GDPR fines
Fines imposed by supervisory authorities under the GDPR, newest first, in the currency in which they were imposed. Checked against each authority's decision or announcement on 28 October 2026.
- Xandr Inc.: NOK 92,000,000
Datatilsynet (Norwegian Data Protection Authority), NorwayDecision of 2 October 2026Appeal status: unknown
As an ad exchange in real-time bidding, processed Grindr users' data (revealing sexual orientation) without a legal basis, relying on Grindr's invalid consents.
- IQVIA Solutions Italy S.r.l: EUR 7,000,000
Garante per la protezione dei dati personali, ItalyDecision of 23 September 2026Appeal status: unknown
Health-analytics firm treated a database of about one million GP patients as anonymous when a persistent identifier made them re-identifiable; no legal basis, no information, no DPIA, weak retention and security.
- Google Ireland Limited: EUR 403,000,000
Data Protection Commission (Ireland), IrelandAnnounced on 21 September 2026Appeal status: unknown
Processed location data in Web & App Activity, Location History and Location Accuracy without lawful, fair and transparent processing, and kept it too long (2018 to 2020).
Not fully confirmed: The press release names the principles (lawfulness, fairness, transparency, accountability, retention) but cites no article numbers; the full decision is 'to be issued in due course'. Fines table date 21/09/2026, status 'Not Confirmed'.
- Uber: EUR 824,990,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsAnnounced on 21 August 2026Appeal status: under appeal
Automatically deactivated drivers' accounts (fraud suspicion, low ratings) with no human review, and did not inform drivers about this automated decision-making (2018 to 2022).
Not fully confirmed: The release refers to the GDPR prohibition of fully automated decision-making but cites no article number; exact legal entity not named in the release. Uber has appealed.
- FRANCE TRAVAIL: EUR 5,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 22 January 2026Appeal status: unknown
Public employment service: weak authentication, poor logging and over-broad access rights let attackers using social engineering reach data on everyone registered over 20 years.
- FREE MOBILE: EUR 27,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 8 January 2026Appeal status: unknown
After an October 2024 intrusion exposed 24 million subscriber contracts (including IBANs): weak VPN authentication and poor detection, an incomplete breach notice to subscribers, and excessive retention of former subscribers' data.
- Experian Nederland B.V.: EUR 2,700,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 16 October 2025Appeal status: not appealed
Credit-scoring business used personal data from many sources without a valid legal basis and did not inform the people concerned.
- McDonald’s Polska Sp. z o.o.: PLN 16,932,657
Prezes Urzędu Ochrony Danych Osobowych (Polish Data Protection Authority), PolandAnnounced on 21 July 2025Appeal status: unknown
Outsourced staff scheduling without risk analysis or supervision of the processor, so employee data (names, PESEL or passport numbers, shifts) ended up in a public directory.
Not fully confirmed: Decision date not shown on the page (announcement date used). Three fines: PLN 1,632,063 + 13,600,528 + 1,700,066. The processor was fined PLN 183,858 in total. Articles taken from the narrative; the page does not give a single list of infringed articles.
- TikTok Technology Limited: EUR 530,000,000
Data Protection Commission (Ireland), IrelandDecision of 30 April 2025Appeal status: under appeal
Allowed staff in China to access EEA users' data without showing equivalent protection, and did not tell users about these transfers.
- Luka Inc.: EUR 5,000,000
Garante per la protezione dei dati personali, ItalyDecision of 10 April 2025Appeal status: unknown
AI companion chatbot ran with no identified legal basis, an inadequate privacy policy and no effective age verification despite excluding minors.
- Vodafone GmbH: EUR 45,000,000
Federal Commissioner for Data Protection and Freedom of Information (BfDI), GermanyDecision of 10 March 2025Appeal status: unknown
Two fines: EUR 15 million for poor supervision and auditing of partner shops acting as processors (staff misused customer data for fraud) and EUR 30 million for weak authentication in the online portal and hotline that allowed eSIM misuse.
- Meta Platforms Ireland Limited: EUR 251,000,000
Data Protection Commission (Ireland), IrelandDecision of 12 December 2024Appeal status: under appeal
A 2018 'View As' token flaw exposed about 29 million Facebook accounts (about 3 million in the EU/EEA); incomplete breach notification and poor design and default safeguards.
- Netflix International B.V.: EUR 4,750,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 26 November 2024Appeal status: unknown
Did not tell customers clearly enough, in its privacy statement and access replies, about purposes, legal bases, recipients, retention and transfers (2018 to 2020).
- Posti: EUR 2,400,000
Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman, Finland), FinlandDecision of 13 November 2024Appeal status: unknown
Automatically opened an OmaPosti electronic mailbox for customers, tied to other services, with a pre-ticked box and without clear information.
