Penalty Amount
$2,000,000
Consumers Affected
22,000,000
New Jersey joined a multistate $2 million settlement with online retailer CafePress over a 2019 data breach that exposed personal information of approximately 22 million consumers nationwide, including over 540,000 in New Jersey. The settlement requires CafePress to implement a comprehensive cybersecurity program, incident response plan, and third-party assessments for five years, with payment suspended pending compliance.
CafePress must pay $2 million (with $750,000 immediate, including $98,368 to New Jersey), implement a comprehensive information security program with regular updates and CEO reporting, develop an incident response and breach notification plan, enhance personal information safeguards (encryption, segmentation, penetration testing, password management, data minimization), provide clear consumer notice regarding account closure and data deletion, and undergo third-party security assessments for five years. The remaining balance is suspended contingent on compliance.
In-house legal teams should review vendor agreements, customer terms of service, and data processing agreements for clauses addressing data security, breach notification, and incident response. Specifically, examine requirements for encryption of sensitive data (e.g., SSNs, payment details), timelines for breach reporting, obligations to conduct third-party security assessments, and data retention/disposal policies. Changes may include mandating a comprehensive cybersecurity program, implementing regular risk assessments, strengthening access controls, and ensuring compliance with state data breach notification laws. Also, assess indemnification provisions for breach-related costs and audit rights to monitor vendor compliance.
Entity
CafePress
Industry
RetailOfficial Press Release
https://www.njoag.gov/ag-grewal-joins-2-million-settlement-with-online-retailer-cafepress-over-2019-data-breach/
121820 CafePress AVC
https://www.nj.gov/oag/newsreleases20/121820-CafePress-AVC.pdf
New Jersey Attorney General Enforcement Page
https://www.njoag.gov/about/divisions-and-offices/division-of-consumer-affairs/
"settlement with internet retailer CafePress"
"total payment to the states of $2 million"
"The data breach compromised the personal information of approximately 22 million consumers nationally"
$500K
The FTC finalized an order against CafePress for failing to secure consumer data and covering up a data breach. The company must implement comprehensive security measures, and its former owner must pay $500,000 in redress to victims.
$370K
The FTC settled with CafePress for failing to implement reasonable data security measures, leading to multiple breaches that exposed Social Security numbers and other sensitive data. As part of the settlement, over $370,000 in refunds are being distributed to 20,044 consumers who filed valid claims.
A multistate coalition co-led by New Jersey won a federal court order rejecting the Trump Administration’s decision not to request funding for the CFPB. The order struck down that decision and directed the Administration to follow the law and fund the agency; no monetary penalty or privacy violation is described.
New Jersey’s Attorney General and Division of Consumer Affairs alerted the public that three synthetic kratom-related compounds became illegal to possess or sell in the state under a temporary federal scheduling order. The release describes a controlled-substance alert, not a privacy enforcement action, and identifies no company, privacy violation, or monetary penalty.
$2.3M
Laboratory Corporation of America Holdings agreed to pay $2,287,455 to participating states and strengthen its security and vendor-management practices following an investigation into the 2019 breach at its debt-collection vendor, AMCA. The breach potentially exposed information of more than 27.5 million people nationwide, including sensitive information belonging to approximately 10.2 million LabCorp patients.
$694.0M
New Jersey's Attorney General and Division of Consumer Affairs, along with 41 Attorneys General, reached a $694 million settlement with subprime auto lender Credit Acceptance Corporation over allegations it originated unaffordable loans its own systems predicted borrowers could not repay, employed aggressive debt-collection tactics, and failed to prevent deceptive vehicle-service contract and GAP product 'packing' by dealers. The multistate settlement stepped in after the CFPB permanently dropped its 2023 enforcement action against CAC in 2025. CAC will provide $60 million in cash restitution, $634 million in debt relief, an additional $15 million to the states, and implement injunctive lending reforms including loan off ramps, pre-loan disclosures, add-on packing safeguards, and a seven-year vehicle price cap. Note: this is a consumer-protection lending enforcement action, not a privacy matter; violation categories are best-fit mappings from the available taxonomy.