Privacy Fines and Enforcement Tracker
Privacy fines, settlements, lawsuits and new rules from the EU, UK, US and beyond, checked against the regulator’s own announcements. Search by country, law, company or reason, and see how to avoid the same mistakes.
- Cases and rules
- 225
- Countries
- 41
- Last updated
Upcoming deadlines
Dec 2026
Apple ATT prompt changes for EU apps in iOS 27.2Dec 10, 2026
Australia Children's Online Privacy Code due to be registeredDec 10, 2026
Australia: privacy policies must disclose automated decision-makingJan 1, 2027
Colorado automated decision-making law (SB 26-189) takes effectJan 1, 2027
Delaware privacy law amendments (HB 380) take effectJan 1, 2027
Louisiana Data Privacy Act takes effect
Latest privacy fines, lawsuits and rules
Last updated
No cases match your search.
- Rule or deadlineUpcoming
India DPDP Rules: core data fiduciary obligations take effect
India Ministry of Electronics and IT (MeitY), India, Other privacy laws
Reason
This is the third phase of the DPDP Rules notified in November 2025. Notice and consent standards, data fiduciary duties, children's data rules, data principal rights and cross-border transfer rules apply 18 months after notification.
Result
In force from 2027-05-13
- Rule or deadlineUpcoming
Alabama Personal Data Protection Act takes effect
Alabama Legislature, Alabama, US state laws
Reason
HB 351 gives Alabama a comprehensive privacy law covering businesses that process data of more than 25,000 consumers or get more than 25% of revenue from selling personal data. The Attorney General enforces it, with a 45-day cure period and penalties of up to $15,000 per violation.
Result
In force from 2027-05-01
- Rule or deadlineUpcoming
IAB TCF 2.4 applies to mobile apps and CTV
IAB Europe, European Union, IAB TCF
Reason
Apps and connected TV using the Transparency and Consent Framework must run TCF 2.4. Websites moved on October 23, 2026.
Result
Applies to apps and CTV from February 23, 2027
- Rule or deadlineUpcoming
California Opt Me Out Act: browsers must offer an opt-out signal
California legislature, California, CCPA / CPRA
Reason
Companies that make web browsers must include a setting that sends an opt-out preference signal such as Global Privacy Control.
Result
In force from January 1, 2027
- Rule or deadlineUpcoming
CCPA automated decisionmaking technology (ADMT) rules apply
California Privacy Protection Agency, California, CCPA / CPRA
Reason
Businesses using automated decisionmaking technology for significant decisions about consumers must comply with the CCPA ADMT regulations. Under the same rules, risk-assessment attestations are due by 1 April 2028, and cybersecurity audit certifications are due between April 2028 and April 2030 depending on revenue.
Result
In force from 2027-01-01
- Rule or deadlineUpcoming
Oklahoma consumer data privacy law (SB 546) takes effect
Oklahoma Legislature, Oklahoma, US state laws
Reason
SB 546 covers controllers that process data of 100,000 Oklahoma consumers, or 25,000 if more than half their revenue comes from data sales. It counts only sales for money, does not require honouring universal opt-out signals, and keeps a permanent 30-day cure period.
Result
In force from 2027-01-01
- Rule or deadlineUpcoming
Louisiana Data Privacy Act takes effect
Louisiana Legislature, Louisiana, US state laws
Reason
SB 386 (Act 502) applies to businesses with more than $25M in revenue, or that handle data of 75,000 residents, households or devices, or that get 50% of revenue from selling data. Specific notice is required before selling sensitive or biometric data.
Result
In force from 2027-01-01
- Rule or deadlineUpcoming
Delaware privacy law amendments (HB 380) take effect
Delaware General Assembly, Delaware, US state laws
Reason
HB 380 lowers the Delaware Personal Data Privacy Act threshold from 35,000 to 10,000 consumers, adds sensitive-data categories such as neural data, and requires contracts and due diligence before disclosing data to third parties. Consumers can also ask for a list of the third parties that received their data.
Result
In force from 2027-01-01
- Rule or deadlineUpcoming
Colorado automated decision-making law (SB 26-189) takes effect
Colorado General Assembly, Colorado, US state laws
Reason
SB 26-189 repeals and replaces the 2024 Colorado AI Act. Deployers must tell consumers before automated decision-making materially influences a consequential decision, and after an adverse outcome they must explain it and offer correction and, where commercially reasonable, human review.
Result
In force from 2027-01-01
- Rule or deadlineUpcoming
Australia: privacy policies must disclose automated decision-making
Australian Parliament (Privacy and Other Legislation Amendment Act 2024), Australia, Other privacy laws
Reason
Under new APPs 1.7 to 1.9, entities that use computer programs to make decisions that could significantly affect people must say in their privacy policies what personal information is used and what kinds of decisions are made. It is a transparency duty only, with no right of review.
Result
In force from 2026-12-10
- Rule or deadlineUpcoming
Australia Children's Online Privacy Code due to be registered
OAIC, Australia, Other privacy laws
Reason
The OAIC must register a Children's Online Privacy Code by 10 December 2026 for social media and other online services likely to be accessed by children. It requires collecting only what is strictly necessary, acting in the child's best interests, reasonable age assurance, stronger consent and deletion rights, and limits on direct marketing.
Result
Registration due by 2026-12-10; commencement date not yet set
- Rule or deadlineUpcoming
Apple ATT prompt changes for EU apps in iOS 27.2
Apple, European Union, Platform policy
Reason
From iOS 27.2, apps distributed in Germany, France, Italy, Poland and Romania can only use Apple's redesigned tracking prompt. It drops the warning-style wording and adds a link to more information. Germany's competition authority gave Apple four months from its August 2026 decision to roll it out, which points to mid-December 2026.
Result
German deadline in mid-December 2026
€805M
Reason
The Facebook Android app read photos, videos and their metadata from the phone gallery to suggest posts, with the feature on by default and no specific consent.
Result
€805M fine and 60 days to turn the feature off by default and ask for separate consent
€11M
Reason
The self-service “Download My Data” tool left out some personal data, or gave only summaries, without telling users.
Result
€11M fine, reprimand and order to comply within three months; Match says it will appeal
$2.975M
Reason
FedEx said it did not sell or share personal data while it used ad trackers for cross-context behavioural advertising. It also did not honour opt-out preference signals, and its cookie controls and request form did not work for trackers.
Result
$2.975M fine, plus quarterly tracker inventories and opt-out testing
Reason
Session replay tools need prior consent, and the consent banner must mention session replay specifically on its first layer.
Result
Final recommendation published
$1.8M
Reason
Lyft sold or shared rider data for in-app targeted ads but had no in-app opt-out. Logged-in users had to follow links to a web form and re-enter details the company already held.
Result
$1.8M civil penalty, in-app opt-out and notice to Californians
Reason
Consent management platforms using the Transparency and Consent Framework had to implement the TCF 2.4 disclosures on websites by this date.
Result
Applies to websites from October 23, 2026
€7M
Reason
The Fnac app used a tracker that sent a user identifier and viewed products to a third-party recommendation service even when users had refused tracking.
Result
€7M fine and order to fix consent within one month, or €10,000 per day
- Rule or deadline
EU Council agrees its Digital Omnibus position on cookies
Council of the EU, European Union, ePrivacy (cookie rules)
Reason
Six uses of cookies would no longer need consent, and sites would wait four months before asking again after a refusal. The proposal is not law yet.
Result
Council position agreed; still to be negotiated with Parliament
$6M
Reason
A 2023 breach exposed data of nearly 7 million customers, including over 855,000 Californians. California also objected under its Genetic Information Privacy Act to the sale of customers' genetic data in bankruptcy without separate consent.
Result
$6M settlement in bankruptcy court, pending approval
€403M
Reason
Google's Web & App Activity, Location History and Location Accuracy settings processed people's location data unlawfully and without enough transparency between May 2018 and February 2020. Users may not have known their location was used to target ads or guess their interests, and the data was kept too long.
Result
€403M in fines; Google ordered to bring processing into compliance within 6 months
$36,400
Reason
The Virginia data broker sold consumers' personal information without registering in California's Data Broker Registry by the 2025 deadline.
Result
$36,400 fine, must publish privacy-rights metrics and process deletions via DROP
R$153.77M
Reason
TikTok processed children's and teens' data with no valid legal basis, both in its logged-out feed and at sign-up. Self-declared age was the only check against under-13 registration.
Result
R$153.7M fine for five LGPD violations, deletion order and compliance plan
€824.99M
Reason
Between 2018 and 2022 Uber's software automatically suspended or permanently deactivated drivers' accounts over suspected fraud or low ratings, with no human review. Drivers were also not properly told about this automated decision-making.
Result
€824.99M fine; Uber has said it will object
$400M
Reason
The DOJ sued in August 2024, after an FTC investigation, alleging that TikTok knowingly let children under 13 create accounts, collected their data without parental consent, failed to honour parents' deletion requests and violated a 2019 FTC consent order.
Result
Settled for $400M: $300M now and $100M once the 2019 Musical.ly consent decree is vacated. No liability finding and no new injunctive relief.
$275,000
Reason
From 2018 to 2022, tracking technologies on TaxAct's site sent taxpayer details such as income, refunds and dependents to advertising partners without notice, against its privacy promises.
Result
$275,000 and a tracking-technology compliance program with two independent audits
$52,400
Reason
The Boston data broker missed the 2025 deadline to register with California's Data Broker Registry under the Delete Act.
Result
$52,400 fine
$116,490
Reason
The Iowa data broker registered late and required Californians to give the last four digits of their Social Security number before they could opt out of data sales.
Result
$116,490 fine and practice changes; first action under both the CCPA and the Delete Act
₩10.3B
Reason
TikTok's ad tools collected users' activity on other websites and apps and linked it to their accounts for personalised ads. This was not clearly disclosed, and users had to consent to use the app.
Result
KRW 10.3B fine; Apple fined KRW 252M in the same session over Siri recordings
- Lawsuit
NFL Enterprises (Kimmons v. NFL Enterprises)
Alameda County Superior Court, California, CIPA (wiretapping)
Reason
The complaint counts 182 third-party trackers on NFL.com before any consent choice and 186 after a visitor declined. These are allegations.
Result
Complaint filed; no ruling yet
- Rule or deadline
UK GDPR: people can complain directly to organisations
UK Parliament, United Kingdom, UK GDPR
Reason
Organisations must accept and handle data protection complaints themselves, under a change made by the Data (Use and Access) Act 2025.
Result
In force from June 19, 2026
- Rule or deadline
Google Signals no longer controls Google Ads data from Analytics
Google, Global, Platform policy
Reason
Since June 15, 2026, Consent Mode settings, not Google Signals, decide whether Google Analytics collects Google Ads cookies and IDs. Google Signals now only links Analytics data to signed-in users for reporting. Ad personalisation controls move to Consent Mode later in 2026.
Result
Applies from June 15, 2026
₩624.681B
Reason
Poorly managed signing keys let a former employee access data on about 33 million users. Coupang also collected behavioural data on about 11 million users from outside sites and apps for targeted ads without consent.
Result
KRW 624.681B in penalty surcharges (423.575B security, 201.106B behavioural data) plus a KRW 16.8M fine
£300,000
Reason
The company sent more than 5.5 million unsolicited marketing texts, including fake bailiff messages. They led to over 60,000 complaints to the 7726 spam reporting service.
Result
£300,000 fine
$12.75M
Reason
GM sold OnStar driving and location data on hundreds of thousands of Californians to Verisk and LexisNexis without notice, while its privacy policy said it did not sell such data.
Result
$12.75M penalty (largest CCPA penalty to date), 5-year ban on selling driving data, deletion
Reason
The data broker sold location data from hundreds of millions of devices that could reveal visits to medical and religious sites, without users' knowledge.
Result
Settlement order bans selling sensitive location data without express consent; no money
Reason
France’s regulator set out when tracking pixels in emails need consent and how to ask for it.
Result
Recommendation published
- Settlement
European Wax Center (Cumor v. European Wax Center)
Florida Circuit Court, Hillsborough County (class action), Florida, CIPA (wiretapping)
$5M
Reason
The class action said waxcenter.com used pixels and other trackers to share visitor data with third parties such as Meta without consent. European Wax Center denies wrongdoing.
Result
Up to $5M class settlement, no admission of liability
€100M
Reason
The taxi app sent Finnish and Norwegian passengers' and drivers' data, including location, chats, bank details and driving licence scans, to Yandex companies in Russia without proper safeguards. The encryption was ineffective because the keys were also kept in Russia until late 2023.
Result
€100M fine on MLU B.V. (successor to Ridetech International); order to stop transfers to Russia; company says it will challenge
€31.8M
Reason
Over 35 months an employee looked up the bank data of 3,573 customers, including public figures, with no work reason, and the bank had no safeguards to stop it. The bank first told the regulator only nine people were affected.
Result
€31.8M fine
$375,703
Reason
Ford required people to verify their email address before it processed opt-out requests, a step the CCPA does not allow.
Result
$375,703 fine
$50M
Reason
Meta misled Facebook users about their control over who could access their data, including third-party app developers, in the conduct behind the Cambridge Analytica scandal.
Result
$50M civil penalties and 3-year injunction on developer data access (SF Superior Court judgment)
$1.1M
Reason
Users had to accept tracking before using tickets or the websites. PlayOn pointed people to NAI/DAA opt-out tools instead of its own and did not honour opt-out preference signals.
Result
$1.10M fine, risk assessments, opt-in for ages 13–15
- Settlement
Limited Run Games (Carbone v. Limited Run Games)
E.D. New York (class action), United States, VPPA
$2.72M
Reason
Plaintiffs said the company's video pages used the Meta Pixel to send users' video-viewing activity and identifying information to Facebook without consent.
Result
Court approved a $2.72M class settlement
£14.473M
Reason
Reddit did not check users' ages until July 2025, so it had no lawful basis to process data of under-13s who used the site anyway. It also did not assess the risks to children until January 2025.
Result
£14.47M fine; Reddit has appealed to the First-tier Tribunal
$2.75M
Reason
Opt-outs, including Global Privacy Control signals, applied only to one streaming service and device instead of the whole account.
Result
$2.75M settlement, the largest CCPA penalty at the time
Reason
The FTC alleged, in a complaint first announced in January 2025, that GM and OnStar collected and sold drivers' precise location and driving-behaviour data to consumer reporting agencies without proper consent, through a misleading OnStar Smart Driver enrolment process.
Result
Final order approved 2-0. GM may not share geolocation or driving data with consumer reporting agencies for 5 years, and must get express consent and offer access, deletion and opt-out for 20 years. No money penalty.
- Fine
Datamasters (Rickenbacher Data)
California Privacy Protection Agency, California, California Delete Act
$45,000
Reason
The unregistered Texas data broker resold lists of millions of people with health conditions such as Alzheimer's and addiction for targeted advertising.
Result
$45,000 fine and must stop selling Californians' data
$62,600
Reason
An administrative error meant S&P Global did not register as a data broker.
Result
$62,600 fine and registration auditing procedures
€42M
Reason
In October 2024 an attacker got into the telecom companies' systems and reached data on 24 million subscriber contracts, including bank account numbers (IBANs). Security was inadequate, and the emails telling customers about the breach left out required information.
Result
€27M fine on Free Mobile and €15M on Free (€42M total), plus orders to fix
- Fine
VNG (Zalo)
Vietnam Competition Commission (Ministry of Industry and Trade), Vietnam, Other privacy laws
₫810M
Reason
Zalo did not give users clear options to choose what personal data they share, or to allow or refuse its use for advertising and other commercial purposes. Its terms also contained prohibited clauses.
Result
Fined VND 810M for six breaches of the consumer protection law; TikTok was fined VND 880M separately for similar violations
€1M
Reason
A marketing processor kept a copy of more than 46 million Deezer users' data after its contract ended and used it without the client's instructions.
Result
€1M fine
$56,600
Reason
A Nevada marketing firm built and sold custom audience lists from data on over 262 million Americans without registering as a data broker in California.
Result
$56,600 in fines and past-due fees
€1.5M
Reason
The site placed advertising trackers before visitors made a choice and even after they refused. It also kept reading existing trackers after people withdrew consent.
Result
€1.5M fine
$1.4M
Reason
None of Jam City's 21 mobile games offered a compliant opt-out of sale or sharing. Some sold or shared data of 13–16-year-olds without opt-in consent.
Result
$1.4M penalty, in-app opt-outs, opt-in for ages 13–15
€750,000
Reason
Cookies were set as soon as visitors arrived, some advertising cookies were labelled strictly necessary, and refusing did not stop them.
Result
€750,000 fine; the publisher had already received a CNIL order to comply over cookies in 2021
€10.043M
Reason
The airport operator ran a facial recognition pilot at several airports without first carrying out a data protection impact assessment.
Result
€10,043,002 fine
$530,000
Reason
Sling routed opt-out requests through cookie preferences and made logged-in users re-enter data. It also had no opt-out in its living-room TV apps.
Result
$530,000 penalty, in-app opt-out, kids' profiles with targeted ads off
$1.35M
Reason
Its privacy notices left out consumers' and job applicants' rights, opt-outs did not work (including Global Privacy Control signals), and it shared data without the required contracts.
Result
$1.35M fine, tracker scans and four years of annual compliance certification
$425M
Reason
Google kept collecting app activity data through its analytics tools from about 98 million users who had switched off Web & App Activity.
Result
Jury verdict of about $425M in compensatory damages; no punitive damages; Google to appeal
$10M
Reason
The FTC alleged Disney did not label some child-directed YouTube videos as 'Made for Kids', so children's data was collected and used for targeted ads without parental consent.
Result
$10M civil penalty and a 10-year video review programme; court approved the order on Dec 31, 2025
DKK 1.5M
Reason
ILVA kept about 350,000 customer records in an old IT system with no routine for deleting or anonymising them. In Denmark the DPA recommends a fine and the courts set it.
Result
The Aarhus district court fined DKK 100,000 in 2021 for negligence. On 2 Sep 2025 the Western High Court found the breach intentional and raised the fine to DKK 1.5M, basing it on group turnover (CJEU C-383/23).
€325M
Reason
Ads shown inside Gmail inboxes and cookies set at account sign-up without valid consent.
Result
€325M fine (€200M Google LLC, €125M Google Ireland) and an order to fix both issues within six months or pay €100,000 per day
€150M
Reason
shein.com placed advertising cookies before visitors answered the banner, and the banners did not explain the advertising purpose. It kept placing and reading cookies after users clicked 'Refuse all' or withdrew consent.
Result
€150M fine on Infinite Styles Services Co. Ltd (Shein's Irish arm)
- Settlement
Google, Flo Health and Flurry (Frasco v. Flo Health)
N.D. California (class action), United States, CIPA (wiretapping)
$59.5M
Reason
Flo app users said their menstrual and pregnancy data was shared through third-party SDKs with Google, Flurry and Meta between November 2016 and February 2019, in violation of the California Invasion of Privacy Act.
Result
Google $48M, Flo $8M and Flurry $3.5M, with no admission of wrongdoing; the judge said on 29 Oct 2026 he would grant final approval
₩134.8B
Reason
Weak access controls and linked networks let hackers take data, including unencrypted SIM authentication keys, on more than 23 million subscribers. SKT also notified users late.
Result
KRW 134.8B fine plus KRW 9.6M administrative penalty
Reason
A jury found that Meta violated the California Invasion of Privacy Act by intentionally recording Flo app users' communications, including menstrual and pregnancy data, through its SDK.
Result
Liability verdict against Meta; post-trial motions denied in Sept 2025; no damages judgment entered as of Nov 2026
$55,400
Reason
The Washington-based data broker failed to register with the CPPA and pay the annual fee required under the Delete Act.
Result
Agreed to pay a $55,400 fine
$85,000
Reason
TicketNetwork's privacy notice was unreadable, left out key rights and had broken rights mechanisms. It did not fix these after a 2023 cure notice.
Result
$85,000; first public CTDPA enforcement
$1.55M
Reason
Healthline kept sharing data with ad partners after people opted out, including through Global Privacy Control. It also shared article titles suggesting a medical diagnosis for ad targeting.
Result
$1.55M settlement, the largest CCPA settlement at the time
€45M
Reason
Vodafone did not properly check and supervise partner sales agencies, whose staff set up fake contracts and changes at customers' expense. Weak authentication between the MeinVodafone portal and the hotline also let outsiders get eSIM profiles.
Result
€45M in fines (€15M + €30M) plus a warning
$7.25M
Reason
Patreon allegedly shared subscribers' video-viewing choices and personal information with Meta through the Meta Pixel without proper consent.
Result
$7.25M settlement granted final approval
₩1.369B
Reason
Temu sent Korean users' data to processors in China, Singapore and Japan without disclosure. It also had no domestic agent and collected sellers' ID and facial video without a lawful basis.
Result
KRW 1.369B penalty plus KRW 17.6M fine and corrective orders
€900,000
Reason
The company sent marketing texts and emails using data bought from data brokers, whose contest forms pushed people into accepting. It could not prove valid consent and passed data on to clients without a legal basis.
Result
€900,000 fine; order to stop prospecting without valid consent
$1.375B
Reason
Two 2022 Texas lawsuits alleged Google tracked location, incognito searches and biometric data such as voiceprints and facial geometry without consent.
Result
$1.375B settlement; no admission and no product changes required
- Fine
Jerico Pictures (National Public Data)
California Privacy Protection Agency, California, California Delete Act
$46,000
Reason
The Florida data broker behind the 2024 National Public Data breach failed to register with the CPPA and pay the annual fee. The CPPA filed an administrative action against it in February 2025.
Result
Ordered to pay a $46,000 fine
$345,178
Reason
A misconfigured privacy portal failed to process opt-out requests for 40 days. The retailer also required identity verification and excess data before people could opt out.
Result
$345,178 fine, fix opt-out tools, staff training
€530M
Reason
EEA users' data was accessed remotely from China without showing equivalent protection, and TikTok did not tell users about the transfers.
Result
€530M fine and an order to comply within six months or suspend transfers to China
€14.4M
Reason
Amadeus reused travellers' personal data from its airline booking system for another product, without a legal basis and without telling the people concerned.
Result
€14.4M fine (€18M cut by 20% for immediate payment)
PLN 27M
Reason
The national post office processed PESEL register data on about 30 million adults without a legal basis while preparing the 2020 postal presidential election.
Result
Annulled by the Warsaw Administrative Court on 5 Mar 2026 (II SA/Wa 837/25), which found the post office was bound by the Prime Minister's decision. Not final; UODO can file a cassation appeal.
$632,500
Reason
Honda made people verify identity to opt out and used a privacy tool that did not present choices evenly. It also shared data with ad tech firms without the required contracts.
Result
$632,500 fine, simpler rights process, UX designer consult
Reason
The California data broker, which advertised that it could dig up 'scary' amounts of information about people, failed to register and pay the annual fee under the Delete Act.
Result
Agreed to shut down its data broker operations through 2028; a $50,000 fine is due only if it breaks the settlement
- Settlement
Key Marketing Advantage
California Privacy Protection Agency, California, California Delete Act
$55,800
Reason
The data broker failed to register with the CPPA and pay the annual fee required under the Delete Act.
Result
Settled for $55,800
$20M
Reason
The FTC said the Genshin Impact developer collected data from children under 13 without parental consent and misled players about loot box odds and costs.
Result
$20M penalty and a ban on selling loot boxes to under-16s without parental consent
Reason
The FTC alleged that Mobilewalla collected location data from real-time bidding ad exchanges and sold data revealing visits to sensitive places without checking consumer consent. It was the first time the FTC called that kind of ad-exchange collection unfair.
Result
Final order (4-1) bans selling sensitive location data and using ad-exchange bid data for anything beyond auctions. No money penalty.
Reason
The FTC alleged, in a complaint announced in December 2024, that Gravy Analytics and its subsidiary Venntel sold location data, including lists of people who visited health clinics and places of worship, without proper consent.
Result
Final order (5-0) bans selling, sharing or using sensitive location data except in limited national security or law enforcement cases. A sensitive location data programme is required. No money penalty.
$54,200
Reason
The data broker failed to register with the CPPA and pay the annual fee from 1 February to 4 November 2024.
Result
Settled for $54,200
$46,600
Reason
The data broker failed to register with the CPPA and pay the annual fee from 1 February to 20 September 2024.
Result
Settled for $46,600
A$50M
Reason
Data of 311,127 Australian Facebook users was exposed to the risk of disclosure to Cambridge Analytica via the 'This Is Your Digital Life' app.
Result
A$50M payment program via enforceable undertaking, ending Federal Court penalty proceedings
€251M
Reason
A 2018 flaw in Facebook's 'View As' feature let attackers take over tokens for about 29 million accounts, 3 million of them in the EU/EEA, exposing data including children's data. Meta's breach notice was incomplete, and its systems were not built to protect data by design.
Result
€251M fine
€950,000
Reason
Loan applications could be opened through personal customer URLs that phishers targeted. This exposed applicants' income, housing costs, marital status and children.
Result
€950,000 fine and an order to notify affected customers
€40,000
Reason
Tracking cookies were placed with pre-ticked boxes, treating continued browsing as consent.
Result
€40,000 fine
₹2.131B
Reason
The CCI found that WhatsApp's 2021 privacy policy update was forced on users on a take-it-or-leave-it basis, an unfair condition and abuse of dominance under the Competition Act, 2002.
Result
Rs 213.14 crore penalty; on 4 Nov 2025 the NCLAT (appeals tribunal) upheld it but set aside the five-year ban on sharing WhatsApp data with Meta for ads
TRY 2M
Reason
A 125 GB data leak affected 35,274 people in Turkey. KVKK found Twitch's security measures and risk assessments inadequate and that it had not reported the breach.
Result
TRY 1.75M for inadequate security plus TRY 250,000 for not reporting the breach
€50M
Reason
Mail Orange showed ads styled as emails among real messages in users' inboxes without consent. On orange.fr, cookies kept being read after users withdrew consent.
Result
€50M fine; order to stop reading cookies after consent is withdrawn, with a €100,000-a-day penalty
$35,400
Reason
The data broker failed to register with the CPPA and pay the annual fee from 1 February to 26 July 2024. It was one of the first Delete Act settlements.
Result
Settled for $35,400
$34,400
Reason
The data broker failed to register with the CPPA and pay the annual fee from 1 February to 21 July 2024. It was one of the first Delete Act settlements.
Result
Settled for $34,400
€2.4M
Reason
Posti automatically created an electronic mailbox for customers and bundled it with other services so it could not be declined. Customers were not clearly told, and a pre-ticked box was used.
Result
The Helsinki Administrative Court overturned the €2.4M fine (reported 3 Nov 2025) but kept the reprimand and the compliance order
€15M
Reason
The Garante found OpenAI trained ChatGPT on users' data without a legal basis, was not transparent enough, did not report a 2023 data breach and had no age checks.
Result
€15M fine and a 6-month awareness campaign; annulled by the Court of Rome on 18 March 2026 because the Garante had lost jurisdiction to the Irish DPC
€310M
Reason
No valid legal basis for using members’ data for behavioural advertising.
Result
€310M fine, reprimand and order to bring processing into compliance
Reason
Ordered to put “Reject all” on the first layer of its cookie banner and stop using colours that push visitors to accept.
Result
Order to change the cookie banner with daily penalties, later withdrawn by the DPA in March 2025; the complaint was closed in September 2025 after RTL changed its banner
€91M
Reason
Meta stored some users' passwords in plain text on internal systems. It also failed to notify and record this as a breach.
Result
€91M fine and a reprimand
- Order
Mediahuis (De Standaard, Het Nieuwsblad, Het Belang van Limburg, Gazet van Antwerpen)
Belgian DPA, Belgium, GDPR
Reason
After a noyb complaint, the DPA ordered Mediahuis's four news sites to add a reject option on the cookie banner wherever 'accept all' appears and to stop using misleading button colours. This replaced an earlier €10,000 settlement that had not required any banner changes.
Result
Two orders to be met within 45 days, each with a €25,000 daily penalty per website (up to €200,000 a day in total). The Market Court annulled the decision on 19 Mar 2025 (2024/AR/1690) on procedural grounds, finding noyb had abused its right to complain.
Reason
Reprimanded for setting advertising cookies before visitors could accept or reject them.
Result
Reprimand, no fine
€290M
Reason
Drivers’ personal data was transferred to the US without adequate protection.
Result
€290M fine
$1.4B
Reason
Facebook's Tag Suggestions feature, on by default, used facial recognition to collect biometric identifiers from uploaded photos without disclosure or consent.
Result
$1.4B over five years; largest single-state privacy settlement at the time
€600,000
Reason
Kruidvat.nl tracked visitors with tracking cookies without valid consent; the banner's consent boxes were ticked by default and refusing was harder. That built detailed profiles from sensitive pharmacy shopping, such as pregnancy tests and medicines.
Result
€600,000 fine
$500,000
Reason
The 'SpongeBob: Krusty Cook-Off' game used a non-neutral age screen and misconfigured SDKs, so it collected and sold children's data without parental consent.
