Fine or enforcement by a regulator
Missing consent, audit trail, retention or reporting required by law or standard.
Severity: legal. Attached to 44 of 46 published product types, backed by 71 evidence records.
Product types that carry it
| Product type | Grade | Note for this type | Evidence |
|---|---|---|---|
| mobile banking app | primary | Prudential and conduct regulators fine the bank when a release or migration takes current account access offline and testing of the change cannot be shown. | |
| neobank | primary | Automated sanctions screening at app sign-up checks only part of the list, and accounts keep opening for high-risk applicants while a regulator restriction is in force. | |
| peer-to-peer payment app | primary | A user reports an unauthorised send and the app answers with a card chargeback instead of the error investigation that Regulation E requires from the app. | |
| crypto exchange | practitioner single incident, no second source | Transaction monitoring alerts on crypto deposits and withdrawals pile up unreviewed, and the state licensing regulator fines the exchange. | |
| lending platform | primary | A credit denial goes out without specific principal reasons, or furnished tradelines report borrowers as delinquent in error, and the lender faces ECOA or FCRA enforcement. | |
| buy now pay later service | primary | The one-click checkout approval skips the affordability or unsuitability check that UK and Australian rules now require before a pay-in-four plan is offered. | |
| stock trading app | primary | Options trading is approved by an automated questionnaire for customers who fail the broker's own eligibility rules, and FINRA treats it as a supervision failure, and fines the broker for not disclosing that it converts market orders to limit orders. | |
| insurance app | primary | The state insurance regulator penalises the carrier because the online quoting tool lacked the controls its cybersecurity regulation requires, and adopting states expect insurers to test pricing models for unfair discrimination (NAIC bulletin). | |
| accounting and invoicing SaaS | primary | The VAT return needs a spreadsheet export and re-key step, breaking the digital link rule, or the submission API call lacks the required fraud prevention headers. | |
| expense management tool | primary | Reimbursements are paid without a receipt or business purpose, or unspent travel advances are never returned, so the payments fail accountable plan rules and become taxable wages. | |
| telemedicine app | primary | The symptom questionnaire before a video visit fires an ad pixel with the patient's answers, or a controlled-drug prescription goes out without the prescriber's DEA status recorded. | |
| electronic health record system | primary | A certified record system delays or refuses an export of a patient's electronic health information to another provider, which can count as information blocking. | |
| patient portal | primary | A request for medical records sent through the portal lands in a general inbox nobody owns, and the record is released late, which can count as information blocking for a portal on certified health IT. | |
| software as a medical device | primary | A software update ships to patients without the verification records and cybersecurity documentation the device clearance and life cycle standard require, and the update does not meet the clearance. | |
| mental health app | primary | A mood journal or therapy app outside HIPAA shares a user's diagnosis without consent and owes breach notices, or signs up a child under 13 without the parental consent its audience requires. | |
| pharmacy delivery app | primary | A controlled-substance refill passes checkout past the refill limits its prescription allows, or with no valid prescription behind it, and the pharmacist queue never flags it. | |
| clinical trial management software | primary | An inspector asks who changed a primary-endpoint value at a site, and the eCRF shows the new value with no audit trail entry, reason or e-signature. | |
| wearable companion app | primary | A release adds a low-blood-oxygen alert to the companion app, and the wearable is now marketed as an uncleared medical device. | |
| ecommerce store | primary | A backordered item misses the shipping date shown at checkout and no delay email with a cancel link goes out, or one-star product reviews wait in a moderation queue forever. | |
| online marketplace | primary | A seller crosses the high-volume threshold and their listings keep selling in the app with no seller name, address or report-this-listing link. | |
| subscription box service | primary | A subscriber who signed up for the monthly box in two taps must call support or pass a retention offer maze to skip or cancel the next box. | |
| grocery delivery app | primary | A free delivery banner on the first grocery order, with a mandatory service fee added at checkout, drew a federal order against a grocery delivery service. | |
| event ticketing platform | primary | A seat map that shows face value and adds service and facility fees only at checkout breaks the federal fee rule for live-event tickets. | |
| travel booking app | primary | Hotel results ranked by commission, 'only 1 room left' banners and resort fees added after the nightly rate drew regulator action against booking sites. | |
| ride-hailing app | primary | Driver onboarding files (taxi licence, ID scan, criminal record check) are copied to servers in another jurisdiction without a lawful transfer basis. | |
| loyalty program app | primary | Award prices or point expiry change after members earned under the old terms, which the CFPB treats as a possible unfair or deceptive practice. | |
| email marketing platform | primary | A campaign to an imported list with no consent record, or with a broken unsubscribe link or missing postal address, breaks CAN-SPAM and GDPR for the sender. | |
| e-signature service | primary | A consumer signs before seeing the electronic records disclosure, the paper-copy right and how to withdraw consent, so the e-signed notice fails the consumer consent rule; or, for records kept for the FDA, the audit trail and signature controls fall short of 21 CFR Part 11. | |