Not fully confirmed: Confirmed on the EDPB news page. Fine for Art. 5 and 6(1); reprimand and order for Art. 13; instruction on Art. 25. Company name given only as 'Posti'.
- Foodinho s.r.l.: EUR 5,000,000
Garante per la protezione dei dati personali, ItalyDecision of 13 November 2024Appeal status: unknown
Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.
- OpenAI: EUR 15,000,000
Garante per la protezione dei dati personali, ItalyDecision of 2 November 2024Appeal status: annulled
ChatGPT: training on personal data without an identified legal basis, lack of transparency, no age verification, and failure to notify a March 2023 breach; also ordered a six-month public information campaign.
Not fully confirmed: Read in the Garante press release of 20 December 2024 (decision no. 755 of 2 November 2024). The decision itself has been removed from the Garante's website after the Tribunal of Rome (judgment no. 4153/2026, published 18 March 2026) upheld the company's objection. 'Annulled' reflects the Garante's own note that the objection was upheld; whether a further appeal is pending was not stated.
- LinkedIn Ireland Unlimited Company: EUR 310,000,000
Data Protection Commission (Ireland), IrelandDecision of 22 October 2024Appeal status: under appeal
Processed members' data for behavioural analysis and targeted advertising without a valid legal basis, and without fair and clear information.
- Meta Platforms Ireland Limited: EUR 91,000,000
Data Protection Commission (Ireland), IrelandDecision of 26 September 2024Appeal status: under appeal
Stored some Facebook users' passwords in plain text, notified the breach late and did not document it.
- Apoteket AB: SEK 37,000,000
Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), SwedenDecision of 29 August 2024Appeal status: unknown
A pharmacy's Meta pixel sent sensitive purchase data (for example, self-tests and treatments) to Meta for over two years because of weak security routines.
- Uber Technologies Inc. en Uber B.V.: EUR 290,000,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 22 July 2024Appeal status: under appeal
Transferred European drivers' data, including sensitive data, to the US for over two years without transfer tools.
- Clearview AI Inc.: EUR 30,500,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 16 May 2024Appeal status: not appealed
Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests.
- Avast Software s.r.o.: CZK 351,000,000
Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Czech RepublicDecision of 10 April 2024Appeal status: upheld
Antivirus maker passed pseudonymised browsing histories of about 100 million users to a sister company that sold insights to marketers, while telling users the data was anonymous and used only for statistics.
- Enel Energia S.p.A.: EUR 79,107,101
Garante per la protezione dei dati personali, ItalyDecision of 8 February 2024Appeal status: upheld
Telemarketing: weak control of sales-agent access let unauthorised agencies place contracts obtained through unlawful calls into the company's systems; failures of security, accountability, privacy by design and processor contracts.
- Amazon France Logistique: EUR 32,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 27 December 2023Appeal status: reduced
Warehouse employee monitoring: scanner-based productivity indicators kept in detail for 31 days, some judged to lack a legal basis, plus poor information to temporary staff and on CCTV, and weak security.
- Uber Technologies Inc. en Uber B.V.: EUR 10,000,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 11 December 2023Appeal status: under appeal
Unclear to drivers on retention periods and transfers outside Europe, and made it hard for them to exercise access and portability rights.
- EOS Matrix d.o.o.: EUR 5,470,000
Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), CroatiaAnnounced on 5 October 2023Appeal status: unknown
Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice.
- TikTok Technology Limited: EUR 345,000,000
Data Protection Commission (Ireland), IrelandDecision of 1 September 2023Appeal status: under appeal
Child users' accounts were public by default, 'Family Pairing' was weak, and children were not told clearly about the settings; the EDPB added a fairness ('dark patterns') finding.
- CRITEO: EUR 40,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 15 June 2023Appeal status: unknown
Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners.
- Spotify AB: SEK 58,000,000
Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), SwedenDecision of 12 June 2023Appeal status: upheld
Gave users their data on request but did not explain clearly enough how it was used (purposes, categories, recipients, retention, sources, transfer safeguards).
- Meta Platforms Ireland Limited: EUR 1,200,000,000
Data Protection Commission (Ireland), IrelandDecision of 12 May 2023Appeal status: under appeal
Kept transferring Facebook users' data to the US on standard contractual clauses after the Schrems II judgment, without addressing the risks the court identified.
- Meta Platforms Ireland Limited: EUR 210,000,000
Data Protection Commission (Ireland), IrelandDecision of 31 December 2022Appeal status: under appeal
Facebook relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.
- Meta Platforms Ireland Limited: EUR 180,000,000
Data Protection Commission (Ireland), IrelandDecision of 31 December 2022Appeal status: under appeal
Instagram relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.
- Meta Platforms Ireland Limited: EUR 265,000,000
Data Protection Commission (Ireland), IrelandDecision of 25 November 2022Appeal status: under appeal
Facebook search and contact-importer tools allowed scraping of a large dataset of user data; failure of data protection by design and by default.
- Clearview AI: EUR 20,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 17 October 2022Appeal status: unknown
Facial-recognition firm scraped photos of people in France from the web with no legal basis, ignored access and erasure requests and did not cooperate with the CNIL; ordered to stop and delete, with a daily penalty.
- Meta Platforms Ireland Limited: EUR 405,000,000
Data Protection Commission (Ireland), IrelandDecision of 2 September 2022Appeal status: under appeal
Instagram let 13 to 17 year olds run business accounts that published their phone numbers or emails, and set child accounts to public by default.
- Clearview AI, Inc: EUR 20,000,000
Hellenic Data Protection Authority, GreeceDecision of 13 July 2022Appeal status: unknown
Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative.
- Google LLC: EUR 10,000,000
Agencia Española de Protección de Datos (AEPD), SpainAnnounced on 18 May 2022Appeal status: unknown
Search and video platform forwarded people's content-removal requests (identity, email, reasons, URLs) to a public third-party database without a legal basis, which frustrated the right to erasure.
Not fully confirmed: AEPD press release of 18 May 2022 (procedure PS/00140/2020). The decision date and the split of the fine between the two infringements are not confirmed.
- Minister van Financiën (controller for the Belastingdienst, Dutch Tax Administration): EUR 3,700,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 7 April 2022Appeal status: unknown
Kept an unlawful fraud blacklist (FSV) on about 270,000 people for over six years: no legal basis, inaccurate data, weak security, DPO not involved in the DPIA.
- Clearview AI: EUR 20,000,000
Garante per la protezione dei dati personali, ItalyDecision of 10 February 2022Appeal status: unknown
Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it.
- IAB Europe: EUR 250,000
Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), BelgiumDecision of 2 February 2022Appeal status: upheld
The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO.
- Grindr LLC: NOK 65,000,000
Datatilsynet (Norwegian Data Protection Authority), NorwayDecision of 13 December 2021Appeal status: upheld
Shared users' data (including the fact of using a gay dating app) with advertising partners without valid consent.
- WhatsApp Ireland Ltd: EUR 225,000,000
Data Protection Commission (Ireland), IrelandDecision of 20 August 2021Appeal status: under appeal
Did not tell users and non-users clearly enough how their data was processed, including sharing with other group companies.
Not fully confirmed: The DPC summary page tags only Articles 5 and 13 (no sub-paragraphs); the full decision also covers other transparency articles. Fine raised after EDPB binding decision 1/2021. DPC fines table: Pending Appeal.
- Deliveroo Italy s.r.l.: EUR 2,500,000
Garante per la protezione dei dati personali, ItalyDecision of 22 July 2021Appeal status: unknown
Food-delivery platform managed about 8,000 riders through opaque algorithms (booking and work allocation), collected excessive data including location, and lacked a DPIA and proper records.
- Amazon Europe Core S.à r.l.: EUR 746,000,000
Commission nationale pour la protection des données (Luxembourg), LuxembourgDecision of 15 July 2021Appeal status: annulled
Behavioural advertising processing without a valid legal basis, plus failures on information and data subject rights.
Not fully confirmed: CNPD pages cite no article numbers. The Luxembourg courts' news page (justice.public.lu, 19 Mar 2025) lists Articles 6, 12 to 17 and 21. Administrative Tribunal upheld the fine on 18 Mar 2025; the Administrative Court on 12 Mar 2026 confirmed most findings but annulled the fine (later CJEU case law on fault) and sent the fine question back to the CNPD.
- VODAFONE ESPAÑA, S.A.U.: EUR 6,000,000
Agencia Española de Protección de Datos (AEPD), SpainDecision of 11 February 2021Appeal status: unknown
Telecom operator failed to control the marketing firms calling and texting on its behalf, including processors outside the EU, so people who had objected kept receiving marketing.
- notebooksbilliger.de AG: EUR 10,400,000
State Commissioner for Data Protection of Lower Saxony (LfD Niedersachsen), GermanyAnnounced on 8 January 2021Appeal status: unknown
Online electronics retailer video-monitored employees (workplaces, warehouses, break areas) for at least two years with no legal basis, keeping footage for 60 days; some cameras also covered customer seating.
Not fully confirmed: Press release created 8 January 2021 (page last updated 11 July 2025); no GDPR article numbers are cited and the page still says the fine is not final.
