How Peeky scans your site, from address to report

No case file matches all of those. Clear one filter to see more.

• Case 009CMA (United Kingdom), 2026

  Countdown timers and high-demand messages found misleading

  The CMA said Emma Sleep admitted breaking consumer law by using misleading countdown timers, false high-demand messages and discount claims on its website. A High Court order of 22 May 2026 confirmed the CMA's position.

  Emma Sleep, United Kingdom · Undertakings to the court

  Emma Sleep gave binding undertakings, enforceable by the court, to stop these practices and put compliance measures in place. The was/now pricing part of the case was due at trial from early June 2026.

  Read the authority's publicationRead the wiki entry

• Case 004Garante (Italy), 2025

  Cookie banner reappeared after visitors closed it

  The Garante inspected the company's website, confalonieriauto.it. It found a cookie banner that came back after a visitor clicked X and did not let users give specific, informed consent to non-technical cookies, and a privacy policy that lacked detail on tracking tools.

  Confalonieri S.r.l., Italy · No fine: reprimand

  The Garante issued a formal warning and an order to comply, with no fine.

  Read the authority's publicationRead the wiki entry

• Case 018FTC (United States), 2025

  Alleged: Children's location data collected without parental consent

  The FTC alleged that China-based Apitor, which sells robot toys for children aged 6 to 14, did not notify parents or get their consent before it, or a third party, collected children's location data. The complaint says the app included a third-party software kit called JPush.

  Apitor Technology, China · $500,000, suspended

  A proposed order filed in federal court would require parental notice and consent, with a $500,000 penalty suspended because of the company's inability to pay.

  Read the authority's publicationRead the wiki entry

• Case 020FTC (United States), 2025

  Alleged: Hosting security tools missing despite award-winning security claims

  The FTC alleged that GoDaddy claimed to provide award-winning security while not using multi-factor authentication, not monitoring for security threats and not securing connections to consumer data.

  GoDaddy Inc., United States · Order to fix

  The FTC finalized an order requiring a comprehensive security program, independent assessments and no misrepresentation of its security.

  Read the authority's publicationRead the wiki entry

• Case 017FTC (United States), 2024

  Alleged: Health data shared with ad platforms through tracking pixels

  The FTC alleged that Monument, a New York-based alcohol addiction treatment service that told users their information was 100% confidential, disclosed health details to Meta, Google and other ad platforms through tracking pixels. According to the complaint, as many as 84,000 users were affected.

  Monument, Inc., United States · $2.5 million, suspended

  Under a proposed order that needs federal court approval, Monument would be banned from disclosing health information for advertising. A $2.5 million civil penalty would be suspended because of its inability to pay.

  Read the authority's publicationRead the wiki entry

• Case 019US Department of Justice (United States), 2022

  Alleged: Vaccine portal barriers for screen reader and keyboard users

  After a compliance review, the Justice Department determined that parts of CVS's vaccine registration portal were not accessible to some people with disabilities. Screen reader users met incorrectly labeled form fields, and people not using a mouse would need to press the Tab key hundreds of times to move past one control. CVS denied wrongdoing.

  CVS Pharmacy, Inc., United States · No payment stated

  CVS agreed to bring its vaccine content to WCAG 2.1 AA and to test it regularly.

  Read the authority's publicationRead the wiki entry

• Case 026CMA (United Kingdom), 2026

  Gym joining fee left out of the membership price shown first

  The CMA found that the gym's website showed annual and Direct Debit membership prices without the mandatory joining fee, £50 or £10, or showed the total in a way that was unclear and unlikely to be seen. On one version of the site the total with the fee appeared only at the payment page, after customers had entered their details. The company admitted the conduct and settled.

  Gold's Gym (UK) Limited, United Kingdom · £45,000, plus £9,220 in refunds

  The CMA gave a Final Infringement Notice on 29 September 2026 with a penalty of £45,000 after a 40% settlement reduction, and ordered the £9,220 in joining fees refunded to 726 customers. The company reports to the CMA on the refunds over the following year.

  Read the authority's publicationRead the wiki entry

• Case 003Garante (Italy), 2025

  Promotional emails sent without documented consent

  The Garante found that the company could not document valid consent for promotional emails sent through partner portals, where consent was recorded only through IP logs. A rights request from the complainant was first blocked by the company's spam filter.

