Do Big Fines Prevent Data Leaks? What the Evidence Shows

Every few months a regulator announces a penalty with a record-setting number, and every few months another breach lands in the headlines. The two facts sit uneasily together. If fines worked as promised, you might expect leaks to taper off. This article looks at what penalties actually do, why they have not ended data leaks, what other tools affect corporate behavior and what that means for the choices you make as an individual. It extends our analysis of how companies respond to breaches and the real costs of data breaches.

1. The theory of deterrence

The idea behind fines is straightforward. If a company expects to pay more for a failure than it saves by cutting corners, it will invest in prevention. For that logic to work, four conditions must hold:

Severity. The penalty must be large relative to profit.
Certainty. Companies must believe violations will be detected and punished.
Speed. Consequences must arrive soon enough to influence decisions.
Specificity. The company must know what behavior is expected.

In data security, all four conditions are often weak. Breaches can go undetected for months. Investigations can take years. Standards are described in broad terms like “reasonable security”. And a penalty, even a large one, is a small share of annual revenue for the biggest firms.

2. The big cases people point to

Facebook, 2019

In 2019 the Federal Trade Commission announced a $5 billion civil penalty against Facebook for violating a previous privacy order, along with new compliance requirements, including a privacy committee at the board level. At the time, it was the largest penalty the FTC had ever obtained in a privacy case. Details are in the agency’s materials at ftc.gov.

Amazon Alexa, 2023

In 2023 the FTC announced a settlement with Amazon over children’s voice recordings collected by Alexa, including a $25 million civil penalty and requirements to delete certain data. The case is a reminder that retention and deletion practices can be legally risky.

Equifax, 2019

After the 2017 breach affecting about 147 million people, Equifax reached a settlement announced in 2019 with federal and state authorities that provided funds for consumer relief and required security improvements. Our article Equifax should pay more discusses the reaction, and Equifax: millions still at risk covers the exposure.

InfoTrax, 2019

The FTC’s action over a vendor’s security failures illustrates that smaller companies are also in scope. See the InfoTrax case.

3. Why leaks continue anyway

Penalties are late

The conduct that leads to a breach often occurs years before enforcement concludes. Executives who made the decisions may have moved on, and systems may have changed.

The size problem

A penalty that sounds enormous may represent a small percentage of annual revenue. Companies can treat it as a cost of doing business, especially when the product being sold is the data itself.

Attackers adapt

Even with perfect compliance, determined criminals find weak points. Supply chains, phishing and unpatched software remain reliable entry routes.

Data accumulates

The best protection is not collecting or keeping data. But data is valuable, and many companies hold more than they need. The more data in circulation, the more can be stolen.

Fines do not undo exposure

A fine punishes. It does not recall the stolen records. Individuals whose data is exposed continue to bear risk for years. Read about how long data leaks affect you.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

4. What else changes behavior

Fines are one tool among several. Combined, they work better.

Binding security programs and assessments. Orders can require companies to build and test controls.
Executive accountability. Personal responsibility for compliance changes incentives.
Private lawsuits. Class actions raise costs for failures.
Data minimization rules. Laws that limit collection and retention shrink the target.
Registration and transparency. Requiring data brokers to register, as California does, makes the industry visible. The California Privacy Protection Agency operates the DROP platform, where residents can send deletion requests to registered brokers.
Procurement and insurance requirements. Customers and insurers can demand baseline controls.
Technical standards. Widespread use of multi-factor authentication and encryption reduces damage.

Our overview of government entities that protect data explains who enforces what.

5. The scale of the problem

The FBI’s Internet Crime Complaint Center received 1,008,597 complaints in 2025, with reported losses of $20.877 billion, including 67,456 personal data breach complaints and 31,675 identity theft complaints (ic3.gov). The FTC received about 3 million fraud reports with about $15.9 billion in reported losses (ftc.gov). These totals show that enforcement actions, however notable, address only a fraction of the harm.

6. What this means for you

If you wait for fines to protect you, you will wait a long time. A better approach is to treat corporate security as a variable you cannot control and to build your own layers.

Freeze your credit

A freeze is free and blocks most new accounts. See what a credit freeze is and the FTC’s guidance.

Use unique passwords and two-factor authentication

One breached site then stays one breached site.

Provide only the data a service needs. Use alias email addresses and secondary phone numbers.

Remove public listings

Take down the people-search profiles that complete stolen records. Official pages include Spokeo, PeopleConnect and That’s Them. Our step-by-step guide covers the rest.

Use your rights

Ask companies what data they hold and request deletion where your state law allows. California residents can use DROP.

Report problems

Use ReportFraud.ftc.gov and IdentityTheft.gov. Our data breach response strategies give a full checklist.

7. A balanced verdict

Fines are not useless. They can signal priorities, finance consumer relief, fund enforcement and, when paired with binding orders, produce lasting changes. They are not sufficient. Without data minimization, strong security requirements, faster enforcement and meaningful remedies for individuals, leaks will continue. The best view is to welcome enforcement while planning for its limits.

8. Timeline: how enforcement unfolds

Stage	Typical timing
Breach or violation occurs	Year 0
Detection and disclosure	Weeks to months later
Investigation	One to several years
Settlement or order	Often several years after the violation
Compliance monitoring	Years of obligations

9. Lessons from other fields

Safety regulation in other industries offers a useful comparison. Aviation, food and pharmaceuticals did not become safer because of fines alone. They improved when rules set specific standards, inspectors checked compliance, incident reporting was mandatory and failures carried real consequences for decision-makers. Data security is younger and has fewer binding standards, so companies often decide for themselves what counts as reasonable. Moving toward concrete requirements, such as mandatory multi-factor authentication, limits on retention and independent testing, would make penalties more predictable and more effective.

10. How you can tell whether a company takes security seriously

You cannot audit a company, but you can look for signals. Does it publish a clear privacy policy with retention periods? Does it offer two-factor authentication? Does it notify customers quickly and plainly when something goes wrong? Does it let you delete your account and data without a fight? Companies that treat these as basics tend to be better custodians. Companies that make it hard to delete data or leave security features out of reach deserve more caution. When you cannot tell, give less.

11. Pressure that does not come from regulators

Customers, employees, investors and the press also shape behavior. A breach that costs a company business, as buyers leave or insurers raise premiums, can do more than a distant penalty. Your choices as a consumer matter in this respect: sharing less, choosing providers with better practices and filing complaints through ReportFraud.ftc.gov all feed the system with signals. Individual actions seem small, but together they influence which practices are rewarded.

12. Three scenarios and what to do

Scenario 1: A large penalty is announced against a company you use. Review your settings, change passwords and check for notices.

Scenario 2: A settlement offers claims. Verify the official administrator and avoid fee-based offers.

Scenario 3: A company ignores your deletion request. Document it and complain to your state attorney general or privacy regulator.

13. Myths and facts

Myth	Fact
Big fines end breaches	They help but do not end them
Fines compensate victims	Most go to the government
Only huge firms are penalized	Smaller firms have been too
Compliance ends all risk	Attackers still adapt
Regulation will protect me soon	Gaps remain; protect yourself now

14. Common mistakes

Assuming the law has you covered.
Treating a settlement as closure.
Ignoring requests you can make yourself.
Skipping a freeze because a company is “responsible”.
Sharing more data than needed.

15. Questions to ask yourself

Which companies hold the most sensitive data about me? Have I asked them to delete what they do not need? Is my credit frozen? What would a criminal need to complete my profile? Start with the weakest link.

16. How Wiperts fits

When enforcement is slow, practical self-defense matters. Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors for returning profiles. Start with the free diagnosis.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

17. Key takeaways

Fines can deter, but delay, size and weak standards limit the effect.
Other tools matter: binding orders, accountability and data minimization.
Fines do not undo exposure for victims.
Protect yourself now with freezes, unique credentials and fewer public listings.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

18. Frequently Asked Questions

Do large fines deter companies from poor data security?

They can, if penalties are large relative to profit, enforcement is predictable and orders require real changes. In practice, delays and modest amounts weaken the effect.

What was the largest FTC privacy penalty?

In 2019 the FTC announced a $5 billion civil penalty against Facebook for violating a prior privacy order, the largest the agency had obtained for a privacy violation at that time.

Do fines go to the victims?

Usually not directly. Government penalties generally go to the government, while class settlements may provide payments or services to affected people.

What else besides fines improves security?

Binding security programs, independent assessments, executive accountability, data minimization requirements and private lawsuits all contribute.

Why do breaches keep happening despite penalties?

Attackers are persistent, systems are complex, vendors multiply risk and companies often keep more data than they need.

What should I do while regulation catches up?

Freeze credit, use unique passwords and two-factor authentication, limit sharing and remove public listings that help criminals build profiles.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing