What 256 settlements say about what websites actually get sued for

When this analysis was published the database held 256 cited settlements, enforcement actions, and rulings (2008–2026) totaling $5.56B; it has grown since, and the live tracker carries the current numbers. For the statistics below we cut it stricter: only fully verified, resolved, distinct cases with a public dollar amount: 193 cases. Pending complaints, dismissed matters, and rows our verification process hasn't confirmed are excluded, the same exclusions our scanner applies before citing a number to a customer. Every underlying case links to a court document, AG release, or consent decree.

One bias to hold onto while reading: this is the public record. Cases enter it when they're big enough to be filed, reported, or enforced. The demand letter your business would actually receive settles quietly, below this dataset's floor, which is precisely why the public numbers should be read as the ceiling of the distribution, not your expected outcome.

Across the 193 verified resolved cases, the median outcome is $6.8M, with an interquartile range of $1.2M to $20M. The mean is roughly five times the median, because the top ten cases alone hold about 68% of every public dollar. Forty-four cases (roughly a quarter) resolved under $1M; eighty-seven (45%) under $5M.

Translation: the famous nine-figure numbers are real and rare. The bulk of the public record is single-digit millions, and the invisible mass below the public record is demand letters and quiet settlements at four to six figures.

Group the verified cases by statute family and a pattern appears that should drive small-business priorities:

• TCPA (35 cases): median $24.15M. Per-message statutory damages ($500–$1,500) times list sizes produce the biggest class outcomes in the dataset (Wakefield v. ViSalus: $925M).
• FTC Act / consumer protection (25 cases): median $7.8M. Enforcement actions over subscriptions, dark patterns, and data practices.
• VPPA (22 cases): median $4.8M. The Meta-Pixel-on-video-pages pattern (AARP $12.5M, Tubi $19.99M).
• ADA / web accessibility (20 cases): median $250K, the smallest in the table, but accessibility produces by far the most filings and letters per year of any category here.
• CCPA / state privacy (17 cases): median $1.2M. Sephora's enforcement is the archetype.
• Session replay / CIPA (12 cases): median $10M. The wiretap theory, post-Javier.

The most frequent claim type (accessibility) has the smallest typical outcome, and the least frequent claim types (texting, video privacy) have the largest. That's not a reason to deprioritize accessibility (volume is its own tax, and ADA letters arrive weekly somewhere). It's a reason to check the low-frequency, high-severity surfaces before they're tested: the consent language on your SMS signup form, the ad pixel on your video pages, the session recorder on your intake flow. Those are one-configuration-mistake exposures with seven-figure medians.

It's also why a compliance check that only covers accessibility reads the risk landscape backwards: it audits the most survivable category and skips the most expensive ones.

Timing matters too: 113 of the 193 verified resolved cases (nearly 60%) date from 2022 through 2025, more than all years before 2022 combined. CCPA enforcement began in 2022; session-replay claims multiplied after Javier; VPPA pixel cases after 2022; auto-renewal enforcement escalated through Adobe. The legal surface a website carries simply got bigger, recently, and the curve in our own data shows it.

The same way our scanner does: as ranges of documented comparable outcomes, never predictions. When a Complidar report attaches a liability range to a finding, it's the 25th-to-75th percentile of resolved comparable cases, and when fewer than four comparables exist, it shows the count instead of inventing a range. These statistics carry the same discipline at dataset scale: verified cases only, methodology stated, selection bias named.

If you want to know which of these categories is actually open on your website, that's a free scan: 22 checks, the evidence captured, the comparable cases attached.