  Noi Compriamo Auto S.r.l., Italy · €45,000

  The Garante fined the company €45,000.

  Read the authority's publicationRead the wiki entry

• Case 005ANSPDCP (Romania), 2024

  Cookies installed before consent, operator identity not shown

  After a complaint, the ANSPDCP found that the company's website did not show the identity of the operator and installed cookies that were not technically necessary before users gave consent.

  Urban Home Development S.R.L., Romania · 10,000 lei

  The authority fined the company 10,000 lei under the e-communications law, issued a warning under the GDPR and ordered the privacy policy and cookie setup corrected.

  Read the authority's publicationRead the wiki entry

• Case 016FTC (United States), 2019

  Alleged: Paid reviews posted on Amazon for a supplement

  The FTC alleged that the supplement seller and its owner paid a website, amazonverifiedreviews.com, to create and post Amazon reviews of their garcinia cambogia product. It also alleged the weight-loss claims were unsubstantiated.

  Cure Encapsulations, Inc., United States · $12.8 million judgment, suspended on payment of $50,000

  The company and its owner settled under a proposed court order, with a $12.8 million judgment suspended on payment of $50,000 and unpaid taxes.

  Read the authority's publicationRead the wiki entry

• Case 006ICO (United Kingdom), 2026

  Millions of marketing texts sent without valid consent

  The ICO found that the Newcastle-upon-Tyne company sent 4,046,947 marketing text messages between February 2023 and February 2024 promoting PPI tax refund services. The messages lacked valid consent and did not meet the soft opt-in rules.

  Allay Claims Ltd, United Kingdom · £120,000

  The ICO fined the company £120,000.

  Read the authority's publicationRead the wiki entry

• Case 007ICO (United Kingdom), 2026

  Marketing emails sent on third-party data without informed consent

  The ICO found that the Bristol company sent 67,772,285 marketing emails between January and July 2023 using third-party data. Recipients had not been given properly informed consent.

  ZMLUK Limited, United Kingdom · £105,000

  The ICO fined the company £105,000.

  Read the authority's publicationRead the wiki entry

• Case 008ICO (United Kingdom), 2026

  Debt-solution texts sent to millions without valid consent

  The ICO found that the Manchester company sent more than 5.5 million marketing texts between April 2022 and May 2025 promoting debt solutions. Some used the sender ID DEMAND, and the messages drew more than 60,000 complaints.

  KRA Consultancy Ltd, United Kingdom · £300,000

  The ICO fined the company £300,000.

  Read the authority's publicationRead the wiki entry

• Case 015FTC (United States), 2026

  Alleged: Employee and incentivised reviews presented as customer reviews

  The FTC alleged that TruHeight relied on reviews written by its own employees and vendors, or by consumers offered a free product or discount for a 5-star review. According to the complaint, it also used fake social media profiles run by bots.

  Vanilla Chip LLC (TruHeight), United States · $4 million judgment, $750,000 payable

  The FTC's final order, approved in July 2026, bars the company and its principals from misrepresenting reviews and buying reviews tied to a sentiment, with a $4 million judgment partially suspended after $750,000 is paid.

  Read the authority's publicationRead the wiki entry

• Case 023Garante (Italy), 2026

  Marketing emails sent to people who never confirmed their account

  The Garante found that when people began signing up on altroconsumo.it and chose not to confirm the account, the company still treated the contract as made and sent them promotional emails. It also found the company slow to answer requests from people exercising their rights.

  Altroconsumo Edizioni S.r.l., Italy · €280,000

  The Garante fined Altroconsumo Edizioni €280,000 in a decision of 18 June 2026, announced on 29 July 2026, and ordered it to stop processing the data of people who never confirmed an account and to bring its procedures into line with the GDPR.

  Read the authority's publicationRead the wiki entry

• Case 028CPPA (California, United States), 2026

  Alleged: An email confirmation step before an opt-out counted

  According to the agency's decision, after a visitor sent Ford's privacy rights form the site showed a further step and emailed the person to confirm their email and identity. From July 2023 to March 2024 opt-out requests from people who did not click were marked as expired, dozens were not processed in time, and selling or sharing continued for them. Ford neither admitted nor denied the findings.