| video conferencing tool | primary | The tool advertises end-to-end encryption it does not provide, says cloud recordings are encrypted when some sit unencrypted on a server, and a desktop helper installs a hidden local web server that bypasses a browser safeguard and stays after the app is deleted. | |
| identity and access management service | primary | Phone numbers and email addresses collected for MFA enrolment and account recovery end up in a marketing, ads or analytics export. | |
| SDK or client library | primary | The sample privacy text handed to integrating apps does not say who receives the location data the SDK collects, and the regulator holds the SDK owner liable. | |
| desktop application | primary | An app update secretly installs a background component that bypasses a browser safeguard, and the regulator cites it in an order. | |
| data pipeline | primary | Regulatory reports built from pipeline tables carry unreconciled source data, and the supervisor fines the firm for weak data quality controls. | |
| machine learning model service | primary | A credit or screening client cannot give the specific reasons behind a model score, or the model was never tested for accuracy across groups. | |
| LLM-based assistant | primary | The assistant answers children with no age gate, and prompts are kept for model training without a stated legal basis; or the assistant does not tell users they are talking to an AI, or is sold with quality claims nobody tested. | |
| smart home or IoT app | primary | A hub ships to UK buyers with a shared default password and no published security update period, so it cannot legally be sold there. | |
| EV charging app | primary | The price per kWh appears only after the driver taps start, a roaming driver has no way to pay at a public charger, or the operator does not publish its compliance with the rapid charger reliability requirement. | |
| fleet and logistics tracking | primary | Tracking keeps running when a driver takes the work van home for private use, with no privacy switch and no notice to the driver, or hours-of-service logs lack the driver-confirmed edits and malfunction records the electronic logging rule requires. | |
| social network | primary | An account registered with a child's birth date starts public by default, so strangers can see and comment on the child's posts, or phone numbers and emails collected for sign-in security are used to target ads, or an account given an under-13 birth date is created without verifiable parental consent. | |
| dating app | primary | A member's GPS position and sexual orientation, implied by using the app, reach ad partners before valid consent is given. | |
| messaging app | primary | The privacy notice does not tell users, or the non-users whose numbers arrive in uploaded address books, what is shared with group companies. | |
| mobile game | primary | The game collects personal information from players under 13 without notifying parents or getting their verifiable consent. | |
| language learning app | primary | Pronunciation drills record a child learner's voice, and the clips stay on the speech server after a parent asks for them to be deleted, or the app collects a child profile's personal information before a parent consents. | |
| kids app | primary | A child's precise location or advertising ID reaches a third-party SDK bundled in the app before a parent has passed the consent screen. |
Tests that address it
- resilience and failure testing: mandatory for this risk on 1 product types.
- compliance checks: mandatory for this risk on 43 product types.
- regression suite: mandatory for this risk on 7 product types.
- end-to-end functional tests: mandatory for this risk on 20 product types.
- data integrity and migration testing: mandatory for this risk on 9 product types.
- penetration testing: mandatory for this risk on 2 product types.
- contract tests: mandatory for this risk on 1 product types.
- analytics and event tracking tests: mandatory for this risk on 8 product types.
- release smoke tests: mandatory for this risk on 3 product types.
- integration tests: mandatory for this risk on 2 product types.
- unit tests: mandatory for this risk on 2 product types.
Evidence
ev-0003store-guidelineprimary
Designing apps for children and families, Google Play
Google Play Families policy sets extra requirements (ads, data collection, SDKs) for apps whose target audience includes children.
published undated · verified 2026-10-07
ev-0024regulatorprimary
Children's Online Privacy Protection Rule (COPPA), U.S. Federal Trade Commission
COPPA requires verifiable parental consent before collecting personal information from children under 13 on sites and apps directed to children or with actual knowledge.
published undated · verified 2026-10-07
ev-0025regulatorprimary
Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex, European Union
The GDPR sets lawful basis, consent, data subject rights, security of processing (Article 32) and breach notification duties for anyone processing personal data of people in the EU.
published undated · verified 2026-10-07
ev-0026regulatorprimary
Electronic Fund Transfers (Regulation E), Consumer Financial Protection Bureau
Regulation E sets error resolution and liability rules for consumer electronic fund transfers, so wrong or unauthorised transfers must be investigated and corrected.
published undated · verified 2026-10-07
ev-0030regulatorprimary
Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex, European Union
The EU AI Act sets obligations by risk level, including accuracy, resilience and transparency duties for high-risk AI systems and disclosure duties for chatbots.
published undated · verified 2026-10-07
ev-0031regulatorprimary
Software as a Medical Device (SaMD), U.S. Food and Drug Administration
The FDA regulates software intended for medical purposes that is not part of a hardware device as a medical device.