Result
$500,000 penalty, neutral age gate, SDK governance (with LA City Attorney)
€30.5M
Reason
Clearview scraped over 30 billion photos, including of Dutch people, to build facial recognition profiles without a legal basis. It did not tell people.
Result
€30.5M fine plus orders under penalty
$7M
Reason
Through tracking tools, the telehealth firm shared sensitive mental health data on nearly 3.2 million people with LinkedIn, Snapchat, TikTok and others for advertising. It also made cancellation hard.
Result
Over $7M (about $5.1M refunds plus $2M of a $10M penalty); ban on using health data for most advertising
CZK 351M
Reason
Avast passed the browsing histories of about 100 million antivirus and browser-extension users to its subsidiary Jumpshot. It claimed the data was anonymous, but it was only pseudonymised and some people could be re-identified.
Result
CZK 351M fine, now final
Reason
The suit alleged Google tracked the browsing of Chrome users who believed Incognito mode kept them private.
Result
No damages; deletion of billions of records, clearer disclosures, third-party cookies blockable in Incognito for 5 years
$16.5M
Reason
Avast collected browsing data through its antivirus software and extensions and sold it through Jumpshot to more than 100 buyers, while promising to protect users from tracking.
Result
$16.5M and ban on selling browsing data for advertising
$375,000
Reason
DoorDash gave California customers' names, addresses and order histories to a marketing co-op. That counted as a sale under the CCPA, and it came with no notice or opt-out.
Result
$375,000 penalty, vendor contract review, annual reporting
€79.1M
Reason
Weak controls let unauthorised agencies use illegal telemarketing to sign customers up. Enel took on 978 contracts from agencies outside its sales network.
Result
€79.1M fine
£140,000
Reason
HelloFresh sent about 79 million marketing emails and 1 million texts on invalid consent, which was bundled into an age-confirmation box and did not mention texts. Some people kept getting messages after asking it to stop.
Result
£140,000 fine
Reason
The data broker sold precise, non-anonymised location data tied to ad IDs, including visits to medical clinics, without making sure users had given informed consent.
Result
First FTC ban on selling sensitive location data; deletion of data and derived products
DKK 15M
Reason
Datatilsynet reported Netcompany to the police over the mit.dk public digital mailbox. Security was not built into the design and the impact assessment was inadequate.
Result
A DPA recommendation of at least DKK 15M; the courts set the final fine. Still pending, no verdict found.
€10M
Reason
Yahoo placed advertising trackers without prior consent. It also told users that withdrawing consent would cut off key services such as Yahoo Mail.
Result
€10M fine on Yahoo EMEA; upheld by the Conseil d'État on 7 October 2025
$300,000
Reason
From 2016 to 2022, tracking tools on the hospital website sent doctor and condition searches and appointment details to tech companies, in violation of HIPAA.
Result
$300,000, vetting of tracking tools, deletion of shared data
€32M
Reason
Amazon monitored warehouse staff through their scanners, built detailed productivity indicators and kept them too long. It also did not properly inform temporary workers about this or about CCTV.
Result
€32M fine; cut to €15M by the Conseil d'État on 23 December 2025
€10M
Reason
Uber did not tell European drivers how long it kept their data or which non-EU countries it went to. It also made it needlessly hard for drivers to request their data.
Result
€10M fine
€5.47M
Reason
The debt collector processed data on non-debtors, and health data, without a legal basis. It recorded about 49,850 people's calls without a legal basis, and weak security let data on 181,641 people be taken.
Result
€5.47M fine, Croatia's largest; EOS Matrix said it would challenge it
€10M
Reason
Energy contracts were opened in people's names without their knowledge, using wrong or outdated contact details, after Axpo took customer data from sales agents without proper checks.
Result
€10M fine
€345M
Reason
Failures in how children’s data and accounts were handled.
Result
€345M fine
- Settlement
Advocate Aurora Health
Federal court, Wisconsin (class action), Wisconsin, Other privacy laws
$12.225M
Reason
The health system used Meta Pixel and Google Analytics on its website, patient portal and scheduling app, which disclosed data on about 2.5 million patients.
Result
$12,225,000 class settlement
- Settlement
Boston Globe Media Partners (Ambrose v. Boston Globe)
D. Massachusetts (class action), United States, VPPA
$4M
Reason
Subscribers alleged that the Facebook pixel on the Globe's video pages sent their video-viewing data to Facebook. Bloomberg Law called it the first Meta Pixel privacy case.
Result
$4M settlement fund; court cut the requested attorneys' fees from about $1.7M to $750,000
$75,000
Reason
The genetic testing firm left DNA and health reports in public cloud storage, misled users about deletion, and changed its privacy policy retroactively to widen sharing.
Result
$75,000 for refunds, destruction of DNA samples, consent required for sharing
€40M
Reason
Browsing data was collected through cookies on partner sites without checking that the partners had obtained valid consent.
Result
€40M fine, upheld by France's Conseil d'État in March 2026
SEK 58M
Reason
When people asked for their data, Spotify handed it over but did not clearly explain how it used that data. Technical data was not explained in a way people could understand.
Result
SEK 58M fine
$20M
Reason
Microsoft collected children's data at Xbox sign-up without notifying parents or getting consent, and kept it longer than allowed.
Result
$20M civil penalty
$25M
Reason
Amazon kept children's Alexa voice recordings and location data indefinitely, failed to honour deletion requests, and used the data to improve its algorithms.
Result
$25M civil penalty and deletion requirements
$5.8M
Reason
Ring let employees and contractors view customers' private videos and lacked basic security, so hackers took over about 55,000 accounts.
Result
$5.8M for refunds and a privacy and security program
€1.2B
Reason
Facebook user data was transferred to the US without adequate protection. The largest GDPR fine so far.
Result
€1.2B fine and order to stop the transfers
$100,000
Reason
Through SDKs, the ovulation app shared sensitive health data with AppsFlyer, Google and two China-based firms, and never told users.
Result
$100,000 Health Breach Notification Rule penalty (plus $100,000 to CT, DC and OR) and an ad-sharing ban
€380,000
Reason
The health website collected data from health quizzes without specific consent and kept it too long. It placed an ad cookie on arrival and two more even after 'Refuse all'.
Result
€380,000 total (€280,000 GDPR + €100,000 cookies)
€2.265M
Reason
The debt collection agency stated the wrong legal basis in its privacy policy and had no processor contract for a bankruptcy-monitoring service. Inadequate security exposed data on at least 132,652 people.
Result
€2.265M fine, AZOP's largest at the time
£12.7M
Reason
TikTok let large numbers of UK children under 13 use the app without parental consent and did too little to find and remove them. It also did not explain clearly how it used people's data.
Result
£12.7M fine; TikTok withdrew its appeals in September 2026 and accepted it
$7.8M
Reason
The FTC said BetterHelp shared email addresses, IP addresses and health questionnaire answers with Facebook, Snapchat, Criteo and Pinterest for advertising.
Result
$7.8M for consumer refunds and a ban on sharing health data for ads
$1.5M
Reason
GoodRx shared users' medications and health conditions with Facebook, Google and Criteo and used them to target ads, despite promising not to.
Result
$1.5M penalty (first Health Breach Notification Rule case) and a ban on sharing health data for ads
€390M
Reason
Meta relied on its contract with users (the terms of service) as the legal basis for behavioural advertising, which the DPC ruled invalid.
