CASE OVERVIEW

| | |

|---|---|

| Article Type | Roundup |

| Vertical | Privacy, Data & TCPA |

| Cases Covered | 3 |

| Published | March 2026 |

Privacy & Data Litigation Roundup: Healthcare Breaches, a CCPA Settlement, and TCPA Trouble for eXp Realty

March 2026 — Three developments in privacy and data litigation are worth watching this month, from ongoing data breach investigations in healthcare and finance to a California privacy enforcement settlement and a real estate company facing mounting federal litigation over alleged unwanted calls.

Data privacy enforcement is showing no signs of slowing in early 2026. According to a roundup of active data breach investigations covering healthcare and financial organizations, consumers across multiple industries may have had sensitive personal information exposed without their knowledge. Meanwhile, California regulators reached a seven-figure settlement over consumer opt-out violations, and a federal court allowed a TCPA class action against eXp Realty to move forward despite the company's efforts to have it dismissed.

Here's what you need to know about each development.

1. Data Breach Investigations: Healthcare and Financial Organizations

Status: Active investigations — lawsuits being evaluated

Who May Qualify: Consumers who received data breach notices from healthcare providers, health insurers, hospitals, financial institutions, or related organizations

Potential Compensation: Varies by case; may include reimbursement for out-of-pocket losses, credit monitoring costs, and statutory damages depending on the claims involved

Healthcare and financial organizations hold some of the most sensitive personal data a consumer can share — Social Security numbers, medical histories, banking credentials, and insurance records. When that data is exposed, the consequences can extend well beyond a notification letter in the mail.

Multiple investigations are currently underway into data breaches affecting organizations in these sectors, according to the roundup. The types of data allegedly exposed in various incidents include names, dates of birth, financial account information, and Social Security numbers — categories of information that researchers and regulators have linked to elevated risk of identity theft and financial fraud.

Consumers who received a breach notification letter from a healthcare provider, hospital, insurer, or financial institution in recent months may be eligible to participate in future class action litigation if lawsuits are filed or certified. In many data breach cases, proof of purchase is not required — receiving a notice of the breach may be sufficient to establish potential eligibility.

To learn more: Review the active investigations listed in the data breach lawsuit roundup to see whether an organization you've interacted with is currently under investigation.

2. CalPrivacy v. PlayOn Sports — CCPA Enforcement Settlement

Settlement Date: February 27, 2026

Settlement Amount: $1.1 million

Who Was Affected: Users of PlayOn's digital ticketing and streaming platform

California's privacy enforcement office, CalPrivacy, reached a $1.1 million settlement with PlayOn Sports on February 27, 2026, resolving allegations that the company violated the California Consumer Privacy Act (CCPA).

PlayOn operates a digital platform used by schools and youth sports organizations for ticketing, live streaming, fundraising, concessions, and merchandise. According to the settlement, CalPrivacy alleged that PlayOn unlawfully "sold" and "shared" users' personal information without providing sufficient opt-out mechanisms or adequate notice — both of which are requirements under California's landmark privacy law.

The CCPA grants California residents the right to know what personal data is being collected about them, the right to opt out of the sale or sharing of that data, and the right to receive clear disclosure about how their information is used. The settlement resolves allegations that PlayOn's practices fell short of those standards.

This enforcement action is notable in part because of PlayOn's user base: the platform is heavily used in educational and youth sports contexts, meaning the personal information at issue may include data from minors and families.

CalPrivacy did not announce a consumer claims process as part of this enforcement settlement, which was a regulatory action rather than a private class action. However, the case signals continued scrutiny of how platforms handle consumer opt-out requests under state privacy laws.

3. Soale v. eXp Realty — TCPA Class Action Survives Dismissal

Case: Soale v. eXp Realty, 2026 WL 653629 (March 9, 2026)

Status: Active litigation — motion to dismiss denied

Who May Be Affected: Individuals who allegedly received unsolicited calls from eXp Realty agents without prior express consent

A federal court declined to dismiss a Telephone Consumer Protection Act (TCPA) class action against eXp Realty on March 9, 2026, allowing the lawsuit to proceed toward discovery and potential class certification.

The lawsuit, Soale v. eXp Realty, centers on allegations that calls were made by an eXp Realty agent in violation of the TCPA — the federal law that restricts the use of autodialers and prerecorded messages and governs calls to numbers listed on the Do Not Call registry. Under the TCPA, consumers who receive violating calls may be eligible for statutory damages of $500 per call, or up to $1,500 per call if violations are found to be willful.

The court's refusal to dismiss the case is a significant procedural development. It means the plaintiff's legal theory was sufficient to survive early challenge, and the case will now move forward. The outcome of class certification — which would determine whether other consumers who received similar calls could join the case — remains to be seen.

According to reports, eXp Realty is facing multiple TCPA actions, suggesting the March 9 ruling may not be an isolated development. The company has not been found liable, and the allegations remain contested.

Consumers who believe they received unsolicited calls from real estate agents or companies without their consent may want to consult with an attorney to understand whether their situation could be relevant to pending or future litigation.

Key Takeaways

• Healthcare and financial data breach investigations are ongoing. If you've received a breach notification letter from a hospital, insurer, or financial institution recently, that may be relevant to future class action litigation.
• CCPA enforcement is active. California's privacy regulator is pursuing real penalties for companies that fail to honor opt-out rights — not just issuing warnings.
• TCPA liability can extend to companies whose agents make calls. The eXp Realty case illustrates that businesses may face class action exposure based on the conduct of affiliated agents, not just direct employees.
• Data breach claims often don't require receipts. In many cases, receiving a breach notice or being a confirmed customer of an affected company may be enough to establish potential eligibility.
• Statutory TCPA damages can add up quickly. At $500–$1,500 per call, violations affecting large numbers of consumers can expose companies to significant potential liability.

InjuryClaims.com reports on class action lawsuits and legal developments. Nothing in this article constitutes legal advice. Eligibility for any lawsuit or settlement can only be determined by a qualified attorney.

Have you received a data breach notice recently, or been contacted with an unwanted call from a real estate company? Share your experience in the comments below.