published undated · verified 2026-10-07
ev-0033regulatorprimary
21 CFR Part 11: Electronic Records; Electronic Signatures, U.S. Electronic Code of Federal Regulations
Part 11 requires validation, audit trails and signature controls for electronic records submitted to or kept for the FDA.
published undated · verified 2026-10-07
ev-0034regulatorprimary
CAN-SPAM Act: A Compliance Guide for Business, U.S. Federal Trade Commission
CAN-SPAM requires commercial email to carry a working opt-out and to honour opt-out requests promptly, and to include the sender's valid physical postal address.
published undated · verified 2026-10-07
ev-0041regulatorprimary
VAT Notice 700/22: Making Tax Digital for VAT, HM Revenue & Customs
Manually transferring data within or between software programs, products or applications (that make up functional compatible software) is not acceptable under Making Tax Digital.
Supports regulatory-penalty and data-corruption for accounting SaaS in the UK: VAT figures must flow from the ledger to the VAT return through digital links, so an export and re-key step breaks the rule and invites figure drift.
published undated · verified 2026-10-07
ev-0042regulatorprimary
VAT (MTD) End-to-End Service Guide, HM Revenue & Customs
Supports regulatory-penalty for accounting SaaS that files VAT returns: the tax authority requires sandbox API testing and valid fraud prevention header data before it issues production credentials, so filing fails without them.
published undated · verified 2026-10-07
ev-0051regulatorprimary
New protections confirmed for Buy Now Pay Later borrowers, Financial Conduct Authority
Lenders must carry out proportionate checks to make sure customers can afford to repay what they borrow before offering BNPL.
Supports regulatory-penalty for a BNPL service in the UK: deferred payment credit comes under FCA rules requiring affordability checks at checkout, missed-payment information and support for customers in financial difficulty.
published 2026-02-11 · verified 2026-10-07
ev-0052regulatorprimary
25-069MR ASIC releases new regulatory guidance to support buy now pay later industry reforms, Australian Securities and Investments Commission
Supports regulatory-penalty for a BNPL service in Australia: buy now pay later providers need a credit licence and must meet modified responsible lending obligations, so an approval flow without an unsuitability assessment exposes the provider.
published undated · verified 2026-10-07
ev-0053regulatorprimary
Warning Letter: Applied Therapeutics, Inc. (MARCS-CMS 696833), U.S. Food and Drug Administration
FDA cannot verify the accuracy, consistency, and completeness of study data collected for critical eCOAs
A sponsor received an FDA warning letter after a contracted electronic outcome assessment system had trial data and its audit trails deleted, so the endpoint data could not be verified; this is the record-retention failure trial software must prevent.
published 2024-12-03 · verified 2026-10-07
ev-0055regulatorprimary
Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers, U.S. Food and Drug Administration
Final FDA guidance (issued October 2024 per the page) on how sponsors, investigators and service providers meet Part 11 for electronic systems, records and signatures used in clinical investigations, the rule set an EDC or CTMS is inspected against.
published undated · verified 2026-10-07
ev-0063court-or-fineprimary
DFS Announces [amount] Settlement with Coinbase, Inc. after Investigation Finds Significant Failings in Company's Compliance Program, New York State Department of Financial Services
State regulator settlement finding a crypto exchange's know-your-customer program inadequate and its transaction monitoring system unable to keep pace with alerts, leaving a large unreviewed backlog. Supports regulatory-penalty and fraud-abuse for crypto exchanges.
published 2023-01-04 · verified 2026-10-07
ev-0071regulatorprimary
Fashion Nova Will Pay [amount] for Consumer Refunds To Settle FTC Charges It Violated Rules On Shipping, Refunds, U.S. Federal Trade Commission
A single-merchant online fashion store was charged under the Mail Order Rule for not sending shipping-delay notices with a cancel option and for issuing gift cards instead of refunds on unshipped items, both order-flow behaviours of an ecommerce store. A subscription box ships ordered merchandise under the same rule, so a late box needs the same delay notice and refund.
published 2020-04-21 · verified 2026-10-07
ev-0072regulatorprimary
Fashion Nova will Pay [amount] as part of Settlement of FTC Allegations it Blocked Negative Reviews of Products, U.S. Federal Trade Commission
The FTC acted against an online store whose review tool auto-published four- and five-star reviews and held lower ones for approval, so the product review flow on a store page is a regulated feature.
published 2022-01-25 · verified 2026-10-07
ev-0081regulatorprimary
Enforcement Alert, Assistant Secretary for Technology Policy / Office of the National Coordinator for Health IT
Information blocking enforcement alert: developers of certified health IT that interfere with access, exchange or use of electronic health information face civil money penalties from OIG. Supports regulatory-penalty for EHR systems and for patient portals that sit on certified health IT and must release records to patients and other systems.