Result
€390M fine (€210M Facebook, €180M Instagram) and an order to comply within three months
€3M
Reason
The mobile games publisher read Apple's IDFV identifier on iPhones for advertising without consent, even after users refused tracking.
Result
€3M fine; upheld by the Conseil d'État on 14 May 2024
€5M
Reason
tiktok.com offered one-click 'accept all' but no equally easy way to refuse cookies; a 'refuse all' button only arrived in February 2022. Visitors were not told clearly enough what the cookies were for.
Result
€5M fine
€8M
Reason
Under iOS 14.6, Apple read iPhone identifiers for personalised App Store ads without asking first; ad targeting was on by default and took several steps to turn off.
Result
€8M fine; Apple said it would appeal
$520M
Reason
The FTC said Epic collected children's data without parental consent, turned on voice and text chat by default, and used dark patterns that led to unwanted purchases.
Result
$275M COPPA penalty plus $245M in consumer refunds ($520M total)
€60M
Reason
bing.com placed cookies, including advertising cookies, and did not let people refuse them as easily as accept them.
Result
€60M fine plus an order to fix
$391.5M
Reason
The states said Google misled users from 2014 about location tracking: data was still collected through settings like Web & App Activity after Location History was turned off.
Result
$391.5M settlement, the largest multistate privacy settlement in US history at the time
€4.3M
Reason
For the 2021 Census, INE used Cloudflare under terms that allowed data transfers to the US and other countries, without adequate safeguards. Other failings included information duties, processor rules and a missing DPIA.
Result
€4.3M fine, Portugal's largest; INE appealed in Jan 2023 and no final ruling was found
€20M
Reason
Clearview scraped billions of online photos, including of people in France, for facial recognition without a legal basis. It did not properly answer access and deletion requests.
Result
€20M fine and order to delete data; a further €5.2M overdue penalty in 2023 for not complying
- Settlement
Google (Google Photos, Rivera v. Google)
Circuit Court of Cook County, Illinois (class action), Illinois, Illinois BIPA
$100M
Reason
Illinois residents alleged that Google Photos' face grouping feature created face templates from their photos without the notice and written consent BIPA requires.
Result
$100M settlement granted final approval on 28 Sept 2022
€405M
Reason
Children’s contact details were made public through business accounts and public-by-default profiles.
Result
€405M fine
₩69.2B
Reason
Google did not clearly tell users it collected their behaviour on other services for customised ads, and set the consent default to 'agree'.
Result
KRW 69.2B fine and corrective order
₩30.8B
Reason
Meta collected and used users' behaviour on other websites and apps for personalised ads without getting valid consent at sign-up.
Result
KRW 30.8B fine and corrective order
$1.2M
Reason
Data was sold through third-party trackers without telling customers, and Global Privacy Control signals were ignored.
Result
$1.2M settlement
$35M
Reason
Illinois users alleged that Snapchat's Lenses and Filters scanned and stored their face geometry without the disclosures and written consent BIPA requires. Snap denied the claims.
Result
$35M class settlement for Illinois users since Nov 2015; final approval hearing set for Nov 2022
$92M
Reason
Plaintiffs alleged TikTok collected faceprints without consent under BIPA and disclosed viewing data under the VPPA.
Result
$92M settlement given final approval
CN¥8.026B
Reason
Didi illegally collected customer data from 2015, including facial recognition data and phone photos, without consent. It also stored data on 57 million drivers insecurely.
Result
CNY 8.026B fine under PIPL, Cybersecurity and Data Security laws
€20M
Reason
Clearview collected facial images of people in Greece from public websites and social networks to build searchable biometric profiles, without a legal basis or transparency.
Result
€20M fine
€220,000
Reason
The health insurer sent one person 51 emails with other people's medical clearances and test results between April 2020 and March 2021, and ignored her warnings. It did not report the breach.
Result
€220,000 proposed (€100,000 under Art. 5(1)(f) plus €60,000 for each of two further breaches); DKV paid €132,000 after the voluntary-payment and admission reductions (PS/00080/2022)
Reason
The app tracked users' location every few minutes, even when closed, after telling them it collected location only while in use.
Result
Findings of violation; Tim Hortons agreed to delete data and set up a privacy program (no fine)
$150M
Reason
Twitter collected phone numbers and emails from over 140 million users for account security, then used them for targeted ads, breaching a 2011 FTC order.
Result
$150M civil penalty
£7.553M
Reason
Clearview built a facial recognition database of over 20 billion scraped images, including of people in the UK, without telling them or having a lawful basis.
Result
£7,552,800 fine and order to delete UK data; overturned on jurisdiction by the First-tier Tribunal in 2023, but the Upper Tribunal reversed that in October 2025 and sent the case back
€10M
Reason
Google passed the personal data of people who asked for content to be removed to the Lumen project at Harvard, which publishes such requests, without a legal basis. It also made it hard for people to have their data erased.
Result
€10M fine
€17M
Reason
After 12 data breaches in 2018, Meta could not show it had proper measures in place to protect EU users' data.
Result
€17M fine
$1.5M
Reason
A weight-loss app marketed to children as young as eight collected their data without parental consent. Its sign-up let kids claim to be over 13.
Result
$1.5M penalty, deletion of data and algorithms
€20M
Reason
Clearview ran biometric facial search on images scraped from the web, including of people in Italy, without a legal basis or transparency.
Result
€20M fine
€250,000
Reason
The ad industry's Transparency & Consent Framework had no valid legal basis for handling the TC String and gave users vague information. It did not ensure that users' choices were respected.
Result
€250,000 fine; orders to fix the TCF, including a ban on relying on legitimate interest; action plan later approved, then suspended pending appeal
€8M
Reason
The DSB found GDPR breaches linked to the jö Bonus Club loyalty programme, after a €2M fine in 2021 on the club itself for not telling about 2 million customers how their data would be used.
Result
Not final when announced; REWE said it would challenge it. No court outcome found.
€1.25M
Reason
The council shared personal data of protest organisers with third parties, including the Russian embassy, in 225 offences between 2018 and 2021.
Result
Reduced by the courts because some offences had prescribed; in Aug 2025 the Central Administrative Court South left about €738,000 for 65 offences. Further appeal possible.
€150M
Reason
google.fr and youtube.com let people accept all cookies in one click, but refusing took several clicks.
Result
€150M total (€90M Google LLC + €60M Google Ireland) plus an order to fix
€60M
Reason
facebook.com let people accept cookies in one click, but refusing took several clicks, and users were not clearly told how to refuse.
Result
€60M fine on Facebook Ireland plus an order to fix
NOK 65M
Reason
Grindr shared users' GPS location, ad IDs and other data, which revealed they used a gay dating app, with ad partners without valid consent. Users had to accept the whole privacy policy to use the app.
Result
NOK 65M fine; upheld by the Privacy Appeals Board, Oslo District Court and finally the Court of Appeal on 21 October 2025
TRY 1.95M
Reason
KVKK found that WhatsApp's 2021 privacy update did not clearly explain how and why user data would be processed, and forced users to accept the contract as a whole instead of consenting freely.
Result
Fined TRY 1.95M (about €197,000) and ordered to bring its privacy policy in line with Turkish law
€225M
Reason
WhatsApp did not explain clearly to users and non-users how it processed their data, including how it shared data with other Facebook companies.
Result
€225M fine, a reprimand and an order to comply; raised after a binding EDPB decision
€746M
Reason
Personal data was used for ad targeting without a valid legal basis.
