US Data Privacy Litigation Report 2026

Understanding how plaintiffs assert their privacy rights, how defendants contest liability, and how the courts interpret and apply privacy laws to new and emerging uses of data and technology is essential for organizations of every shape and size. Increasingly, individuals and certified classes of ordinary citizens are asserting their privacy rights around an assortment of issues at the frontiers of digital governance, from web tracking to data breaches to biometric privacy.

It is critical for organizations to understand recent trends in privacy litigation to better position themselves and adjust compliance practices to reduce enterprise risks stemming from data collection, processing and use. Litigants alleging privacy violations are not only grounding their claims in newer state privacy laws, such as the California Consumer Privacy Act, Washington state's My Health My Data Act and New Jersey's Daniel's Law, but they are also marshalling long-standing privacy statutes like the California Invasion of Privacy Act against modern-day data uses. In sum, this report acknowledges the significance of private litigation and class-action lawsuits in contesting privacy violations in the U.S., tracking the trends and distilling compliance insights.

U.S. courts continue to set new, albeit fragmented, precedents with respect to privacy, which are continuing to cascade throughout the judicial system. As the court explained in Lopez v. Apple, "data privacy law is [a] developing area of law posing inherent risks [meaning] that a new decision could shift the legal landscape as to the certifiability of a class, liability, and damages."

As the analyses in this report demonstrate, the case law emerging from private litigation around data privacy violations adds a new dimension to the enforcement of privacy rights and the demands of compliance. Read comprehensively, the judgments espoused in the cases herein generate legal obligations for businesses that collect, store and share personal information. With each new settlement, dismissal and decision, data privacy continues to be a source of living law, constantly reshaping our understanding of the impact that digital governance has on individual lives and business practices.

The IAPP previously published a 2025 edition of this report.