published 2025-09-04 · verified 2026-10-07
ev-0082regulatorprimary
Publication 463 (2025), Travel, Gift, and Car Expenses, Internal Revenue Service
Supports regulatory-penalty for an expense management tool: reimbursements count as an accountable plan only with adequate accounting, documentary evidence such as receipts and return of excess advances; otherwise the employer reports them as wages.
published undated · verified 2026-10-07
ev-0089regulatorprimary
Instacart to Pay [amount] in Consumer Refunds to Settle FTC Lawsuit Over Allegations it Engaged in Deceptive Tactics, Federal Trade Commission
Consumers who experience late deliveries or unprofessional service typically are not offered full refunds and instead are given only a small credit that can be used toward a future order.
Federal settlement with a grocery delivery service over a free delivery claim with undisclosed mandatory service fees, a satisfaction guarantee that paid credits instead of refunds, and membership charges after free trials without consent. Supports regulatory-penalty and money-loss for a grocery delivery app.
published 2025-12-18 · verified 2026-10-07
ev-0093court-or-fineprimary
Attorney General James and DFS Superintendent Harris Secure [amount] from Auto Insurance Companies over Data Breaches, New York State Department of Financial Services
Hackers were able to obtain New Yorkers' driver's license numbers from GEICO's publicly-facing website because GEICO failed to protect this information on the website's back end.
Supports data-breach and regulatory-penalty for an insurance app: attackers pulled driver's license numbers from public online quoting tools and the insurers were penalised under the state cybersecurity regulation.
published 2024-11-25 · verified 2026-10-07
ev-0097standardprimary
NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers, National Association of Insurance Commissioners
These standards require, at a minimum, that decisions made by Insurers are not inaccurate, arbitrary, capricious, or unfairly discriminatory.
Supports wrong-decisions for an insurance app: insurers using AI or predictive models in underwriting, pricing or claims are expected to test for errors, bias and model drift, and adopting states hold them to it.
published 2023-12-04 · verified 2026-10-07
ev-0099court-or-fineprimary
CFPB Orders Hyundai to Pay [amount] for Widespread Credit Reporting Failures, Consumer Financial Protection Bureau
Supports data-corruption for a lending platform: a loan servicer's systems furnished inaccurate account information to credit reporting companies and borrowers were reported delinquent through no fault of their own.
published 2022-07-26 · verified 2026-10-07
ev-0100regulatorprimary
CFPB Acts to Protect the Public from Black-Box Credit Models Using Complex Algorithms, Consumer Financial Protection Bureau
Supports wrong-decisions and regulatory-penalty for a lending platform: creditors using algorithmic credit decisions must still give declined applicants the specific, accurate reasons, so the decision engine and the notice must agree.
published 2022-05-26 · verified 2026-10-07
ev-0103regulatorprimary
Consumer Financial Protection Circular 2024-07: Design, marketing, and administration of credit card rewards programs, Consumer Financial Protection Bureau
The circular treats reducing the value of rewards already earned, and point conversions after a merger that lose value, as possible unfair or deceptive practices. Written for card rewards; it transfers to any points program where earned balances carry value, so it supports money-loss, data-corruption and regulatory-penalty for loyalty program apps.
published 2024-12-18 · verified 2026-10-07
ev-0107regulatorprimary
Online Marketplace Temu to Pay [amount] Penalty for Alleged INFORM Act Violations, U.S. Federal Trade Commission
First INFORM Act enforcement: an online marketplace was penalised for missing or hard-to-find seller disclosures and suspicious-activity reporting on third-party listings, including listings inside its app.
published 2025-09-05 · verified 2026-10-07
ev-0108regulatorprimary
Informing Businesses about the INFORM Consumers Act, U.S. Federal Trade Commission
Online marketplaces must verify the information they get from high-volume third party sellers.
FTC guidance sets the duty for a marketplace to collect, verify and disclose high-volume third-party seller details to deter stolen, counterfeit or unsafe goods, which is the fake-seller risk of this product type.
published undated · verified 2026-10-07
ev-0109regulatorprimary
FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data for Advertising, Requiring It to Pay [amount], Federal Trade Commission
Final FTC order against an online counseling service that sent email addresses, IP addresses and health questionnaire answers to ad platforms after promising privacy. Supports data-breach and regulatory-penalty for mental health apps whose intake questionnaire reveals the user's condition, and for telemedicine apps that run the same intake before a therapy visit.
published 2023-07-14 · verified 2026-10-07
ev-0111regulatorprimary
FTC Finalizes Changes to the Health Breach Notification Rule, Federal Trade Commission
FTC rule update stating that health apps outside HIPAA are covered and that an unauthorized disclosure of identifiable health information counts as a breach that must be notified. Supports regulatory-penalty and data-breach for mental health apps and fitness apps that sell direct to consumers, and wearable companion apps, since the FTC ties the update to health apps and connected devices.
published 2024-04-26 · verified 2026-10-07
ev-0112court-or-fineprimary
TSB fined [amount] for operational resilience failings, Bank of England (Prudential Regulation Authority)
This resulted in significant disruption to the continuity of TSB's banking services, including branch, telephone, online and mobile banking.
