US privacy claims set to top USD $1.4 billion in 2026

US companies are on course to pay more than USD $1.4 billion in 2026 to settle website and app privacy claims, according to research from Privado AI. That would be 36% more than in 2025.

The report reviewed 116 publicly disclosed class action settlements reached between January 2025 and August 2026. It found the average settlement this year is USD $6.7 million, up 12% from 2025. Lawsuit filings have also climbed sharply, from an estimated 200 in 2022 to a projected 3,500 this year.

Much of the litigation is being brought under older wiretapping laws rather than newer state privacy legislation. The Federal Wiretap Act appeared in 53% of 2026 settlements, while the California Invasion of Privacy Act featured in 43% - more than double its share in 2025.

By contrast, internet-era state privacy laws, including California's CCPA, generally can be enforced only by regulators. The older statutes let individuals sue directly and seek fixed damages for each violation, making them a more common basis for private claims over web and app tracking.

California's SB 690, recently signed into law, is unlikely to materially reduce the volume of these cases, the report found. The measure bars claims under CIPA Section 638.51, but that provision appeared in only 3% of the 116 settlements reviewed. By comparison, 88% of settlements citing CIPA relied on Section 631, which remains unchanged.

Sector split

Healthcare companies accounted for 64% of the settlements in the data set, making the sector the most frequent target. Technology companies, however, recorded the highest average payouts at USD $26.8 million, influenced by two large Google settlements.

The findings also suggest mobile apps are becoming a more expensive area of dispute. Every settlement reached in 2025 involved a website. But in the first eight months of 2026, 8% involved a mobile app alone, and cases involving app-tracking allegations paid 3.5 times more than website-only claims.

Among third-party technologies identified in the cases, Meta's advertising pixel was named in 91% of settlements that specified a tracker. The report said this showed how routine tools used for advertising and analytics can become central evidence in privacy litigation.

A broader estimate of exposure sits well above the published class action figures. A law firm estimate cited in the report suggested that between 50,000 and 100,000 website and app privacy claims were made between 2022 and 2025, with most demand letters settled privately rather than through public court filings.

That means the 116 settlements likely capture only part of the money companies are paying out. Privately resolved claims do not usually disclose settlement values, leaving public class actions as only a partial view of the legal and financial burden.

"Privacy claims are rising fast. Most of the companies facing litigation had a consent management platform in place, and they are not as covered as they thought. The 116 public settlements we have analyzed in our report are the tip of the iceberg. It's estimated there were as many as 100,000 privacy claims against companies between 2022 and 2025. Many will have settled privately, so the real cost to companies is likely far higher than the $1.4 billion paid out in public class action settlements," said Vaibhav Antil, Chief Executive Officer, Privado AI.

Compliance gap

The report argues that many businesses facing legal pressure already had consent tools on their websites or apps. Its central claim is that these systems may control banners and preference settings but do not necessarily verify whether every tracker, tag or software development kit operates in line with a user's choices.

That issue may be growing as litigators widen their focus beyond established ad technology. Independent security research published in September found that a cookie linked to OpenAI recorded the activity of free-tier ChatGPT users across more than 1,000 merchant websites, while OpenAI's cookie policy classified the tracker as analytics rather than marketing.

The report said the OpenAI cookie worked in a similar way to the Meta pixel, highlighting how new forms of third-party tracking can create fresh legal questions. For companies, the risk is not limited to major social media or advertising platforms but extends to a wider range of embedded tools on consumer-facing digital properties.

Privado AI said its methodology covered publicly available website and app privacy class action settlements agreed between January 2025 and August 2026, capturing defendants, settlement amounts, statutes alleged, whether claims related to websites or apps, and any named third-party trackers. It estimated annual totals by combining the mean settlement amount with the estimated number of settlements reached in a given year.

"Consent tools don't prove compliance, and a plaintiff's lawyer needs little more than a browser to find evidence that a site has failed to honor a visitor's choice. At $6.7 million on average per settlement, a business has to catch every pixel, tag and data flow before it turns into a demand letter. Every company needs a proper website governance program, so they can safely add a new ad channel and increase revenue, without compromising on user privacy and increasing their risk of litigation," said Antil.