The Data Privacy Mistakes That Keep Costing Companies Millions—and the Design Choices That Reduce the Risk

By Atticus Smith, Legal Intern, Afissio Law

This installment looks at real examples of good and bad decisions companies have made about personal data. The gap between a company's privacy policy and its actual data practices is where most of the risk—and, as Part 3 argues, most of the opportunity—lives. The enforcement examples below come from settlements between agencies and companies, not court findings of wrongdoing. None of these companies admitted liability, and nothing here should be read as a verdict on any of them. The agency complaints and orders nevertheless reveal recurring allegations about how companies collect, retain, disclose, and secure personal information, and those patterns offer useful lessons even without adjudicated findings. So what are the alleged failures that keep showing up?

Broken Promises

Many of these cases involve a company allegedly saying one thing about its data practices and doing another. According to the FTC, BetterHelp, the online counseling platform, told users, "Rest assured—any information provided in this questionnaire will stay private between you and your counselor,"¹ and then shared their health questionnaire answers, email addresses, and IP addresses with Facebook, Snapchat, Pinterest, and Criteo for advertising. BetterHelp agreed to pay $7.8 million to fund partial consumer refunds, and the FTC's order bars it from sharing health information for advertising.² GoodRx followed a similar arc: the FTC alleged that the prescription discount platform promised never to share health data with advertisers, then did so with Facebook, Google, Criteo, and others for years. GoodRx agreed to a $1.5 million civil penalty, and the case was the FTC's first enforcement action under its Health Breach Notification Rule.³

The genetic testing company 1Health.io (Vitagene) shows a subtler version of the same problem. The FTC alleged that it changed its privacy policy in 2020 to allow broader data sharing without adequately notifying customers who had already provided their DNA, and that it left unencrypted health reports and raw genetic data in publicly accessible cloud storage. The order required 1Health.io to instruct its labs to destroy DNA samples retained for more than 180 days and to obtain consumers' affirmative express consent before sharing their health data with third parties.⁴

Holding Onto Data

Another recurring pattern involves retaining data after the original business need has ended. Blackbaud, a commercial software and data-services provider whose customers include nonprofits, schools, and health care organizations, suffered a breach in 2020 that went undetected for about three months. The FTC alleged that the company kept data belonging to former customers far longer than necessary, failed to adequately implement multifactor authentication, and failed to encrypt certain sensitive information. The FTC's order requires Blackbaud to delete information it no longer needs and to adopt and follow a formal data retention schedule.⁵

Lacking Proper Security

The starkest example remains Equifax. Its 2017 breach exposed personal information, including Social Security numbers, of approximately 147 million people. The FTC alleged that the company failed to patch a known critical vulnerability for months and stored network credentials and Social Security numbers in plain text, practices sharply out of step with the sensitivity of the data it held. Equifax's global settlement with the FTC, the Consumer Financial Protection Bureau, and 50 states and territories included at least $575 million and potentially up to $700 million.⁶ The more sensitive the data, the higher the bar for protecting it, and companies keep getting caught treating that bar as optional.

What Companies Are Doing Right

Strong privacy practices rarely make headlines the way scandals do, but they are just as instructive. The examples below show privacy problems being avoided by design, not by better paperwork after the fact. Apple's Advanced Data Protection, an optional feature users can turn on, extends end-to-end encryption to most categories of iCloud data, so that only the user's trusted devices hold the encryption keys.⁷ The Electronic Frontier Foundation called the feature "a big win for user privacy."⁸ Firefox turned on Total Cookie Protection for every user by default in 2022, rather than making it an opt-in setting most people never find.⁹ Signal designed its systems to hold almost no user data, so when it receives a subpoena, it can produce only the date an account was created and the date it last connected to Signal's servers.¹⁰ DuckDuckGo says it does not save or share users' search histories.¹¹ Even infrastructure providers are getting in on this: Cloudflare has submitted its 1.1.1.1 DNS resolver to an independent accounting firm's examination of its privacy commitments, which include not storing users' querying IP addresses alongside their DNS queries and deleting logs on a short, fixed schedule.¹² What sets these choices apart is that they are structural product and system decisions, not compliance measures added after the fact.

