Terms Unconditional

Companies

Every company record in the dataset, worst first. Rows marked unverified have not been checked against a primary source.

Results

Skechers U.S.A.

F500 Retail & Grocery · unverified

Footwear sold through retailers and company stores.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Slack (Salesforce)

Consumer Apps · unverified

Slack and its parent Salesforce filed a lawsuit against Microsoft in a LONDON court (April 2026), accusing it of illegally bundling Teams with Office to…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Snapchat (Snap Inc.)

Consumer Apps · unverified

Same pattern as TikTok (this same tab): Snap has settled youth-safety bellwether cases just before trial, both in a state personal-injury case (early 2026)…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Sonic Automotive

F500 Auto & Dealerships · unverified

Disclosed CDK-related disruption to the SEC in June 2024 alongside Lithia, Group 1, Penske, AutoNation and Asbury.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Spirit Airlines

Global Airlines (Top 40) · unverified

Spirit ceased all flight operations on May 2, 2026 and is being liquidated; the analysis below describes its fare model while it operated.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Spotify

Consumer Apps · unverified

A lawsuit alleges Spotify's 'personalized' recommendations aren't actually based on YOUR listening taste at all…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

State Farm

Insurance · unverified

A federal class action alleges State Farm's automated claims system routes Black homeowners into a 'high touch' track - more documentation demanded, more…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Steak 'n Shake

Car Rental & Grocery-Restaurant · unverified

The BIPA class action (Massel v. Steak N Shake) concerns CUSTOMERS, not employees: it alleges the chain's self-service ordering kiosks used facial recognition…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Stryker

F500 Pharma & Biotech · unverified

Stryker discovered a cybersecurity incident in March 2026 - recent enough that scope and data types were still developing as of this pass, and no figures are…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

StubHub

Consumer Apps · unverified

A July 2026 proposed class action (Sanquini v. StubHub, S.D.N.Y.; sent to individual arbitration and stayed by Judge Rakoff on Sept 14, 2026) alleges…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Substack

Media, News & Creative Apps · unverified

The February 2026 disclosure involved a third party exploiting a flaw - a confirmed and very recent breach.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Sunrun

Library, Fitness & Home · unverified

The January 2017 breach came from a hacker impersonating Sunrun's CEO to obtain employee data - a business email compromise, which is social engineering…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Swiss International Air Lines

Global Airlines (Top 40) · unverified

SWISS self-disclosed a 2025 breach that was employee-facing rather than passenger-facing - worth recording precisely, because employee data breaches at…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

T-Mobile

Carriers · unverified

T-Mobile's Terms & Conditions are very long (a count of 71 pages / 20,116 words has been cited but was not verified in this review), and plaintiffs in Panchal…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

T-Mobile Home Internet

Internet Providers · unverified

T-Mobile was one of the six ISPs compelled to produce records in the FTC's study, and Home Internet has no separate privacy framework - the wireless policy…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

TCL (Smart TVs)

Smart TVs & Connected Devices · unverified

TCL is one of three TV makers still fighting Texas over automated content recognition.

Severity 3 of 5, not independently verified.
Last verified 23 days ago
Unassigned

TEFCA / QHINs (federal framework)

EHR & Health Data Systems · unverified

TEFCA is the federal government's framework for nationwide health-record exchange.

Severity 3 of 5, not independently verified.
Last verified 24 days ago
Unassigned

THOR Industries

F500 Misc Remainder · unverified

Recreational vehicle manufacturer selling through independent dealers.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Talkspace (Universal Health Services)

Retirement & Telehealth · unverified

Talkspace uses AI tools to analyze anonymized therapy-session transcripts and launched an AI mental-health chatbot, 'Tee,' in June 2026.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Telegram

Consumer Apps · unverified

Telegram markets itself as the private alternative to WhatsApp — but ordinary 'cloud chats' are NOT end-to-end encrypted by default…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Temu

Consumer Apps · unverified

Court filings cite expert claims that Temu's app loads tools capable of executing 'virulent and dangerous MALWARE AND SPYWARE activities' on your phone…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

The Home Depot

Online Retailers (Top 10) · unverified

Home Depot has the most extensively documented surveillance-related findings of any retailer in this tracker, and the structural reason is that a home…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

The Trade Desk (UID2)

Ad Tech & Identity · unverified

The Trade Desk built Unified ID 2.0 (UID2) as the industry's 'privacy-safe' replacement for third-party cookies, but UID2 is built from hashed email addresses…

Severity 3 of 5, not independently verified.
Last verified 23 days ago
Unassigned

Ticketmaster / Live Nation

Consumer Apps · unverified

Internal Live Nation/Ticketmaster communications, entered as evidence in the federal antitrust trial the company LOST in April 2026, reportedly included staff…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

