US Companies Set to Pay $1.4 Billion in Privacy Settlements Over Web and App Tracking, up 36% From 2025

• Privado AI's 2026 Website & App Privacy Litigation Report analyzed 116 US class action settlements and found the average payout now stands at $6.7 million, with lawsuits up 18-fold since 2022, from around 200 filings to a projected 3,500 this year
• The Federal Wiretap Act appears in 53% of 2026 settlements and a 1967 California law in 43%, more than double its 2025 share. California's SB 690 reform is unlikely to change that
• Meta's advertising pixel was named in 91% of settlements that identified a tracker; healthcare companies account for 64% of settlements, while payouts by technology companies are the largest, averaging $26.8 million

NEW YORK--(BUSINESS WIRE)--New research from Privado AI, the agentic privacy platform, finds that US companies are on track to pay more than $1.4 billion in 2026 to settle claims that their websites and mobile apps shared personal data without proper consent, an increase of 36% from 2025.

The 2026 Website & App Privacy Litigation Report from Privado AI analyzes 116 publicly disclosed class action settlements reached between January 2025 and August 2026, alongside litigation volumes since 2022. The average settlement in 2026 is $6.7 million, up 12% on 2025. Lawsuit filings have risen from an estimated 200 in 2022 to a projected 3,500 this year.

The 116 settlements analyzed are likely a fraction of the total claims companies are resolving. A prominent law firm estimates 50,000 to 100,000 claims were made between 2022 and 2025, with the majority of demand letters settled privately.

Vaibhav Antil, CEO of Privado AI, said, “Privacy claims are rising fast. Most of the companies facing litigation had a consent management platform in place, and they are not as covered as they thought. The 116 public settlements we have analyzed in our report are the tip of the iceberg. It’s estimated there were as many as 100,000 privacy claims against companies between 2022 and 2025. Many will have settled privately, so the real cost to companies is likely far higher than the $1.4 billion paid out in public class action settlements.”

Pre-internet wiretapping laws, not the new privacy laws, are driving settlements

The Federal Wiretap Act, passed in 1968, appears in 53% of 2026 settlements. The California Invasion of Privacy Act (CIPA), passed in 1967 to stop the covert recording of phone calls, appears in 43%, up from 20% in 2025. Wiretapping laws let any individual sue and set fixed damages per violation; the state privacy laws written for the internet, including California's CCPA, can be enforced only by regulators.

California's SB 690 reform, signed into law on September 30^th 2026, and set to take effect on January 1^st 2027, stops tracking claims under one CIPA provision, Section 638.51. Only 3% of the 116 settlements used it. Of settlements citing CIPA, 88% relied on the wiretapping provision, Section 631, which the reform leaves intact.

Healthcare pays most often; apps pay more

Healthcare companies account for 64% of settlements. Technology companies pay the most on average, $26.8 million, a figure driven by two large Google settlements.

Every settlement reached in 2025 involved a website. In the first eight months of 2026, 8% involved a mobile app alone, and settlements referencing an app-tracking allegation paid 3.5 times more than website-only cases. Meta’s advertising pixel is named in 91% of settlements that named third-party trackers.

New trackers are appearing

Independent security research published in September 2026 found a cookie set by OpenAI recording free-tier ChatGPT users’ activity across more than 1,000 merchant websites, while OpenAI’s cookie policy classifies the tracker as analytics, not marketing. The OpenAI cookie works in the same way as the Meta pixel.

Antil added, “Consent tools don’t prove compliance, and a plaintiff’s lawyer needs little more than a browser to find evidence that a site has failed to honor a visitor's choice. At $6.7 million on average per settlement, a business has to catch every pixel, tag and data flow before it turns into a demand letter. Every company needs a proper website governance program, so they can safely add a new ad channel and increase revenue, without compromising on user privacy and increasing their risk of litigation.”

Privado AI’s Web Auditor and App Auditor scan and monitor live websites and apps continuously and record whether each visitor's consent choice is being honored.

Report Methodology

For the 2026 Website & App Privacy Litigation Report, Privado AI reviewed all publicly available website and app privacy class action settlements with an agreement date between January 1, 2025 and August 31, 2026, capturing the defendant, settlement amount, statutes alleged, website versus app tracking and third-party trackers named. The 76 settlements from 2025 represented 43% of the estimated 175 settlements agreed that year; the 40 from 2026 represented 29% of the estimated 140 agreed through August. Litigation volume estimates were drawn from Duane Morris research, americanbar.org, hipaajournal.com and claimdepot.com. Figures for 2026 are annualized from filings and settlements recorded through August. Annual settlement totals are estimates: the estimated number of settlements agreed in the year multiplied by the mean settlement amount.

Read the full report here.

Webinar

Privado AI will host a webinar on the 2026 Website & App Privacy Litigation Report on October 14, 2026, at 08:00 am Pacific / 11:00 am Eastern.

Vaibhav Antil, CEO of Privado AI, will be joined by Privado AI’s Founding Product Manager, Romit Raj and Matthew Pearson, Partner at Frankfurt Kurnit.

Sign up for the webinar here.

About Privado AI

Privado AI is the agentic privacy platform. With AI agents and real-time software scanning designed for privacy teams, Privado AI automates manual compliance work, delivers complete personal data visibility, and helps eliminate privacy risk, accelerating enterprise productivity as a result. As technology has outpaced manual privacy controls, Privado AI has built AI-native solutions to automate risk discovery, assessments, and data maps. It prevents website and app privacy violations with automated audits that verify consent compliance, populates entire assessments with agents that analyze documentation, contracts, and data flows, and builds dynamic data maps by scanning web, app, backend, and third-party software. Founded in 2020 and based in New York, New York, Privado AI is trusted by enterprise and SMB companies around the world, including Riot Games, Principal Financial Group, Virgin Voyages, and HERE Technologies.