The Numbers Behind Both Paths

Data breaches aren't cheap. According to IBM's 2026 Cost of a Data Breach Report, the global average cost of a breach reached $4.99 million, a record high and a 12% increase over the prior year.¹³ Regulatory penalties can dwarf even that: the FTC's $5 billion penalty against Facebook, imposed in 2019 after the Cambridge Analytica revelations, was at the time the largest privacy penalty ever imposed on any company.¹⁴

Consumers say they are paying attention, too. In Cisco's 2024 Consumer Privacy Survey of more than 2,600 adults in 12 countries, 75% of respondents said they would not buy from an organization they don't trust with their data. And 38% qualified as "Privacy Actives"—people who say they care about privacy, are willing to act on it, and have already switched companies or providers over data practices—up from 32% in 2022 and 33% in 2023.¹⁵

Privacy can pay off in the market, too. When WhatsApp, then owned by Facebook, announced a data-sharing policy update in January 2021, one widely (if not entirely accurately) read as expanding Facebook's access to user data, privacy-focused competitors saw a surge of new users.¹⁶ Part 3 looks at that episode, and at what Apple's tracking changes meant for Meta, as part of the case that privacy by design can be a competitive advantage rather than a compliance cost.

Atticus Smith is a legal intern at Afissio Law. This series was edited by Jerry Stephen Smith, Principal of Afissio Law.

Notes

1. FTC, Complaint, In re BetterHelp, Inc., https://www.ftc.gov/system/files/ftc_gov/pdf/2023169betterhelpcomplaintfinal.pdf
2. FTC, FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data for Advertising (July 2023), https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-gives-final-approval-order-banning-betterhelp-sharing-sensitive-health-data-advertising
3. FTC, Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising (Feb. 2023), https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising
4. FTC, FTC Finalizes Order with 1Health.io (Sept. 2023), https://www.ftc.gov/news-events/news/press-releases/2023/09/ftc-finalizes-order-1healthio-over-charges-it-failed-protect-privacy-security-dna-data-unfairly
5. FTC, FTC Order Will Require Blackbaud to Delete Unnecessary Data (Feb. 2024), https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-require-blackbaud-delete-unnecessary-data-boost-safeguards-settle-charges-its-lax
6. FTC, Equifax to Pay $575 Million as Part of Settlement (July 2019), https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach
7. Apple Platform Security, Advanced Data Protection for iCloud, https://support.apple.com/guide/security/advanced-data-protection-for-icloud-sec973254c5f/web
8. Electronic Frontier Foundation, How to Enable Advanced Data Protection on iOS, and Why You Should (May 2023), https://www.eff.org/deeplinks/2023/05/how-enable-advanced-data-protection-ios-and-why-you-should
9. Mozilla, Firefox Rolls Out Total Cookie Protection by Default to All Users Worldwide (June 2022), https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/
10. Signal, Grand Jury Subpoena for Signal User Data, Central District of California, https://signal.org/bigbrother/central-california-grand-jury/
11. DuckDuckGo, Privacy Policy, https://duckduckgo.com/privacy
12. Cloudflare, Announcing the Results of the 1.1.1.1 Public DNS Resolver Privacy Examination, https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/
13. IBM, Cost of a Data Breach Report 2026, https://www.ibm.com/reports/data-breach
14. FTC, FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook (July 2019), https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook
15. Cisco, 2024 Consumer Privacy Survey, https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-consumer-privacy-report-2024.pdf
16. Sensor Tower, WhatsApp Rivals See Nearly 1,200% Growth Ahead of Privacy Policy Deadline (May 2021), https://sensortower.com/blog/whatsapp-signal-telegram-install-growth

Afissio Law, LLC | Jerry Stephen Smith, Principal

1438 W Broadway Road, Suite 101, Tempe, Arizona 85282

This article is provided for general informational purposes only and is not legal advice. Reading it does not create an attorney-client relationship.