- CAIXABANK, S.A.: EUR 6,000,000
Agencia Española de Protección de Datos (AEPD), SpainDecision of 7 January 2021Appeal status: unknown
Bank relied on invalid consent and its privacy information was unclear when it profiled customers and shared data across its group for commercial purposes.
Not fully confirmed: Operative part of resolution PS/00477/2019 read: EUR 2,000,000 for Articles 13 and 14 and EUR 4,000,000 for Article 6; a charge under Article 22 was dismissed. The resolution text carries no visible date; 7 January 2021 comes from a later AEPD document.
- Booking.com B.V.: EUR 475,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 10 December 2020Appeal status: not appealed
Reported a data breach (hotel-staff phishing in the UAE, 4,109 people affected) 22 days late.
- Twitter International Company: USD 500,000
Data Protection Commission (Ireland), IrelandDecision of 9 December 2020Appeal status: unknown
Notified a personal data breach late and did not document it properly (a bug that exposed protected tweets).
- Carrefour France: EUR 2,250,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 18 November 2020Appeal status: unknown
Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.
Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb_aar_2020_final_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.
- Marriott International Inc: GBP 18,400,000
Information Commissioner's Office (United Kingdom), United KingdomDecision of 30 October 2020Appeal status: unknown
Starwood's systems, compromised in 2014 and later acquired by Marriott, were not detected as breached until September 2018; security of guest data was inadequate.
- British Airways plc: GBP 20,000,000
Information Commissioner's Office (United Kingdom), United KingdomDecision of 16 October 2020Appeal status: unknown
An attacker used compromised remote-access credentials and altered a script on the airline's website to send customers' card data to an outside domain (22 June to 5 September 2018).
- H&M Hennes & Mauritz Online Shop A.B. & Co. KG: EUR 35,258,707.95
Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), GermanyAnnounced on 1 October 2020Appeal status: unknown
Service-centre managers recorded and stored detailed notes on hundreds of employees' private lives, health and religious beliefs after 'welcome back' talks, and used them to profile staff.
Not fully confirmed: Press release of 1 October 2020; it gives the exact amount and name but cites no GDPR article numbers, and the fine notice's own date is not stated.
- Google LLC: SEK 75,000,000
Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), SwedenDecision of 10 March 2020Appeal status: reduced
Failed to remove search results in time under the right to be forgotten, and told website owners about removals, which discouraged people from asking.
- TIM S.p.A.: EUR 27,802,946
Garante per la protezione dei dati personali, ItalyDecision of 15 January 2020Appeal status: unknown
Aggressive telemarketing: calls to people who had refused or were on internal block lists, marketing without valid consent, and weak control of call-centre partners.
Not fully confirmed: Amount, date and name read in the decision (register no. 7 of 15 January 2020). Articles listed are those the decision states for its main finding (section 3.1, which also cites Article 130 of the Italian Code); later sections discuss further provisions (e.g. Articles 12 and 21), so the list may be incomplete.
- 1&1 Telecom GmbH: EUR 9,550,000
Federal Commissioner for Data Protection and Freedom of Information (BfDI), GermanyAnnounced on 9 December 2019Appeal status: reduced
Telecom call centre released extensive customer data to anyone who could give a customer's name and date of birth; inadequate authentication.
- Deutsche Wohnen SE: EUR 14,500,000
Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), GermanyDecision of 30 October 2019Appeal status: reduced
Property company kept years-old tenant documents (pay slips, bank statements, tax and health-insurance data) in an archive system with no means of deleting data no longer needed.
- Post AG: EUR 18,000,000
Datenschutzbehörde (Austrian Data Protection Authority), AustriaDecision of 23 October 2019Appeal status: reduced
Calculated and stored 'party affinity' scores (likely political leanings) for about 2.2 million people and sold some, without consent; also reused parcel data for marketing.
Not fully confirmed: The DSB page does not name the company; the name comes from the Federal Administrative Court's own news page (bvwg.gv.at, 3 Dec 2020). History: annulled 2020 on a procedural point, reinstated on further appeal, cut to EUR 16m (27 Dec 2024), finally set at EUR 13m by the Supreme Administrative Court on 24 Jun 2026.
- Google LLC: EUR 50,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 21 January 2019Appeal status: upheld
Information on ad personalisation was scattered and unclear, and consent to it was not specific or informed (pre-ticked, bundled), so it gave no valid legal basis.
- Knuddels: EUR 20,000
State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), GermanyDecision of 21 November 2018Appeal status: unknown
First German GDPR fine: a chat platform stored users' passwords in plain text, exposed in a hack of about 330,000 accounts; low amount reflects exemplary cooperation.