Joint PRA and FCA penalty after a platform migration left customers unable to use mobile and online banking and the bank failed to manage risk from its critical third-party IT supplier. Supports dependency-failure and regulatory-penalty for a bank's mobile app; transfers to neobanks that run on an outsourced core banking platform.
published 2022-12-20 · verified 2026-10-07
ev-0113court-or-fineprimary
FCA fines RBS, NatWest and Ulster Bank Ltd [amount] for IT failures, Financial Conduct Authority
When it noticed problems with the upgrade it decided to uninstall it without first testing the consequences of that action.
FCA penalty after a batch software upgrade and untested rollback left customers unable to use online banking or see accurate balances, with incorrect interest applied and inaccurate statements. Supports data-corruption and regulatory-penalty for banking apps that display balances and interest from the core ledger.
published 2014-11-20 · verified 2026-10-07
ev-0117court-or-fineprimary
FCA fines Monzo [amount] for failings in financial crime controls, Financial Conduct Authority
FCA penalty against an app-only bank whose financial crime controls did not keep pace with customer growth and which onboarded customers on obviously implausible details, such as London landmarks as an address. Supports fraud-abuse and regulatory-penalty for neobank in-app onboarding.
published 2025-07-08 · verified 2026-10-07
ev-0118court-or-fineprimary
FCA fines Starling Bank [amount] for failings in their financial crime systems and controls, Financial Conduct Authority
FCA penalty against an app-only bank whose automated sanctions screening system had been checking customers against only part of the sanctions list, and which opened accounts for high-risk customers despite a restriction. Supports regulatory-penalty for neobank automated onboarding and screening.
published 2024-10-02 · verified 2026-10-07
ev-0121court-or-fineprimary
Block, Inc. (CFPB enforcement action), Consumer Financial Protection Bureau
CFPB order finding the operator of a peer-to-peer payment app failed to prevent, detect and address fraud on the platform and used the card network chargeback process in place of its own investigation of unauthorised transfer disputes. Supports fraud-abuse and money-loss for P2P payment apps.
published 2025-01-16 · verified 2026-10-07
ev-0140regulatorprimary
21 U.S. Code 829: Prescriptions, Legal Information Institute, Cornell Law School (U.S. Code text)
No controlled substance that is a prescription drug as determined under the Federal Food, Drug, and Cosmetic Act may be delivered, distributed, or dispensed by means of the Internet without a valid prescription.
The Ryan Haight provision in subsection (e) makes internet delivery of a controlled substance without a valid prescription unlawful, which applies directly to any app that takes and delivers prescription orders. Subsection (b) also bars filling or refilling schedule III and IV prescriptions past the time and refill limits it sets unless the practitioner renews them.
published undated · verified 2026-10-07
ev-0142regulatorprimary
Proposed FTC Order will Prohibit Telehealth Firm Cerebral from Using or Disclosing Sensitive Data for Advertising Purposes, and Require it to Pay [amount], U.S. Federal Trade Commission
The FTC complaint describes pharmacy and prescription information sent to third parties through tracking tools, a patient portal access method that exposed medications to other patients, a failure to block former employees from accessing medical records, and a cancel-anytime promise contradicted by a multi-step, often multi-day cancellation process during which consumers kept being charged. The first two transfer to pharmacy delivery apps; the cancellation finding transfers to any recurring subscription sold online.
published 2024-04-15 · verified 2026-10-07
ev-0158regulatorprimary
Dutch DPA imposes a fine of [amount] on Uber because of transfers of drivers' data to the US, Autoriteit Persoonsgegevens
It concerns account details and taxi licences, but also location data, photos, payment details, identity documents, and in some cases even criminal and medical data of drivers.
GDPR fine for storing European driver onboarding data on US servers without a transfer tool. Supports regulatory-penalty for ride-hailing apps that collect driver licences, background checks and location.
published 2024-08-26 · verified 2026-10-07
ev-0167regulatorprimary
Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, U.S. Food and Drug Administration
FDA guidance on cybersecurity design, labeling and premarket documentation for devices with cybersecurity risk, including section 524B cyber devices. Supports data-breach (by design) and regulatory-penalty for SaMD that connects to phones, clouds or networks.
published undated · verified 2026-10-07
ev-0168standardprimary
IEC 62304:2006 - Medical device software - Software life cycle processes, International Organization for Standardization / International Electrotechnical Commission
Life cycle standard for medical device software, covering development, verification and maintenance processes. Supports regulatory-penalty for SaMD that must show documented verification to a regulator.
published undated · verified 2026-10-07
ev-0169regulatorprimary
FTC Secures Historic [amount] Settlement Against Amazon, U.S. Federal Trade Commission
The process cannot be difficult, costly, or time-consuming and must be available using the same method that consumers used to sign up.
The FTC settled charges that a retailer enrolled shoppers in a paid recurring membership through confusing checkout screens and made cancellation hard; the order sets the enrolment-consent and same-channel cancellation rules any recurring delivery subscription is tested against.
published 2025-09-25 · verified 2026-10-07
ev-0170regulatorprimary
Alcohol Addiction Treatment Firm will be Banned from Disclosing Health Data for Advertising to Settle FTC Charges that It Shared Data Without Consent, Federal Trade Commission
Monument used the information to target ads for its services to both current users who subscribe to the lowest cost memberships and to target new consumers, according to the complaint.
Enforcement against an online alcohol use disorder treatment service whose pixels and APIs sent intake and treatment events to ad platforms without consent. Supports data-breach and regulatory-penalty for telemedicine apps and for mental health apps, which collect the same kind of intake answers.
published 2024-04-11 · verified 2026-10-07
ev-0174regulatorprimary
Special Registrations for Telemedicine and Limited State Telemedicine Registrations, Drug Enforcement Administration, Federal Register
DEA proposed rule setting registrations for clinicians who prescribe controlled substances over telemedicine and for online platforms that facilitate dispensing. Supports regulatory-penalty for telemedicine apps that route controlled-substance prescriptions; the rule is proposed, so the note in the cell must not present it as final.
published 2025-01-17 · verified 2026-10-07
ev-0179regulatorprimary
16 CFR 464.1: Definitions (Rule on Unfair or Deceptive Fees), Federal Trade Commission (16 CFR Part 464, text via Cornell Legal Information Institute)
The federal fee rule names live-event tickets and short-term lodging as the covered goods, and its section 464.2 requires the total price to be shown with any advertised price. Applies to an event ticketing platform and to a travel booking app that sells hotel stays.
published undated · verified 2026-10-07
ev-0181court-or-fineprimary
Robinhood Financial LLC Letter of Acceptance, Waiver and Consent, FINRA
During the March outage, all of Robinhood's customers were unable to trade.
Supports outage-under-load, wrong-decisions and regulatory-penalty for a stock trading app: the regulator found a retail brokerage app went down during the March 2020 market volatility, showed customers inflated negative cash balances and approved options accounts through automated approval bots with limited oversight.
published 2021-06-30 · verified 2026-10-07
ev-0182court-or-fineprimary
Robinhood Financial provided customers with inaccurate or incomplete disclosures regarding its practice of 'collaring' market orders by converting them to limit orders.
Supports money-loss and regulatory-penalty for a stock trading app: market orders converted to limit orders were cancelled, customers re-entered them at worse prices and the firm paid restitution for the order-handling behavior it had not disclosed.
published 2025-03-07 · verified 2026-10-07
ev-0187regulatorprimary
Online hotel booking, Competition and Markets Authority
UK enforcement case that ended with formal undertakings from hotel booking sites on search ranking influenced by commission, pressure selling about room availability, misleading discount claims and fees added after the first price. Supports regulatory-penalty for a travel booking app.
published undated · verified 2026-10-07
ev-0188regulatorprimary
Warning Letter: Owlet Baby Care, Inc. (MARCS-CMS 616354), U.S. Food and Drug Administration
FDA treated a wearable sock and its oxygen and heart-rate notifications to parents as an uncleared medical device, so the alerts a companion app shows can turn a consumer wearable into a regulated product.
published 2021-10-05 · verified 2026-10-07
ev-0215regulatorprimary
Federal Reserve Board fines Citigroup for violating the Board’s 2020 enforcement action, Board of Governors of the Federal Reserve System
Citigroup has made insufficient progress remediating its problems with data quality management and failed to implement compensating controls to manage its ongoing risk.
Regulator fine for unremediated data quality management problems. Supports regulatory-penalty for data pipelines that feed regulated reporting.
published 2024-07-10 · verified 2026-10-07
ev-0219regulatorprimary
Intention to issue [amount] fine to Grindr LLC, Datatilsynet (Norwegian Data Protection Authority)
Grindr has shared user data to a number of third parties without legal basis.
Supports regulatory-penalty for a dating app: the regulator found that GPS location, profile data and the fact of using a dating app for gay and bisexual men went to ad partners without valid consent. Notice of intent, not the final decision.
published 2021-01-26 · verified 2026-10-07
ev-0221regulatorprimary
FTC Requires Zoom to Enhance its Security Practices as Part of Settlement, Federal Trade Commission
The FTC also alleged that the company compromised the security of some users when it secretly installed software, called a ZoomOpener web server, as part of a manual update for its Mac desktop application in July 2018.