Result
€746M fine, upheld in 2025 but annulled by Luxembourg's higher administrative court in March 2026 and sent back to the CNPD
$650M
Reason
Facebook used facial recognition to collect and store Illinois users' biometric identifiers without the written consent BIPA requires.
Result
$650M settlement given final approval by Judge Donato
£60,000
Reason
The fashion brand sent 1,746,632 direct marketing messages between June 2019 and June 2020 without valid consent, some offering a free face mask for downloading its app. Its checkout gave no simple way to refuse marketing, so the soft opt-in did not apply.
Result
£60,000 PECR fine
£10,000
Reason
The online sticker seller sent 491,995 marketing emails between August 2019 and April 2020 without consent, many advertising face masks early in the pandemic.
Result
£10,000 PECR fine
€50,000
Reason
The company sends 'pink box' samples to expectant parents. It passed customer data, including children's data, to third parties such as data brokers without valid, informed and freely given consent. A woman who withdrew consent kept getting advertising calls.
Result
€50,000 fine and an order to bring processing into compliance (decision 04/2021)
Reason
The period-tracking app shared health data, including pregnancy, with third-party analytics and marketing firms despite promising privacy.
Result
Consent order: independent review, consent before sharing, user notice; no money
€10.4M
Reason
The online retailer filmed its staff for at least two years without a legal basis, covering workstations, sales floors, warehouses and break areas. Recordings were often kept for 60 days.
Result
LG Hannover cut it to €700,000 (6 May 2024); on the prosecutor's appeal OLG Celle set the final fine at €900,000 (18 Dec 2025, 3 ORbs 113/25)
€6M
Reason
Customers' consent was not valid and the bank could not rely on legitimate interest for profiling. It also failed to inform customers properly.
Result
€6M fine (€4M for unlawful processing, €2M for lack of information)
€100M
Reason
google.fr placed advertising cookies without prior consent and did not clearly tell users what they were for. An ad cookie also stayed on after users turned ad personalisation off.
Result
€100M total (€60M Google LLC + €40M Google Ireland) plus an order to fix
€35M
Reason
amazon.fr placed advertising cookies on visitors' devices without prior consent and without clear information.
Result
€35M fine on Amazon Europe Core plus an order to fix
€7,300
Reason
A two-person email prospecting company sent marketing emails without proof of prior consent. It also kept unneeded data, informed people poorly, made unsubscribing ineffective and had an incomplete processor contract.
Result
€7,300 fine, set low for a very small business, plus an order to comply within two months or pay €1,000 a day (SAN-2020-016)
PLN 1.969M
Reason
Virgin Mobile did not regularly test its security measures, and a leak exposed PESEL and ID document numbers of about 114,000 prepaid customers.
Result
The first decision was annulled; UODO re-set the fine at PLN 1,599,395, upheld in 2023 and made final when the Supreme Administrative Court rejected the appeal on 7 May 2026
€2.25M
Reason
Carrefour's websites and loyalty scheme gave unclear information, kept data too long, mishandled people's rights requests and failed on cookies.
Result
€2.25M fine on Carrefour France (Carrefour Banque separately fined €800,000)
£1.25M
Reason
A poorly secured third-party chatbot on Ticketmaster's payment page was attacked in 2018, potentially exposing 9.4 million European customers' data, including payment card details.
Result
£1.25M fine
€12.252M
Reason
Millions of customers got telemarketing calls without consent, some made from fake numbers by sales partners.
Result
€12,251,601 fine
£18.4M
Reason
A 2014 cyber attack on Starwood, which Marriott later bought, exposed about 339 million guest records and went unnoticed until 2018. Marriott had not done enough due diligence or security.
Result
£18.4M fine
£20M
Reason
Attackers diverted BA website traffic in 2018 and harvested the login, payment card and booking details of about 400,000 customers because of poor security.
Result
£20M fine (reduced from £183.39M proposed)
€35.259M
Reason
Managers at H&M's Nuremberg service centre recorded staff's private lives, including illnesses and diagnoses from 'welcome back' talks, and used them to build profiles.
Result
€35,258,708 fine
€16.7M
Reason
Customers got marketing texts, emails and calls without consent. Incomplete privacy information made it hard for them to withdraw consent or object.
Result
€16.7M fine
TRY 1.2M
Reason
amazon.com.tr processed personal data through cookies as soon as users arrived, with no notice or consent prompt. It also used pre-ticked marketing email consent and transferred data abroad without explicit consent.
Result
TRY 1.1M (data security) plus TRY 100,000 (duty to inform); ordered to fix its privacy, terms and cookie notices
€27.8M
Reason
Hundreds of complaints showed TIM made marketing calls without consent or to people who had opted out. It also used unclear app information and bundled consents.
Result
€27.8M fine
€9.55M
Reason
Phone support gave extensive customer data to anyone who supplied a customer's name and date of birth, which was too weak a check under Art. 32 GDPR.
Result
LG Bonn upheld the fine in principle but cut it to €900,000 on 11 Nov 2020
€14.5M
Reason
The landlord's archive system could not delete old tenant data, so payslips, bank statements and tax and health insurance data were kept for years (Art. 25(1) and Art. 5 GDPR).
Result
LG Berlin annulled it in 2021. The CJEU ruled on 5 Dec 2023 (C-807/21) that companies can be fined directly, but only for culpable breaches. On 9 Jun 2026 LG Berlin I cut the fine to €900,000; not yet final.
€30,000
Reason
Vueling's website gave visitors no way to refuse cookies: they had to accept them to keep browsing.
Result
€30,000 fine (€18,000 if paid early)
€18M
Reason
The postal service estimated and sold the likely political party preferences of 2.2 million Austrians without consent.
Result
Annulled in 2020 on a formal defect, then re-set at €16M after the CJEU Deutsche Wohnen ruling. The Supreme Administrative Court set the final fine at €13M on 24 Jun 2026 (Ro 2025/04/0007).
PLN 2.83M
Reason
Weak access control and authentication, and no reaction to unusual data transfers, let an attacker take data on about 2.2 million online shop customers in 2018.
Result
Upheld in 2020, annulled by the Supreme Administrative Court on 9 Feb 2023; UODO re-fined PLN 3.8M in Feb 2024, which is under appeal
$170M
Reason
YouTube collected cookies from viewers of child-directed channels without parental consent and used them for targeted ads.
Result
$170M ($136M FTC, $34M New York); channel content labelling system
€195,407
Reason
The food delivery company did not delete long-inactive accounts, kept sending marketing emails after people objected, and did not answer access requests.
Result
Final; announced 19 Sep 2019
$5B
Reason
The FTC said Facebook broke its 2012 privacy order by deceiving users about control of their data, including sharing friends' data with third-party apps. The charges followed the Cambridge Analytica scandal.
Result
$5B penalty, the largest ever for a privacy violation at the time, plus a board privacy committee
DKK 1.2M
Reason
The taxi company kept phone numbers and trip locations for nearly nine million trips longer than needed. The DPA recommended DKK 1.2M; Danish courts set fines.
Result
The Frederiksberg District Court fined DKK 100,000 in Jan 2023
$5.7M
Reason
The app collected personal data from users under 13 without parental consent, though it knew many users were children.
Result
$5.7M civil penalty, removal of under-13 videos
€50M
Reason
Android users setting up a Google account got unclear, scattered information about ad personalisation. Consent was bundled and used a pre-ticked box.
