History shows that large companies do not always correct harmful or unlawful practices simply because consumers complain, employees raise concerns, or the dangers become publicly known. In many cases, the conduct continues until a major lawsuit, government enforcement action, or substantial financial penalty changes the company’s calculation.
The reason is uncomfortable but straightforward: corporations respond to financial incentives. If a questionable practice generates millions or billions of dollars while the expected consequences remain limited, continuing the practice may appear financially rational. Compliance becomes more likely only when the expected cost of refusing to comply exceeds the revenue or other benefit produced by the conduct.
This pattern has appeared in product-safety cases, banking scandals, environmental fraud, tobacco litigation, deceptive sales practices, and consumer-privacy enforcement. Today, the same calculation may influence how companies approach website tracking and the collection of personal information.
The McDonald’s hot-coffee case is frequently described as an example of a consumer receiving millions of dollars after carelessly spilling ordinary coffee. The actual evidence presented to the jury told a much different story.
In 1992, 79-year-old Stella Liebeck suffered third-degree burns after McDonald’s coffee spilled into her lap. She was hospitalized and underwent skin grafting. Evidence presented during the case showed that McDonald’s served its coffee at approximately 180 to 190 degrees Fahrenheit and had previously received numerous reports involving customers burned by its coffee.
A jury found McDonald’s liable and awarded Liebeck compensatory and punitive damages. The punitive-damages award was intended to do more than compensate one injured customer. It was intended to make continued disregard of a known danger financially significant. Cornell Law School’s summary of the case explains the jury’s findings and the damages awarded.
The case should be described accurately. It was a civil product-liability case, not a criminal prosecution or a finding that McDonald’s had committed a crime. Nevertheless, the case demonstrates an important principle: prior reports of harm may not change a company’s conduct when responding to those reports remains less expensive than changing the underlying practice.
Punitive damages exist partly to address situations in which ordinary compensation is not enough to deter repeated or reckless conduct.
For decades, major tobacco companies publicly disputed or minimized the health effects and addictiveness of cigarettes. This continued even as internal information and scientific research demonstrated the serious risks associated with smoking.
The federal government eventually brought a civil lawsuit under the Racketeer Influenced and Corrupt Organizations Act. Following a lengthy trial, a federal court found that the defendant tobacco companies had participated in a coordinated campaign to deceive the American public about smoking’s health effects, nicotine addiction, secondhand smoke, and the design of cigarettes.
The companies were ordered to publish corrective statements in newspapers, on television, on their websites, on cigarette packages, and in retail stores. The Department of Justice explained that the court found the defendants had “lied, misrepresented, and deceived the American public” regarding numerous aspects of smoking and addiction. The Department of Justice’s account of the tobacco racketeering case documents those findings.
Warnings, public criticism, and medical research were not enough to produce complete transparency. It took years of litigation and a court order requiring the companies to correct their public representations.
From 2002 through 2016, Wells Fargo employees opened millions of accounts and financial products that customers had not authorized. The conduct was driven by aggressive and unrealistic sales goals that placed intense pressure on employees to increase the number of products assigned to each customer.
Employees created false records, misused customers’ identities, opened accounts without permission, and sometimes transferred money between accounts to make unauthorized products appear funded. These practices continued for years before the scandal resulted in major government action.
In 2020, Wells Fargo agreed to pay $3 billion to resolve criminal and civil investigations. According to the Department of Justice, the bank admitted that its sales practices led thousands of employees to provide millions of products under false pretenses or without customer consent. The Justice Department’s Wells Fargo announcement describes the conduct and the resulting resolution.
The scandal was not the work of one employee acting briefly without detection. It grew within a corporate system that rewarded results and punished employees who failed to reach sales targets. The misconduct became deeply embedded because the incentive structure prioritized sales numbers over customer consent.
The system changed only after investigations, public exposure, regulatory intervention, and billions of dollars in consequences made the conduct impossible to defend.
Volkswagen marketed diesel vehicles as environmentally responsible while installing software designed to detect emissions testing and alter vehicle performance during the test. Under normal driving conditions, affected vehicles emitted significantly more pollution than permitted.
This was not merely a failure to discover an accidental technical defect. The technology was designed to make regulators believe the vehicles complied with emissions requirements when they did not.
Volkswagen eventually agreed to spend up to $14.7 billion addressing claims involving approximately 500,000 vehicles, consumer compensation, vehicle buybacks, pollution mitigation, and investments in zero-emission technology. The company later agreed to plead guilty and pay additional criminal and civil penalties. The Department of Justice’s Volkswagen announcement describes the relief imposed after the scheme was uncovered.