Regulator order: a Mac desktop app update installed a hidden local web server that bypassed a browser safeguard, stayed after the app was deleted and could reinstall it. The order also states the company advertised end-to-end encryption it did not provide and said cloud recordings were encrypted when some were stored unencrypted on its servers before transfer. Supports regulatory-penalty and data-breach for desktop applications and video conferencing tools.
published 2020-11-09 · verified 2026-10-07
ev-0225regulatorprimary
15 U.S.C. 7001: General rule of validity (ESIGN Act), U.S. Government Publishing Office
Statute text: before an electronic record replaces a paper notice to a consumer, the consumer must get a disclosure of hardware and software requirements, the right to a paper copy and the right to withdraw consent. Supports regulatory-penalty for e-signature services used in consumer transactions.
published undated · verified 2026-10-07
ev-0235regulatorprimary
23 CFR Part 680: National Electric Vehicle Infrastructure Standards and Requirements, U.S. Federal Highway Administration (eCFR)
The price for charging must be displayed prior to initiating a charging transaction and be based on the price for electricity to charge in $/kWh.
The US rule for federally funded chargers requires price shown before a session starts, payment methods accessible to people with disabilities, OCPP between charger and network, network-to-network roaming and real-time port status for third-party apps.
published undated · verified 2026-10-07
ev-0236regulatorprimary
The Public Charge Point Regulations 2023, UK Government (legislation.gov.uk)
The UK regulations for public charge points set contactless payment, payment roaming, reliability, a helpline, open charge point data and price transparency, with an enforcement schedule, so the driver app and its data feed fall in scope.
published undated · verified 2026-10-07
ev-0238regulatorprimary
The Public Charge Point Regulations 2023, regulation 7: Reliability of rapid charge points, UK Government (legislation.gov.uk)
The charge point operator must publish information on its compliance with the reliability requirement on its website.
Reliability is measured from each charger's reported status (inoperative or out of order), so the status shown and published by the operator is a regulated figure, not a convenience.
published undated · verified 2026-10-07
ev-0240regulatorprimary
Specific data protection considerations for different ways or methods of monitoring workers, Information Commissioner's Office (UK)
You must inform workers and passengers of any vehicle monitoring.
The UK regulator states that monitoring work vehicles during private use is rarely justified and gives the example of a tracker the driver can switch off outside work, which a fleet platform has to support.
published undated · verified 2026-10-07
ev-0241regulatorprimary
49 CFR Part 395 Subpart B: Electronic Logging Devices (ELDs), U.S. Federal Motor Carrier Safety Administration (eCFR)
Edits requested by any system or by any person other than the driver must require the driver's electronic confirmation or rejection.
Applies where the fleet platform provides electronic logging of drivers' hours: the rule requires accurate records, annotated edits confirmed by the driver, and recorded malfunctions and data diagnostic events.
published undated · verified 2026-10-07
ev-0251regulatorprimary
FTC Charges Twitter with Deceptively Using Account Security Data to Sell Targeted Ads, Federal Trade Commission
Twitter asked users to give their phone numbers and email addresses to protect their accounts.
Regulator action: phone numbers and emails collected for two-factor authentication and account recovery were used for ad targeting, breaching an earlier order. Transfers to identity providers, which collect the same MFA and recovery data for their customers' users.
published 2022-05-25 · verified 2026-10-07
ev-0255regulatorprimary
D-Link Agrees to Make Security Enhancements to Settle FTC Litigation, U.S. Federal Trade Commission
The FTC settlement with a router and camera maker cites hard-coded device credentials and mobile app login data stored in clear text, and requires testing for vulnerabilities before release and automatic firmware updates.
published 2019-07-02 · verified 2026-10-07
ev-0256regulatorprimary
The UK Product Security and Telecommunications Infrastructure (Product Security) regime, UK Government (GOV.UK)
The UK regime sets minimum security requirements that connectable consumer products must meet before they are made available in the UK, with duties on manufacturers, importers and distributors, including that passwords are unique per product or set by the user and that the minimum security update period is published.
published undated · verified 2026-10-07
ev-0262court-or-fineprimary
Apitor (FTC case), Federal Trade Commission
The FTC reached a settlement with Apitor Technology over allegations that its app enabled a third party in China to collect geolocation information from children without parental consent.
Supports regulatory-penalty and data-breach for a kids app: the companion app of a children's toy let a third party collect children's location without parental consent.
published undated · verified 2026-10-07
ev-0263court-or-fineprimary
Fortnite Video Game Maker Epic Games to Pay More Than Half a Billion Dollars over FTC Allegations of Privacy Violations and Unwanted Charges, Federal Trade Commission
Children and teens have been bullied, threatened, harassed, and exposed to dangerous and psychologically traumatizing issues such as suicide while on Fortnite.