Result
€50M fine; upheld by the Conseil d'État on 19 June 2020
SGD 750,000
Reason
As the IT agency for SingHealth, IHiS failed to put reasonable security in place before the 2018 cyberattack, which copied data of over 1.5 million patients.
Result
S$750,000 fine
SGD 250,000
Reason
SingHealth remained responsible for securing patient records it outsourced to IHiS. It did not have reasonable security in place before the 2018 breach.
Result
S$250,000 fine
£385,000
Reason
Avoidable security flaws let attackers take data on about 2.7 million UK riders and 82,000 drivers in 2016. Uber paid the attackers and kept the breach quiet for over a year.
Result
Paid (Data Protection Act 1998)
€20,000
Reason
The chat platform stored passwords in plain text, and hackers took data on about 330,000 users in July 2018.
Result
Germany's first GDPR fine, kept low because Knuddels reported the breach itself and cooperated
£500,000
Reason
Facebook let the 'This Is Your Digital Life' app collect data on up to 87 million users, which went to Cambridge Analytica. It broke the transparency and security principles of the Data Protection Act 1998.
Result
Maximum fine under the 1998 Act. Facebook appealed, then agreed on 30 Oct 2019 to pay without admitting liability, and both sides dropped their appeals.
€4,800
Reason
The shop's CCTV filmed a large part of the public pavement without a legal basis, and the camera was not properly signposted.
Result
Austria's first GDPR fine; not final when reported, and no later court outcome was confirmed
- Fine
Lifecycle Marketing (Mother and Baby) Ltd (Emma's Diary)
UK ICO, United Kingdom, Other privacy laws
£140,000
Reason
The data broker sold data on more than a million people, mostly new mothers, to Experian, which built a database the Labour Party used for 2017 election mailings. Its privacy policy never mentioned political marketing.
Result
Paid (Data Protection Act 1998)
€400,000
Reason
Poor access controls let non-medical staff open patients' clinical records. There were 985 active doctor accounts but only 296 doctors.
Result
After the hospital's appeal the fine was merged into a single €380,000 fine, which the CNPD waived on 14 Jul 2020, citing the pandemic and the hospital's deficit
£77,000
Reason
BT sent nearly five million marketing emails to customers without the consent needed.
Result
Paid
£12,000
Reason
Royal Mail emailed 327,014 people who had already opted out of direct marketing.
Result
Paid
€300,000
Reason
WhatsApp passed user data to Facebook without valid consent. Users had to accept the 2016 terms to keep using the app.
Result
Serious breach of Spain's pre-GDPR data protection law (LOPD); WhatsApp said it would appeal
€300,000
Reason
Facebook used data received from WhatsApp for its own purposes, including advertising, without free, specific and informed consent.
Result
Serious breach of the LOPD
€1.2M
Reason
Facebook used sensitive data such as ideology, religion and sex life for ad targeting without express consent. It tracked non-users and logged-out users through cookies and Like buttons without telling them.
Result
€1.2M under the LOPD (PS/00082/2017), the AEPD's largest fine at the time; Facebook said it would appeal
£10,500
Reason
Morrisons sent marketing emails to recipients without enough consent.
Result
Paid
€150,000
Reason
Facebook tracked people, including non-users, across other websites with its 'datr' cookie without clear information, and combined data for ad targeting without a legal basis. Users could not effectively refuse the cookies.
Result
€150,000 fine on Facebook Inc. and Facebook Ireland
£70,000
Reason
Flybe deliberately sent more than 3.3 million emails to people who had opted out of its marketing.
Result
Paid
£13,000
Reason
Honda sent 289,790 emails asking customers to confirm their marketing preferences. Those emails were themselves marketing sent without consent.
Result
Paid
Biggest GDPR and EU privacy fines
- 1Meta Platforms IrelandIrish DPC, 2023€1.2B
- 2UberDutch DPA (AP), 2026€824.99M
- 3Meta (Facebook Android app)Italian Garante, 2026€805M
- 4Amazon Europe CoreLuxembourg CNPD, 2021€746M
- 5TikTokIrish DPC, 2025€530M
- 6Meta (Instagram)Irish DPC, 2022€405M
- 7GoogleIrish DPC, 2026€403M
- 8Meta (Facebook and Instagram)Irish DPC, 2023€390M
- 9TikTokIrish DPC, 2023€345M
- 10Google LLC and Google IrelandCNIL, 2025€325M
Biggest CCPA and US privacy penalties
- 1Meta (Facebook)FTC, 2019$5B
- 2MetaTexas Attorney General, 2024$1.4B
- 3GoogleTexas Attorney General, 2025$1.375B
- 4FacebookN.D. California (class action), 2021$650M
- 5Epic Games (Fortnite)FTC, 2022$520M
- 6Google (Web & App Activity)N.D. California (class action), 2025$425M
- 7TikTok and ByteDanceDOJ on behalf of FTC (C.D. California), 2026$400M
- 8Google (location tracking)40 US state attorneys general, 2022$391.5M
- 9Google / YouTubeFTC, 2019$170M
- 10TwitterFTC, 2022$150M
Fines by privacy law
Fines by country
- California37
- United States30
- France28
- United Kingdom20
- Ireland12
- Italy9
- Spain9
- Netherlands7
- Germany7
- South Korea6
- European Union4
- Belgium4
- Illinois4
- Australia3
- Denmark3
- Poland3
- Turkey3
- Portugal3
- Austria3
- India2
- Connecticut2
- Texas2
- Finland2
- Croatia2
- Singapore2
- Alabama1
- Oklahoma1
- Louisiana1
- Delaware1
- Colorado1
- Brazil1
- Global1
- Florida1
- Vietnam1
- Czechia1
- New York1
- Wisconsin1
- Sweden1
- China1
- Greece1
- Canada1
- Norway1
- Luxembourg1
Leading Consent Management Platform
Compliant with GDPR, CCPA, COPPA, LGPD, PECR, PDPA, PIPEDA, and more.
Frequently asked questions
What is the largest GDPR fine?
The largest GDPR fine is €1.2 billion, issued to Meta Platforms Ireland by the Irish Data Protection Commission in May 2023 for transferring Facebook user data to the US without adequate protection.
What is the largest CCPA fine?
The largest CCPA penalty so far is the $12.75 million settlement General Motors agreed with the California Attorney General in May 2026, for selling drivers’ location and driving data without notice. The largest fine from the California Privacy Protection Agency is the $2.975 million against FedEx in November 2026.
How much can a GDPR fine be?
Up to €20 million or 4% of a company’s worldwide annual turnover, whichever is higher, for the most serious infringements.
Can a company outside the EU be fined under the GDPR?
Yes. The GDPR applies to companies anywhere that offer goods or services to people in the EU or monitor their behaviour, which includes tracking them on a website.
What are the most common reasons for privacy fines?
In the cases tracked here, the most common problems are cookies and tracking pixels that run before consent, opt-outs and Global Privacy Control signals that are not honoured, and advertising without a valid legal basis.
How often is this tracker updated?
We add new fines, lawsuits and deadlines as we cover them on the UniConsent blog. Each case links to its source and to our analysis.
For analysis of the trends behind these cases, read GDPR Enforcement and Fines 2026 and US Privacy 2026: State Laws, FTC Actions, and Class Action Risk.
Last updated
Get started to make your website and application compliant for EU GDPR, US CPRA, CA PIPEDA etc
Sign upStay ahead on privacy and consent
Privacy laws, consent and compliance updates, a few emails a month.