Every claim traceable to a cited source. Every row shows how verified it is.
How 1,036 company records treat their customers: what they collect and share, whether they force arbitration, and what has leaked.
Start with your own
Pick a company you already pay. Choosing a company opens its page.
The Toxic Ten
The most severe findings among the 31 that have passed review for publication. Drafts are left out however severe. Ranked by severity, then alphabetically; rows with the same severity are tied.
Allstate's subsidiary Arity paid app developers millions of dollars to bury a tracking SDK inside apps that had nothing to do with insurance - Life360…
Severity 5 of 5.
UnassignedEvidence tier: Unassigned (no legal tier assigned; source types: regulator)
The 2018 breach is the most-studied GDPR case in aviation because of what the regulator found: attackers reached BA's systems and harvested payment card…
Severity 5 of 5.
UnassignedEvidence tier: Unassigned (no legal tier assigned; source types: regulator)
The CFPB ordered Cash App's parent company to pay UP TO $120 MILLION back to defrauded customers plus a separate $55 MILLION penalty, finding Cash App failed…
Google Photos face grouping is the other biometric claim set in the $1.375 billion Texas settlement, and Google separately paid $100 million to settle an…
Humana was sued in 2023 over the same nH Predict algorithm at issue in the UnitedHealth case - the naviHealth-built tool that estimates how long a Medicare…
The 2023 breach hit Johnson & Johnson's PATIENT ASSISTANCE programme - the mechanism through which people who cannot afford a drug apply for help paying for it.
Severity 5 of 5.
UnassignedEvidence tier: Unassigned (no legal tier assigned; source types: none)