Consumer Protection Litigation Hits a 10-Year High and AI Adds New Questions

Consumer protection litigation is climbing, even as federal enforcement filings decline. According to Lex Machina’s 2026 Consumer Protection Litigation Report, federal consumer protection filings reached 20,353 in 2025, a 31% increase over 2024 and a 10-year high. Credit reporting and telemarketing disputes were major drivers: Fair Credit Reporting Act (FCRA) cases reached 7,750, while Telephone Consumer Protection Act (TCPA) filings rose from 1,682 to 2,748. With more than 12,000 consumer protection lawsuits filed in the first half of 2026, the report suggests the upward trend is continuing.

AI is adding another layer of complexity to both credit reporting and consumer outreach. The report highlights the Federal Communications Commission’s February 2024 confirmation that the TCPA covers AI-generated human voices, along with its subsequent move to expressly codify do-not-call protections for marketing texts. On the hiring side, AI tools that combine online information with predictive models to rank applicants are drawing scrutiny under the FCRA. In Kistler v. Eightfold AI Inc., case no. 3:26-cv-01768 (N.D. Cal. filed Jan. 2026), plaintiffs allege that automated applicant profiles qualify as consumer reports and that the recruiting company supplied them without required disclosures or opportunities to dispute errors; those claims are pending, not yet established violations.

Data breach litigation is also rising, reaching 2,980 new cases in 2025, compared with 711 in 2022. For businesses, these trends support treating privacy, cybersecurity, marketing, and AI governance as connected risk-management priorities rather than separate compliance exercises. A practical starting point is to review consent and opt-out workflows, examine what data recruiting and screening vendors collect and how they generate scores, and revisit incident-response readiness. Vendor diligence should go beyond whether a tool works to address how its data practices and outputs could create legal exposure. Businesses should evaluate the underlying activity, not just the technology’s label.