Statutory Damages Explained: How U.S. Laws Such as CIPA, VPPA, and TCPA Can Turn Tracking Code and AI Training into High-Stakes Lawsuits

Several U.S. laws set statutory damages for each violation: CIPA provides for $5,000 per violation or three times the actual damages; the TCPA provides for $500 per illegal call or text message, which can increase to $1,500 for willful violations; and BIPA provides for $1,000 for negligence and $5,000 for intentional violations. In August 2025, a federal jury in San Francisco found that Meta violated CIPA by receiving reproductive health data through the Flo app’s SDK, and the plaintiffs subsequently requested a partial judgment of about $1.1 billion.