Breach and Fine Tracker
Menu

Fines and enforcement

FTC data security enforcement explained

Last checked 24 October 2026 · 6 sources

Short answer

The US Federal Trade Commission (FTC) brings data security cases under Section 5 of the FTC Act, which bans unfair or deceptive practices 1. A respondent may settle by signing a consent agreement without admitting liability 1. Civil penalties apply for breaking a final order or certain rules 1. In its 2024 Marriott case the FTC said it lacked authority to obtain civil penalties 2. Since May 2024 non-bank financial firms must report breaches of 500 or more consumers 3.
Main legal basis
FTC Act Section 5 1
Settlement route
Consent agreement, no admission of liability 1
Equifax settlement
At least US$575 million, up to US$700 million 4
Marriott order
20 years of security program certification 2
Safeguards breach reports
500 or more consumers, within 30 days 3

The legal basis

Section 5(a) of the FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful 1. Data security cases rely on it, and on rules such as the Gramm-Leach-Bliley Act Safeguards Rule for financial institutions 4.

The FTC's Bureau of Consumer Protection investigates with civil investigative demands, not subpoenas 1.

How a case moves forward

  • Investigation: civil investigative demands for documents and testimony 1.
  • Complaint: the Commission issues an administrative complaint setting out its charges 1.
  • Consent agreement: the respondent may settle without admitting liability 1.
  • Public comment: a proposed order is published for 30 days before the Commission decides whether to make it final 2.
  • Final order: breaking it makes the respondent liable for a civil penalty for each violation 1.

When the FTC can get money

Money depends on the law used. Violators of certain rules with the required knowledge are liable for civil penalties for each violation 1. The FTC can seek court injunctions under Section 13(b) 1.

The Equifax settlement of 22 July 2019 was joint with the CFPB and the states 4. It was at least US$575 million and up to US$700 million, with US$300 million for a consumer fund, US$100 million in CFPB civil penalties and US$175 million to states 4. About 147 million people were affected by the 2017 breach 4.

In the Marriott and Starwood case of 9 October 2024, the FTC said it lacked legal authority to obtain civil penalties 2. A separate settlement required Marriott to pay US$52 million to 49 states and the District of Columbia 2.

What orders require

The proposed Marriott order covered three breaches between 2014 and 2020 that affected more than 344 million customers worldwide 2. It required an information security program with annual certification to the FTC for 20 years and an independent assessment every two years 2. It added data retention limits and a way for US customers to request deletion 2. The release described it as a proposed settlement 2.

Breach reporting rules

The first enforcement action under the Health Breach Notification Rule was against GoodRx, announced on 1 February 2023 with a US$1.5 million civil penalty, filed by the Department of Justice for the FTC and subject to court approval 5.

On 27 October 2023 the FTC amended the Safeguards Rule to require non-banking financial institutions to report breaches 6. The duty took effect in May 2024 and applies to unauthorized acquisition of unencrypted information of at least 500 consumers, with notice no later than 30 days after discovery 3. The FTC says a report may be made public 3.

Common questions

Can the FTC fine a company for a first data breach?

Not in every case. In the Marriott case the FTC said it lacked authority to obtain civil penalties 2. Penalties apply for breaking final orders or certain rules 1.

Does an FTC consent order mean the company admitted wrongdoing?

No. The FTC says a respondent may sign a consent agreement without admitting liability 1.

How long do FTC data security orders last?

The proposed Marriott order required annual compliance certification for 20 years 2.

Who must report breaches to the FTC?

Non-banking financial institutions under the Safeguards Rule, for breaches involving at least 500 consumers 3.

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.

Sources

  1. FTC: A Brief Overview of the Federal Trade Commission's Investigative, Law Enforcement, and Rulemaking Authority (revised July 2025)
  2. FTC: FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches (9 October 2024)
  3. FTC: FTC Safeguards Rule: What Your Business Needs to Know
  4. FTC: Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach (22 July 2019)
  5. FTC: FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising (1 February 2023)
  6. FTC: FTC Amends Safeguards Rule to Require Non-Banking Financial Institutions to Report Data Security Breaches (27 October 2023)

Related