Volkswagen changed course when regulators discovered the deception and the cost became enormous. Until then, cheating the test allowed the company to advertise environmental benefits and vehicle performance that it could not lawfully provide at the same time.
Privacy enforcement provides some of the clearest modern examples of companies changing only when the financial consequences become substantial.
In 2019, Facebook agreed to pay a record $5 billion civil penalty to resolve allegations that it violated an earlier Federal Trade Commission privacy order. The FTC alleged that Facebook deceived users about their ability to control the privacy of their personal information.
The order imposed new restrictions, oversight requirements, documentation duties, and privacy-review procedures on the company. At the time, the FTC described the penalty as the largest ever imposed on a company for violating consumer privacy. The FTC’s Facebook announcement explains the penalty and accompanying restrictions.
The most important part of the case was not only the size of the fine. Facebook had already been subject to an FTC privacy order. The record penalty arose from allegations that the company violated restrictions that were already supposed to govern its conduct.
That history undermines the assumption that a warning, policy, or initial enforcement action will necessarily change a company’s behavior. If the underlying business model continues to reward aggressive data collection, even an earlier regulatory action may be viewed as a manageable obstacle.
In 2023, the FTC finalized an order requiring online counseling company BetterHelp to pay $7.8 million and prohibiting it from sharing consumers’ health information for advertising.
The FTC alleged that BetterHelp disclosed information—including email addresses, IP addresses, and answers to personal health questions—to advertising platforms despite promising consumers that their information would be used only for limited purposes.
According to the FTC’s complaint, using this information for advertising brought BetterHelp hundreds of thousands of new users and millions of dollars in additional revenue.
The company’s privacy representations did not prevent the alleged sharing. Government enforcement did.
The resulting order prohibited BetterHelp from sharing health information for advertising and retargeting and required the company to obtain affirmative consent before disclosing certain personal information. The FTC’s BetterHelp announcement explains the allegations and restrictions.
BetterHelp is particularly relevant to website privacy because the case involved familiar digital-advertising technologies rather than an exotic surveillance system. Email addresses, IP addresses, questionnaire responses, and advertising identifiers can appear technical or ordinary when viewed separately. When combined and transmitted for advertising, however, they can reveal deeply personal information about an identifiable consumer.
In 2022, the FTC announced agreements requiring Epic Games, the developer of Fortnite, to pay a total of $520 million over alleged privacy violations and unwanted charges.
The resolution included a $275 million penalty for alleged violations of the Children’s Online Privacy Protection Act and $245 million in consumer refunds relating to alleged billing practices and digital design techniques known as dark patterns. Epic was also required to adopt stronger privacy defaults for children and teenagers. The FTC’s Epic Games announcement details the two resolutions.
Once again, the most substantial changes arrived with an enforcement action carrying hundreds of millions of dollars in consequences.
A similar cost-benefit calculation may explain why some companies continue allowing tracking pixels, advertising scripts, cookies, analytics tools, and software development kits to collect or transmit information before a visitor has provided meaningful consent.
The company receives the benefit of tracking across its entire audience. It can measure advertising campaigns, build customer profiles, retarget potential buyers, analyze behavior, improve attribution, and increase conversions. The financial value can be spread across millions of website visits.
The costs of noncompliance, however, may initially appear distant or uncertain. Many consumers do not understand how website-tracking technology operates. Others may notice a privacy banner and reasonably assume that no optional tracking will occur until they make a selection.
That creates a dangerous financial incentive: the company can receive the commercial benefit of collecting information across its entire audience while facing consequences only if regulators, courts, or the public force it to change.
If aggressive data collection produces millions of dollars in advertising value, customer insights, and increased sales, a company may consider legal expenses and occasional regulatory penalties less costly than changing its systems for every visitor.
This does not establish that every use of a tracking pixel is unlawful. The legal outcome depends on the information involved, the promises made to visitors, the timing of the transmission, the consumer’s consent, the parties receiving the information, and the laws of the applicable jurisdiction.
But when a company tells visitors that tracking is optional while third-party transmissions occur before the visitor makes a choice, there is an obvious gap between the company’s representation and the actual operation of its website.
Consumers commonly describe the collection of their information without informed consent as “stealing data.” Companies and their lawyers will usually reject that terminology because theft has a particular legal meaning and privacy disputes may arise under consumer-protection, wiretap, communications, health-privacy, or data-protection laws.
The precise legal label may be disputed, but the economic reality remains.
