and the states press the CFPB’s Acting Director for overdue restitution funds

Anastasia V. Caton

California

California Attorney General Bonta entered into the state’s largest California Consumer Privacy Act (“CCPA”) settlement to date with a website publisher for $1.55 million. AG Bonta alleges that the company’s online tracking technology violated the CCPA because the company, according to the AG, failed to allow consumers to opt out of targeted advertising, shared consumer data with third parties without following the CCPA’s purpose limitations, failed to ensure that its advertising contracts had the privacy protections required by the CCPA, and deceived consumers about its privacy practices by not disabling cookies at the consumer’s request.

Illinois

The Illinois Department of Financial and Professional Regulation (“IDFPR”) revoked the license of and assessed a fee against a mortgage lender for allegedly retaining unlicensed mortgage loan originators, facilitating their unlicensed loan origination activities, and accepting loan files from the unlicensed mortgage loan originators that contained false or fabricated information without correcting it. In addition to revoking the mortgage lender’s license, the IDFPR assessed a fine of $100,000.

Nebraska

Nebraska Attorney General Hilgers sued a Chinese e-commerce company over its alleged practice of using malware to collect Nebraskans’ data, even in instances where the consumer had not downloaded the company’s app. AG Hilgers also accused the retailer of purportedly misrepresenting the quality and characteristics of advertised products, including by artificially skewing paid reviews, failing to have a meaningful return process, selling merchandise that infringes on Nebraska brands, deceptively labeling products as “local” when they are shipped from a warehouse in the U.S. but manufactured outside of the U.S., and “greenwashing.” The lawsuit alleges violations of Nebraska’s Consumer Protection Act and Uniform Deceptive Trade Practices Act. It seeks injunctive relief, restitution, civil penalties, and costs.

New York

Both houses of New York’s legislature passed the FAIR Business Practices Act and the bill is expected to go to Governor Hochul’s desk soon. If signed into law, the FAIR Business Practices Act would amend New York’s consumer protection law, which currently prohibits only deceptive trade practices, to also prohibit unfair and abusive acts or practices, adopt the Federal Trade Commission’s definition of “unfairness,” and vest authority in the state attorney general to enforce the prohibition on unfair or abusive acts or practices. AG James and others have repeatedly cited the attempted dismantling of the CFPB as the impetus for this legislation.

Pennsylvania

Pennsylvania Attorney General Sunday settled with a debt collector over its collection of online payday loans originated by lenders affiliated with Native American tribes. According to the AG, the loans, which were made by lenders claiming to be exempt from licensing and usury, had interest rates and fees in excess of Pennsylvania’s usury limit applicable to unlicensed lenders. AG Sunday claimed that, because portions of the debts were not legally authorized by Pennsylvania law, the debt collector misrepresented the legal status of the debts in violation of Pennsylvania’s Fair Credit Extension Uniformity Act and Consumer Protection Law. The debt collector has voluntarily stopped collecting loans made by tribal lending enterprises. Under the terms of the settlement, the debt collector will pay restitution and civil penalties of almost $30,000.

Multistate

• A bipartisan group of 42 state attorneys general sent a letter to Congress urging it to pass the Homebuyers Privacy Protection Act of 2025 (“HPPA”). The HPPA, if enacted, would curb the use of mortgage trigger leads to only situations in which a business has a current or prior relationship with the consumer or the consumer has explicitly consented. The letter cites the “barrage of calls and texts” consumers receive after applying for a mortgage, as a result of trigger leads, as the reason the legislation is necessary.
• In May, the California DFPI and 11 state attorneys general sent a letter to the CFPB’s Acting Director, Russell Vought, urging him to release restitution funds for victims of a now-defunct company that had provided vocational sales training to consumers. The CFPB, DFPI, and 11 state attorneys general brought an enforcement action against the company in bankruptcy court in 2023 and obtained a judgment requiring the company to pay $4.2 million in consumer restitution. Because the company was insolvent, the CFPB’s Civil Penalty Fund was going to be used to compensate consumers. The CFPB had been providing updates to the states on the progress of disbursing the restitution funds, but it abruptly stopped in February of 2025 when Vought took over the agency. Following receipt of the letter from the state attorneys general and DFPI, the CFPB finally released the $4.2 million in restitution funds.

Join us for a webinar highlighting anticipated state AG enforcement trends on September 17, 2025 at 2:00 pm ET. Click here to learn more about Hudson Cook’s State Enforcement Practice.