal fails to publish annual sustainability audits in the machine-readable digital format. User interfaces employ design components that restrict access or options for visitors.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1994
CSRD-004
Missing Digital Sustainability Disclosures Cryptographic Strengths
The corporate portal fails to publish annual sustainability audits in the machine-readable digital format. Cryptographic hashing algorithms or encryption transport layers fall below baseline standards.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1995
CSRD-005
Missing Digital Sustainability Disclosures Vulnerability Scanning Failures
The corporate portal fails to publish annual sustainability audits in the machine-readable digital format. Automated scanning tools fail to run periodically on public web paths.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1996
CSRD-006
Missing Digital Sustainability Disclosures Consent Logging Integrity
The corporate portal fails to publish annual sustainability audits in the machine-readable digital format. Automated logging systems fail to store customer choices in an immutable storage registry.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1997
CSRD-007
Missing Digital Sustainability Disclosures Opt-Out Links Visibility
The corporate portal fails to publish annual sustainability audits in the machine-readable digital format. Footers lack conspicuous links allowing visitors to request exclusion from data tracking.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1998
CSRD-008
Missing Digital Sustainability Disclosures Privacy Notice Disclosures
The corporate portal fails to publish annual sustainability audits in the machine-readable digital format. Disclosures fail to clearly state the reasons and scope of personal file processing.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
1999
CSRD-009
Missing Digital Sustainability Disclosures Audit Control Verification
The corporate portal fails to publish annual sustainability audits in the machine-readable digital format. Data transfer procedures operate without automated checks ensuring record validity.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
2000
CSRD-010
Missing Digital Sustainability Disclosures Administrative Key Credentials
The corporate portal fails to publish annual sustainability audits in the machine-readable digital format. Administrative consoles allow standard user credentials without enforcing MFA keys.
EU DORA / Gramm-Leach-Bliley Act (GLBA) / Corporate Transparency Act (CTA)
$500/day late (FinCEN BOI) / up to $100,000 (GLBA) / 1% daily global turnover (DORA)
FinCEN/IRS criminal penalties / SEC enforcement / European ESAs regulatory audits
Oracle v2.1 · Live
Terminal Threat Scanner
Drop in any domain. Oracle probes WCAG, ADA, GDPR, CCPA, PCI-DSS, SOC 2, and ISO 27001 in seconds and returns a live compliance score.
oracle-threat-scanner — bash
$
Enter a domain above and click Initiate Scan to run the Oracle compliance audit.
Disclaimer: The results of this automated scan are for informational and educational purposes only and do not constitute official legal advice. The specified fine amounts reflect the maximum possible legislative sanctions for the respective types of violations.