TikTok

Consumer Apps · unverified

TikTok has repeatedly settled individual bellwether lawsuits over child-safety allegations RIGHT BEFORE trial was set to begin…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Toyota App / Toyota Connected Services

Auto Apps · unverified

A customer lawsuit alleges that a Toyota affiliate shared driving data with insurers like Progressive, and a federal judge ORDERED THE CASE INTO ARBITRATION…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Truist

Banks (DMV) · unverified

Truist's Mutual Arbitration Agreement — the clause that takes away your right to sue in court — sits near the end of a long online/mobile banking agreement…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

TurboTax (Intuit)

Consumer Apps · unverified

A data-breach class action reportedly filed July 1, 2024 in California federal court…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

US Cellular (UScellular)

Carriers · unverified

USCellular's contract contains a blunt, all-caps-style refusal built right into the legal language…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Uber (rides + Uber Eats + Uber One)

Consumer Apps · unverified

Uber markets Uber One as 'cancel anytime.'

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Ulta Beauty

Retail & Fintech · unverified

The BIPA class actions concern Ulta's GLAM Lab virtual try-on, and the mechanism is the point: a feature that lets you see how lipstick would look requires…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Universal Health Services

F500 Telecom & Consumer Svc · unverified

UHS is the parent of Talkspace, whose findings are documented in the Retirement & Telehealth tab and are among the most serious in this tracker.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Unum

F500 Insurance Carriers · unverified

Unum is the parent of Colonial Life, already documented in Life-Health-Dental, and the group structure is the finding worth carrying…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Venmo (PayPal)

Consumer Apps · unverified

In 2018, the FTC said Venmo misled consumers about how far they could control the privacy of their transactions, which were public by default.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Verisk (consumer driving/insurance data)

Credit Bureaus & Data Brokers · unverified

Verisk built 'Driving Behavior Data History Reports' for auto insurers from driving data supplied by General Motors, Honda and Hyundai vehicles.

Severity 3 of 5, not independently verified.
Last verified 23 days ago
Unassigned

Verizon 5G Home Internet / LTE Home Internet

Internet Providers · unverified

Same shared Verizon privacy policy as Fios and Verizon Wireless - no separate framework for the home product at all.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Verizon Fios

Internet Providers · unverified

Verizon was one of the six ISPs in the FTC's 6(b) study, and it was the only one where the FTC also had to issue orders to TWO affiliated advertising entities…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Verizon Prepaid / Visible

DMV Misc (Parking-Telecom) · unverified

Same parent-company data practices as Verizon Wireless, documented in the Carriers tab - one policy, several brands.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Voya Financial

Retirement & Telehealth · unverified

Voya's 2016 breach produced an SEC settlement in 2018 that was the first enforcement action under the Identity Theft Red Flags Rule - a genuinely notable…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Walt Disney

F500 Entertainment & Leisure · unverified

The May 2026 biometric lawsuit is the current finding, and Disney occupies an unusual position in this tracker because its customer base is disproportionately…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Warner Bros. Discovery (Max/HBO)

F500 Entertainment & Leisure · unverified

Corporate parent of HBO Max (branded 'Max' from 2023), documented elsewhere in this tracker.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Wayfair

Consumer Apps · unverified

A federal district court enforced Wayfair's web-based arbitration clause against a customer's proposed class action…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Wegmans

Regional Grocery & Restaurants · unverified

Wegmans was penalised by the New York Attorney General over a breach in 2022, and the cause is the kind that is hardest to defend…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Western Digital

F500 Tech & Semiconductors · unverified

Confirmed 2023 incident: after a network intrusion identified March 26, 2023, an unauthorized party copied Western Digital's online-store customer database…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Western Union

Travel & Transit Apps · unverified

The proposed class action over data sharing matters more than its size suggests because of who uses money transfer services…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

WhatsApp (Meta)

Consumer Apps · unverified

WhatsApp's entire brand promise is 'end-to-end encrypted' — not even Meta can read your messages.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Whitepages

Credit Bureaus & Data Brokers · unverified

Whitepages has been sued twice over using people's names in free 'teaser' profiles that advertise its paid Premium reports.

Severity 3 of 5, not independently verified.
Last verified 23 days ago
Unassigned

Wise (formerly TransferWise)

Travel & Transit Apps · unverified

Wise disclosed in mid-2024 that some customers' data may have been stolen in the Evolve Bank & Trust breach (a former US partner bank).

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Wish

Consumer Apps · unverified

Wish built its business as a marketplace for ultra-cheap goods from independent sellers and drew sustained criticism for poor-quality and counterfeit goods…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned