Sources: U.S. Federal Trade Commission (FTC) official website; California Privacy Protection Agency (CalPrivacy / CPPA) official website
Date collected: 2026-09-23
Official links: listed under each entry; all are directly accessible official pages (not home pages, not search-result pages)
Verification: every holding below is quoted verbatim from the official English text; the quotations were checked sentence by sentence against the official pages
Jurisdiction: United States (federal / California)

Case 1: Workado, LLC (f/k/a Content at Scale AI) — accuracy claims for an AI content-detection product

  • Case/Matter number: FTC Matter/File No. 2323092 (from the “FTC Matter/File Number” field on the official case page)
  • Authority: U.S. Federal Trade Commission (FTC)
  • Date: final order approved and made final on 2025-08-28 (date of the official press release; the complaint was issued in April 2025)
  • Applicable law: Section 5 of the FTC Act (unfair or deceptive acts or practices) [to verify] — the official press release does not cite the section; the official case page is tagged “deceptive/misleading conduct”
  • Holding (official text):

“The Federal Trade Commission has given final approval to an order against Workado, LLC, requiring the company to stop advertising the accuracy or efficacy of its artificial intelligence (AI) content detection products unless it has competent and reliable evidence showing those products are as accurate as claimed.”

“Workado markets its AI Content Detector to consumers seeking to determine whether written content was developed using generative AI technology or if it was written by a human being. The company claimed that its AI Content Detector was developed using a wide range of material, including blog posts and Wikipedia entries, to make it more accurate for average users. The FTC’s April 2025 complaint alleges, however, that the AI model powering the AI Content Detector was trained or fine-tuned to effect…”

“The final order is designed to ensure Workado does not engage in similar false, misleading, or unsupported advertising. Under the order, Workado: Is prohibited from making any representations about the effectiveness of any AI content detection product unless it is not misleading, and the company has competent and reliable evidence to support the claim at the time it is made; …”

Case 2: GGL Projects, Inc. (d/b/a Sitejabber) — misleading ratings and reviews on an AI-enabled review platform

  • Case/Matter number: [to verify] — the official case page does not list an “FTC Matter/File Number” field; case name: In the Matter of GGL Projects, Inc., a Corporation, also d/b/a Sitejabber.
  • Authority: U.S. Federal Trade Commission (FTC)
  • Date: complaint issued in November 2024 (official case page: “In a complaint issued in November 2024”); the date the final order was approved is [to verify] (the “Last Updated” field showing 2025-01-03 is a page-update date, not the order date)
  • Applicable law: Section 5 of the FTC Act (deceptive acts or practices) [to verify] — to be confirmed against the order text
  • Holding (official text):

“In a complaint issued in November 2024, the FTC charged that Sitejabber deceived consumers by misrepresenting that ratings and reviews it published came from customers who experienced the reviewed product or service, artificially inflating average ratings and review counts. Under a proposed order settling the agency’s complaint, Sitejabber will be prohibited from making such misrepresentations and from making other misrepresentations about consumer ratings or reviews. The Commission approved the…”

  • Official link:
  • Jurisdiction: United States (federal)
  • To verify: ① the FTC Matter/File Number (not listed on the case page); ② the date the final order was approved; ③ the “Case Status” field; ④ the final sentence is truncated on the official page.

Case 3: FTC v. Evolv Technologies Holdings, Inc. — unsupported claims about an AI security-screening system

  • Case/Matter number: Federal Trade Commission, Plaintiff, v. Evolv Technologies Holdings, Inc., a Corporation, Defendant.; docket number [to verify] (not listed on the case page)
  • Authority: U.S. Federal Trade Commission (FTC, as plaintiff)
  • Date: 2024-11-26 (date of the official press release)
  • Applicable law: Section 5 of the FTC Act (deceptive acts or practices) [to verify] — to be confirmed against the order/complaint text
  • Holding (official text):

“The Federal Trade Commission is taking action against Evolv Technologies over allegations that the company made false claims about the extent to which its AI-powered security screening system can detect weapons and ignore harmless personal items, including in school settings.”

“In the proposed FTC settlement order, Evolv would be banned from making unsupported claims about its products’ ability…”

(press-release subheading) “Proposed settlement would prohibit misrepresentations and allow affected schools to opt out of current contracts for security screening systems”

Case 4: Tractor Supply Company — CCPA privacy-notice and job-applicant notice violations (largest fine in the agency’s history)

  • Case/Matter number: Case No. ENF24-M-TR-04 (body of the decision; verified 2026-09-24 against the archived original)
  • Authority: California Privacy Protection Agency (CPPA / CalPrivacy) Board
  • Date: announcement date 2025-09-30; decision signed 2025-09-26 (“this 26th day of September, 2025” on the signature page; verified 2026-09-24)
  • Applicable law: California Consumer Privacy Act (CCPA) — privacy-notice obligations and the obligation to inform consumers and job applicants of their rights
  • Holding (official text):

“SACRAMENTO – The California Privacy Protection Agency (CPPA) Board has issued a decision requiring Tractor Supply Company, the nation’s largest rural lifestyle retailer with more than 2,500 stores in 49 states, to change its business practices and pay a $1,350,000 fine to resolve claims that the company violated the California Consumer Privacy Act (CCPA). The fine is the largest in the CPPA’s history, and the decision is the first to address the importance of CCPA privacy notices and privacy rig…”

“According to the Board’s decision, Tractor Supply violated Californians’ privacy rights by: Failing to maintain a privacy policy that notified consumers of their rights; Failing to notify California job applicants of their privacy rights and how to exercise them; …”

“To resolve the allegations, Tractor Supply agreed to pay $1,350,000, implement broad remedial measures, such as scanning its digital properties to inventory tracking technologies, and require a corporate officer or director to certify compliance annually for the next four years.”

  • Official links:
  • Jurisdiction: United States (California)
  • To verify: ① the signature date and case number on the decision (the PDF is a scanned document; the text layer could not be extracted); ② the first quotation and the list of violations are truncated on the official page; ③ “largest fine in the CPPA’s history” is the agency’s own statement, not a comparison across decisions.

Case 5: ROR Partners LLC — failure to register as a data broker under California’s Delete Act

  • Case/Matter number: Case No. ENF25-245-D-RO (body of the decision; verified 2026-09-24 against the archived original)
  • Authority: California Privacy Protection Agency (CPPA / CalPrivacy) Board
  • Date: announcement date 2025-12-03; decision signed 2025-11-26 (template year 2025 + handwritten “26th November” on the signature page; verified 2026-09-24. The page’s <time> attribute 2025-11-20 is page metadata, a different node — conflict resolved). the date of signature on the decision governs)
  • Applicable law: California Delete Act — annual registration obligation for data brokers
  • Holding (official text):

“SACRAMENTO, CA – The California Privacy Protection Agency Board has issued a decision requiring ROR Partners LLC, a Nevada-based marketing firm catering to fitness and wellness brands, to pay $56,600 in fines and past-due fees for failing to register as a data broker in violation of California’s Delete Act. The Enforcement Division brought the case as part of its …”

Appendix 1: two further verified entries that can be added

Both entries below belong to the same CalPrivacy enforcement announcement of 2026-01-08 on data brokers. Because they share the same source and date as Case 5, and to avoid splitting a single enforcement announcement into multiple entries, they are listed here in tabular form pending separate entries per respondent.

#RespondentPenaltyGroundsApplicable lawAnnouncement dateOfficial link
ARickenbacher Data LLC (d/b/a Datamasters, Texas)$45,000Failure to register as a data broker; resale of names, addresses, phone numbers and emails of individuals with health conditions including Alzheimer’s disease, drug addiction and bladder incontinenceCalifornia Delete Act2026-01-08https://cppa.ca.gov/announcements/2026/20260108.html ; decision https://cppa.ca.gov/pdf/datamasters_order_signed.pdf
BS&P Global, Inc. (New York)$62,600Failure to register as a data broker owing to an administrative error; required to establish registration and compliance-audit proceduresCalifornia Delete Act2026-01-08https://cppa.ca.gov/announcements/2026/20260108.html ; decision https://cppa.ca.gov/pdf/sp_global_inc_fo_signed.pdf

The decisions for these two entries were not downloaded in this round; [to verify]: decision date and case number.

Appendix 2: scope and limitations of this batch

  • Change of authority name: the California Privacy Protection Agency (CPPA) moved all announcements to privacy.ca.gov as of 2026-01-26 and now uses the name CalPrivacy. Announcements from 2025 and earlier remain at cppa.ca.gov/announcements/ and those links remain valid.
  • Date conventions: this batch consists of enforcement/penalty cases and therefore does not involve the “entry into force vs. date of application of compliance obligations” distinction. Note, however, that the annual data-broker registration obligation under the Delete Act falls due each January, a different kind of milestone from the announcement dates of each penalty; the two are labelled separately where listed together in this section.
  • Sources used: all fields are taken solely from first-hand pages on the FTC and CalPrivacy/CPPA official websites and from official PDFs — no third-party republication and no law-firm commentary is used in the body text.