  Ford Motor Company, United States · $375,703

  The CPPA Board adopted a stipulated order on 27 February 2026 with a $375,703 fine. Ford must offer opt-outs with minimal steps and no verification, audit the tracking technologies on its website so they honour Global Privacy Control, and confirm in writing within 90 days.

  Read the authority's publicationRead the wiki entry

• Case 013California Attorney General (United States), 2024

  Alleged: Customer data sold to marketing cooperatives without notice

  The California Attorney General said its investigation found that DoorDash sold customers' names, addresses and transaction histories through marketing cooperatives. The complaint alleges its privacy policy did not state that this information was disclosed.

  DoorDash, United States · $375,000

  DoorDash agreed to pay a $375,000 civil penalty, review vendor contracts and report annually to the Attorney General.

  Read the authority's publicationRead the wiki entry

• Case 022CNIL (France), 2026

  Basic security measures missing before data on 24 million contracts was reached

  After an intruder reached data on 24 million subscriber contracts in October 2024, the CNIL found that the VPN used for remote work lacked robust authentication and that the tools for spotting unusual activity were ineffective (Article 32 GDPR). The email telling customers about the incident left out information they needed (Article 34), and Free Mobile kept former subscribers' data too long.

  Free Mobile and Free, France · €42 million

  In January 2026 the CNIL fined Free Mobile €27 million and Free €15 million, ordered both to finish their new security measures within three months and ordered Free Mobile to finish sorting and deleting old data within six months.

  Read the authority's publicationRead the wiki entry

• Case 024CMA (United Kingdom), 2026

  Daily deals and flash deals still on offer after the countdown ended

  The CMA found that products advertised as Daily Deals and 24-hour Flash Deals, with countdown timers and messages such as "Here Today, Gone Tomorrow", often stayed available at the same price or lower after the stated deadline. Wayfair admitted the conduct and settled.

  Wayfair Stores Limited, United Kingdom · £4.8 million

  The CMA gave a Final Infringement Notice on 12 October 2026 with a penalty of £4.8 million, which includes a 40% reduction for settling early. Wayfair agreed not to appeal.

  Read the authority's publicationRead the wiki entry

• Case 025CMA (United Kingdom), 2026

  Paid delivery extras added by default, and discount countdowns that kept coming back

  The CMA found that customers were automatically opted into paid old-appliance removal, installation on delivery, or both, without choosing them. Countdown banners on some product pages offered £10 to £25 off for a limited time, but the same discount codes appeared again over many days. The company admitted the conduct and settled.

  Buy It Direct Ltd (Appliances Direct), United Kingdom · £1.2 million, plus about £432,000 in refunds

  The CMA gave a Final Infringement Notice on 12 October 2026 with a penalty of £1.2 million, including a 40% reduction for settling, and ordered around £432,000 in refunds to customers opted in between 6 April and 17 November 2025, about £25 each on average.

  Read the authority's publicationRead the wiki entry

• Case 027California Attorney General (United States), 2026

  Alleged: Opt-outs that stopped at one service or one device

  The California Attorney General said its investigation found that the opt-out toggle on Disney's websites and apps applied only to the streaming service being watched and often only to that device, that its webform stopped sharing through Disney's own ad platform while selling and sharing with certain third-party ad-tech companies whose code was embedded continued, and that Global Privacy Control was applied only to the device that sent it, even for logged-in users.

  Disney DTC, LLC and ABC Enterprises, Inc., United States · $2.75 million

  Disney agreed to a stipulated judgment with $2.75 million in civil penalties, without admitting liability. Opt-outs, Global Privacy Control included, must apply across the services tied to an account, third parties must be told, and a three-year monitoring programme reports to the Attorney General every year.

  Read the authority's publicationRead the wiki entry

• Case 029CPPA (California, United States), 2026

  Alleged: A banner with only an Agree button over the ticket

  According to the agency's decision, the GoFan ticketing site's banner named trackers such as the Meta Pixel and offered only an Agree button, which on a phone covered the part of the screen used to show a ticket. The only opt-out routes were a phone number and an email address that did not reach the trackers, opt-out preference signals were not recognised, and the privacy policy said the company did not sell personal information.

  2080 Media, Inc. (PlayOn Sports), United States · $1.10 million

  The CPPA Board adopted a stipulated order on 27 February 2026 with a $1.10 million fine, crediting changes made in December 2024. The company must carry out risk assessments, set up proper opt-outs and get opt-in consent before selling or sharing the data of 13 to 15 year olds.

  Read the authority's publicationRead the wiki entry

• Case 001CNIL (France), 2025

  Advertising cookies set before visitors chose

  The CNIL found that several cookies, particularly for advertising, were placed on visitors' devices as soon as they arrived on shein.com, even before they interacted with the information banner. It also found that clicking Refuse all, or withdrawing consent, did not stop new cookies being placed.

  Infinite Styles Services Co. Limited (SHEIN), Ireland · €150 million

  The CNIL fined the company €150 million on 1 September 2025.

  Read the authority's publicationRead the wiki entry

• Case 002CNIL (France), 2025

  Refusing advertising cookies took more effort than accepting

  The CNIL found that when users created a Google account, it was more difficult to refuse cookies linked to personalised advertising than to accept them. It also found advertisements displayed between emails in Gmail without prior consent.

  Google LLC and Google Ireland Limited, France · €325 million

  The CNIL fined Google LLC €200 million and Google Ireland Limited €125 million, and ordered changes within six months.

  Read the authority's publicationRead the wiki entry

• Case 010California Attorney General (United States), 2025

  Alleged: Tracking cookies kept running after visitors opted out

  The California Attorney General said its investigation found that Healthline kept sharing data with some advertising third parties even when consumers opted out, and shared article titles suggesting a diagnosis to target ads. The complaint alleges the consent banner did not disable tracking cookies when a box was unchecked.

  Healthline Media LLC, United States · $1.55 million

  Healthline agreed to pay $1.55 million in civil penalties and to change its opt-out and data-sharing practices.

  Read the authority's publicationRead the wiki entry

• Case 012CPPA (California, United States), 2025

  Alleged: Opt-out tools did not honour Global Privacy Control

  According to the agency's decision, Tractor Supply's privacy policy did not notify consumers of their rights, job applicants were not told of their privacy rights, its opt-out mechanism did not work effectively, including for opt-out preference signals such as Global Privacy Control, and personal information was disclosed to other companies without privacy contracts.

  Tractor Supply Company, United States · $1,350,000

  Tractor Supply agreed to pay $1,350,000 to resolve the allegations, scan its digital properties for tracking technologies and have a corporate officer or director certify compliance annually for four years.

  Read the authority's publicationRead the wiki entry

• Case 014FTC (United States), 2025

  Alleged: Subscriptions hard to cancel, charges continued afterwards

  The FTC alleged that Chegg did not give subscribers a simple way to cancel auto-renewing subscriptions. It said that since October 2020 nearly 200,000 consumers were charged after asking to cancel.

  Chegg, Inc., United States · $7.5 million

  Chegg agreed to a proposed order requiring $7.5 million for consumer refunds and simple cancellation mechanisms.

  Read the authority's publicationRead the wiki entry

• Case 021CNIL (France), 2024

  Cookies still read after visitors withdrew consent

  The CNIL found that when visitors to orange.fr accepted cookies and then withdrew their consent, the cookies already stored continued to be read by Orange and its partners, under article 82 of the French Data Protection Act. It also found advertisements in the form of emails shown among real emails in Mail Orange inboxes without consent.

  Orange SA, France · €50 million

  The CNIL fined Orange €50 million on 14 November 2024 and ordered it to stop reading cookies after withdrawal within three months. It closed the order on 11 September 2025. The Conseil d'État rejected Orange's appeal on 16 October 2026 (no. 501268) and found the fine proportionate.

  Read the authority's publicationRead the wiki entry

• Case 011California Attorney General (United States), 2022

  Alleged: Data sale not disclosed, opt-out signals not honoured

  The California Attorney General alleged that Sephora did not tell consumers it was selling their personal information and did not honour opt-out requests sent through Global Privacy Control.

  Sephora, United States · $1.2 million

  Sephora agreed to pay $1.2 million, update its disclosures, support the Global Privacy Control signal and report to the Attorney General.

  Read the authority's publicationRead the wiki entry