Supports user-harm for a kids app with chat or multiplayer: the FTC tied harm to children to voice and text chat being on by default, tied unwanted charges to confusing purchase buttons, including purchases triggered when waking the game from sleep, on a loading screen or while previewing an item, and found personal information collected from children under 13 without notifying parents or getting their consent.
published 2022-12-19 · verified 2026-10-07
ev-0267court-or-fineprimary
FTC and DOJ Charge Amazon with Violating Children’s Privacy Law by Keeping Kids’ Alexa Voice Recordings Forever and Undermining Parents’ Deletion Requests, Federal Trade Commission
Supports regulatory-penalty for a language learning app with child learners and for a kids app: the FTC charged retention of children's voice recordings and failure to honour parents' deletion requests under COPPA, which applies to speech exercises that record a child.
published 2023-05-31 · verified 2026-10-07
ev-0269regulatorprimary
Artificial intelligence: stop to ChatGPT by the Italian SA, Garante per la protezione dei dati personali
A data breach affecting ChatGPT users’ conversations and information on payments by subscribers to the service had been reported on 20 March.
The Italian data protection authority limited a chat assistant over a breach of user conversations, no legal basis for training on personal data, inaccurate personal data in answers and no age check for children.
published 2023-03-31 · verified 2026-10-07
ev-0270regulatorprimary
FTC Announces Crackdown on Deceptive AI Claims and Schemes, U.S. Federal Trade Commission
The complaint alleges that the company did not conduct testing to determine whether its AI chatbot’s output was equal to the level of a human lawyer, and that the company itself did not hire or retain any attorneys.
The FTC acted against a chatbot marketed as a substitute for a lawyer that had not been tested against that claim, so untested quality claims about assistant output are an enforcement risk.
published 2024-09-25 · verified 2026-10-07
ev-0281court-or-fineprimary
Edmodo, LLC, U.S. v., Federal Trade Commission
Supports regulatory-penalty for a learning management system used by schools and for a kids app: the FTC order covers collecting children's data without parental consent, using it for advertising and pushing COPPA consent duties onto schools.
published undated · verified 2026-10-07
ev-0284regulatorprimary
Data Protection Commission announces decision in WhatsApp inquiry, Data Protection Commission (Ireland)
The DPC's investigation examined whether WhatsApp has discharged its GDPR transparency obligations with regard to the provision of information and the transparency of that information.
Supports regulatory-penalty for a messaging app: the inquiry covered what a chat app tells users and non-users about processing of their data, including sharing with group companies.
published 2021-09-02 · verified 2026-10-07
ev-0288regulatorprimary
Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards, Federal Trade Commission
Test, assess, measure, document, or inquire about the accuracy of its facial recognition technology before deploying it
Regulator order: a face-matching model flagged shoppers as suspects with more false positives in some communities, nobody tracked the false-positive rate, and employees acting on false-positive alerts followed, searched or removed shoppers. Supports wrong-decisions, user-harm and regulatory-penalty for model services.
published 2023-12-19 · verified 2026-10-07
ev-0289regulatorprimary
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms, Consumer Financial Protection Bureau
Creditors who use complex algorithms, including artificial intelligence or machine learning, in any aspect of their credit decisions must still provide a notice that discloses the specific principal reasons for taking an adverse action.
Regulator rule interpretation: a lender using a model score must still give specific reasons for each denial. Supports regulatory-penalty for model services whose scores feed credit decisions.
published 2022-05-26 · verified 2026-10-07
ev-0297regulatorprimary
FTC Order Prohibits Data Broker X-Mode Social and Outlogic from Selling Sensitive Location Data, Federal Trade Commission
X-Mode/Outlogic sells and licenses precise location data that it collects from third-party apps that incorporate its software development kit (SDK) into their apps, from its own mobile apps, and by purchasing location data from other data brokers and aggregators.
Regulator order: the SDK maker gave host apps sample privacy disclosures that did not tell users how their location would be used. Supports regulatory-penalty and data-breach for mobile SDKs that collect location.
published 2024-01-09 · verified 2026-10-07
ev-0319regulatorprimary
Irish Data Protection Commission announces [amount] fine of TikTok, Data Protection Commission (Ireland)
The Irish regulator found infringements in how a social video platform processed children's data, including public-by-default settings, the family pairing feature and age verification at registration.
published 2023-09-15 · verified 2026-10-07
ev-0321regulatorprimary
Online Safety Act 2023, UK Government (legislation.gov.uk)
The Act places duties of care on user-to-user services, including illegal content and children's risk assessments, overseen by the UK communications regulator.
published undated · verified 2026-10-07