A company can receive valuable information from a consumer without paying that consumer. It may use the information to improve advertising, identify audiences, follow visitors across websites, measure purchases, predict behavior, or create detailed profiles. The consumer loses control over personal information, while the company and its advertising partners receive the commercial benefit.
When questioned, a company may argue that the information was not sensitive, did not identify anyone, was automatically generated, or was handled entirely by an outside vendor. It may characterize a transmission as a cookie, technical event, analytics request, or ordinary business record instead of acknowledging what the technology allowed another company to learn.
These distinctions may matter legally. They should not be used to avoid the most important factual questions: What information left the consumer’s device? Who received it? When did the transmission occur? What permission existed at that moment?
Many businesses appear to believe that displaying a consent banner proves compliance. It does not.
A banner is simply an interface. Compliance depends on what the website actually does before, during, and after the consumer makes a selection.
If advertising pixels fire before the visitor accepts tracking, the banner may be misleading. If selecting “Reject All” still permits nonessential third-party transmissions, the choice may be meaningless. If the company categorizes advertising technology as “necessary” solely to avoid obtaining consent, that label does not change the technology’s actual purpose.
Companies sometimes blame consent-management vendors when these failures are discovered. But a business chooses its vendors, controls its website, benefits from the information collected, and is responsible for determining whether its representations are accurate.
A company should not be permitted to use a privacy banner as a shield while its technical systems operate in direct conflict with the choice displayed to the consumer.
Companies may dismiss website privacy failures as minor technical issues because one person’s browsing activity appears insignificant. That ignores the scale of automated data collection.
A single website configuration can affect thousands or millions of visitors. A tracker that activates automatically does not make an individual decision each time someone visits. It performs the same programmed function repeatedly and at scale.
That means the financial consequences of unlawful data collection should reflect the scope of the conduct—not merely the value a company assigns to one person’s browsing activity.
Meaningful enforcement changes the calculation. Regulatory penalties, court judgments, mandatory technical changes, outside monitoring, and public accountability can make noncompliance more expensive. When the financial and reputational consequences become substantial, respecting consumer privacy becomes the better business decision.
Without meaningful enforcement, privacy laws risk becoming suggestions. A company can publish a privacy policy, display a banner, make reassuring promises, and continue operating the same data-collection systems behind the scenes.
History teaches that corporate promises are not enough. McDonald’s had received prior reports of burns. Tobacco companies had decades of scientific evidence. Wells Fargo had internal information about unauthorized accounts. Volkswagen knew what its emissions software was designed to do. Facebook was already operating under an FTC privacy order.
The decisive change came when courts, regulators, and the public imposed consequences large enough to alter the financial calculation.
Website privacy will likely follow the same pattern. Companies will not universally stop questionable tracking practices because consumers ask politely. Some companies will change because responsible leadership recognizes the problem. Others will change only when collecting and transmitting information without valid consent becomes more expensive than respecting the consumer’s choice.
Until then, some businesses may continue treating privacy penalties and legal expenses as the price of obtaining commercially valuable data.
The solution is meaningful accountability: financial consequences tied to the scale of the conduct, technical correction rather than changes to policy language alone, independent testing, greater transparency, and requirements that cannot simply be absorbed as another cost of doing business.
A privacy right that is cheaper to violate than to honor is not a meaningful right. It is merely an optional expense on a corporate balance sheet.
My name is Joseph Sides. I am a Florida-based privacy advocate, data privacy consultant, entrepreneur, and writer focused on digital transparency and consumer protection. My work examines tracking pixels, cookies, analytics tools, software development kits, and other technologies companies use to collect, transmit, and profit from consumers’ personal information.
I research how modern websites interact with third-party advertising and analytics platforms and advocate for meaningful consent, stronger consumer protections, responsible data practices, and greater corporate accountability. I believe consumers deserve to know what information companies collect, where that information is sent, and how it is ultimately used.
I hold a bachelor’s degree in criminology with a minor in business from Florida State University. My background in analytical research, business, and data privacy informs my writing about online tracking and corporate data practices.
Outside of my professional work, I am an entrepreneur, family man, charitable supporter, and dog lover. I write practical articles to help consumers better understand digital privacy and the ways companies profit from personal information.
This article is for general informational purposes only and does not constitute legal advice. References to allegations, penalties, and government actions should not be interpreted as findings beyond those made by the relevant courts or agencies. Whether a particular website practice violates the law depends on the specific facts, technology, representations, consent process, jurisdiction, and applicable law.