November 10, 2025
State Watch: Consumer Protection Enforcement Update: October 2025
Privacy and data security enforcement take center stage while the AGs push back against CFPB proposals to dramatically reduce its nonbank supervisory authority
New Jersey
New Jersey Attorney General Platkin entered into a $2.8 million settlement with a Florida-based realty company over a product the company described as a "Homeowner Benefit Agreement" or "HBA." AG Platkin claims the company marketed the HBA to New Jersey consumers as simply an agreement for cash up-front in exchange for the consumer agreeing to hire the company as their realtor when they chose to sell. Instead, according to the AG, the terms of the HBA lasted 40 years and included a lien on the consumer's home and an early termination fee of at least 3% of the home's value if the consumer listed the property with a different realtor, the home was foreclosed, or the title was otherwise transferred or the home was sold. The AG alleges that the company violated New Jersey's Consumer Fraud Act and its advertising and telemarketing do-not-call regulations. The settlement includes a $1.5 million civil penalty and over $1.3 million in consumer restitution.
New York
New York Attorney General James settled with eight car insurance companies over their alleged cybersecurity failures. Specifically, AG James claims that the companies did not have in place reasonable data security controls to protect consumers' private information. The AG alleges that hackers targeting the car insurance companies accessed the private information of over 800,000 New Yorkers. In total, the companies agreed to pay $14.2 million and improve their data security practices. The AG's office and the New York Department of Financial Services collaborated on the investigation. The settlement follows on the heels of settlements with 10 other car insurance companies alleging similar deficiencies.
Texas
Texas Attorney General Paxton entered into an eye-popping $1.375 billion settlement with a tech giant over its alleged unlawful tracking and collection of consumers' private geolocation, incognito browsing activity, and biometric identifier data. This is AG Paxton's second settlement in excess of one billion dollars involving privacy issues. The AG's office retained outside counsel to assist in bringing the case.
Multistate
New Hampshire recently joined the Consortium of Privacy Regulators, a bipartisan group of state privacy regulators collaborating on data privacy enforcement. This follows on the state's passage of its comprehensive Data Privacy Act and the creation, within the New Hampshire Department of Justice, of a Data Privacy Unit tasked with enforcing the new law. The Consortium now includes the California Privacy Protection Agency and state Attorneys General from California, Colorado, Connecticut, Delaware, Indiana, New Hampshire, New Jersey, Minnesota, and Oregon.
A group of 21 states attorneys general submitted comments in opposition to the federal Consumer Financial Protection Bureau's recent proposals to dramatically reduce the agency's supervisory footprint by limiting the entities subject to supervision in the auto finance, consumer reporting, debt collection, and international money transfer services markets. The AGs also submitted a comment in opposition to the Bureau's recent proposal to revise how the agency designates nonbank financial services providers for supervision.
Click here to learn more about Hudson Cook's State Enforcement Practice.