--- title: "GDPR fines" canonical: "https://dposchool.com/gdpr/fines" source: - "https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/" - "https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en" - "https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location" - "https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-nearly-825-million-euros-for-automated-driver-blocking" - "https://www.edpb.europa.eu/news/data-breach-france-travail-fined-eur-5-000-000_en" - "https://www.cnil.fr/en/sanction-free-2026" - "https://www.autoriteitpersoonsgegevens.nl/actueel/experian-krijgt-boete-van-27-miljoen-euro-voor-privacyovertredingen" - "https://uodo.gov.pl/pl/138/3827" - "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-tiktok-technology-limited" - "https://www.edpb.europa.eu/news/ai-the-italian-supervisory-authority-fines-company-behind-chatbot-replika_en" - "https://www.edpb.europa.eu/news/german-federal-sa-administrative-fines-in-the-amount-of-eu15-000-000-and-eu30-000-000-as-well_en" - "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiries-meta-platforms-ireland-limited-token-breach" - "https://www.autoriteitpersoonsgegevens.nl/en/documents/fine-netflix" - "https://www.edpb.europa.eu/news/finnish-sa-administrative-fine-imposed-on-posti-for-unlawful-processing-of-personal-data_en" - "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601" - "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432" - "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-linkedin-ireland-unlimited-company-october-2024" - "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-september-2024" - "https://www.imy.se/nyheter/sanktionsavgifter-mot-apoteket-och-apohem-for-overforing-av-personuppgifter-till-meta/" - "https://www.autoriteitpersoonsgegevens.nl/documenten/boete-uber-doorgifte-naar-vs" - "https://www.autoriteitpersoonsgegevens.nl/en/documents/decision-fine-clearview-ai" - "https://uoou.gov.cz/novinky/vse/uoou-ulozil-pokutu-351-mil-kc-za-poruseni-gdpr" - "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9988710" - "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048989272" - "https://www.autoriteitpersoonsgegevens.nl/documenten/boete-uber-privacyrechten" - "https://azop.hr/agenciji-za-naplatu-potrazivanja-eos-matrix-d-o-o-izrecena-upravna-novcana-kazna-u-iznosu-od-547-milijuna-eura/" - "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-tiktok-technology-limited-september-2023" - "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063" - "https://www.imy.se/tillsyner/spotify-ratten-till-tillgang/" - "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-data-transfers-eueea-us-meta-platforms-ireland-limited-its-facebook-service" - "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-december-2022" - "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-meta-dataset-november-2022" - "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046444859" - "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-processing-personal-data-relating-child-users-instagram-social-networking-service" - "https://www.dpa.gr/en/en/enimerwtiko/prakseisArxis/imposition-fine-clearview-ai-inc" - "https://www.aepd.es/en/prensa-y-comunicacion/notas-de-prensa/the-aepd-has-imposed-sanction-on-google-llc-for-transferring-personal-data-to-third-parties" - "https://autoriteitpersoonsgegevens.nl/actueel/boete-belastingdienst-voor-zwarte-lijst-fsv" - "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362" - "https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr" - "https://www.datatilsynet.no/en/regulations-and-tools/regulations/avgjorelser-fra-datatilsynet/2021/gebyr-til-grindr/" - "https://www.dataprotection.ie/en/dpc-guidance/decisions/decision-concerning-whatsapp-ireland-ltd" - "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9685994" - "https://cnpd.public.lu/en/actualites/national/2025/03/amazon-decision.html" - "https://www.aepd.es/documento/ps-00059-2020.pdf" - "https://www.lfd.niedersachsen.de/startseite/infothek/presseinformationen/lfd-niedersachsen-verhangt-bussgeld-uber-10-4-millionen-euro-gegen-notebooksbilliger-de-196019.html" - "https://www.aepd.es/documento/ps-00477-2019.pdf" - "https://www.autoriteitpersoonsgegevens.nl/en/current/bookingcom-fined-for-delay-in-reporting-data-breach" - "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-twitter-international-company-tic" - "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756" - "https://ico.org.uk/media2/migrated/2618524/marriott-international-inc-mpn-20201030.pdf" - "https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf" - "https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Pressemitteilungen/2020/2020-10-01-H_M.pdf" - "https://www.imy.se/tillsyner/google/" - "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9256486" - "https://www.bfdi.bund.de/SharedDocs/Pressemitteilungen/DE/2019/30_BfDIverh%C3%A4ngtGeldbu%C3%9Fe1u1.html" - "https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/pressemitteilungen/2019/20191105-PR-Translation-Fine_DW.pdf" - "https://dsb.gv.at/aktuelles/vwgh-bestaetigt-unrechtmaessige-verarbeitung-von-partei-affinitaeten-und-setzt-geldbusse-mit-eur-13-mio-fest" - "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000038032552/" - "https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-sein-erstes-bussgeld-in-deutschland-nach-der-ds-gvo/" source_note: "Only the authority's decision is authoritative." text_as_of: "2026-10-28" language: "en" publisher: "DPO School" --- # GDPR fines Fines imposed by supervisory authorities under the GDPR, newest first, in the currency in which they were imposed. Checked against each authority's decision or announcement on 28 October 2026. ## [Xandr Inc.: NOK 92,000,000](https://dposchool.com/gdpr/fine/dt-xandr-2026-10) Datatilsynet (Norwegian Data Protection Authority), Norway · Decision of 2 October 2026 · Appeal status: unknown As an ad exchange in real-time bidding, processed Grindr users' data (revealing sexual orientation) without a legal basis, relying on Grindr's invalid consents. [Source: the authority](https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/) ## [IQVIA Solutions Italy S.r.l: EUR 7,000,000](https://dposchool.com/gdpr/fine/garante-iqvia-2026-09) Garante per la protezione dei dati personali, Italy · Decision of 23 September 2026 · Appeal status: unknown Health-analytics firm treated a database of about one million GP patients as anonymous when a persistent identifier made them re-identifiable; no legal basis, no information, no DPIA, weak retention and security. [Source: the authority](https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en) ## [Google Ireland Limited: EUR 403,000,000](https://dposchool.com/gdpr/fine/dpc-google-2026-09) Data Protection Commission (Ireland), Ireland · Announced on 21 September 2026 · Appeal status: unknown Processed location data in Web & App Activity, Location History and Location Accuracy without lawful, fair and transparent processing, and kept it too long (2018 to 2020). Not fully confirmed: The press release names the principles (lawfulness, fairness, transparency, accountability, retention) but cites no article numbers; the full decision is 'to be issued in due course'. Fines table date 21/09/2026, status 'Not Confirmed'. [Source: the authority](https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location) ## [Uber: EUR 824,990,000](https://dposchool.com/gdpr/fine/ap-uber-2026-08) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Announced on 21 August 2026 · Appeal status: under appeal Automatically deactivated drivers' accounts (fraud suspicion, low ratings) with no human review, and did not inform drivers about this automated decision-making (2018 to 2022). Not fully confirmed: The release refers to the GDPR prohibition of fully automated decision-making but cites no article number; exact legal entity not named in the release. Uber has appealed. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-nearly-825-million-euros-for-automated-driver-blocking) ## [FRANCE TRAVAIL: EUR 5,000,000](https://dposchool.com/gdpr/fine/cnil-france-travail-2026-01) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 22 January 2026 · Appeal status: unknown Public employment service: weak authentication, poor logging and over-broad access rights let attackers using social engineering reach data on everyone registered over 20 years. [Source: the authority](https://www.edpb.europa.eu/news/data-breach-france-travail-fined-eur-5-000-000_en) ## [FREE MOBILE: EUR 27,000,000](https://dposchool.com/gdpr/fine/cnil-free-mobile-2026-01) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 8 January 2026 · Appeal status: unknown After an October 2024 intrusion exposed 24 million subscriber contracts (including IBANs): weak VPN authentication and poor detection, an incomplete breach notice to subscribers, and excessive retention of former subscribers' data. [Source: the authority](https://www.cnil.fr/en/sanction-free-2026) ## [Experian Nederland B.V.: EUR 2,700,000](https://dposchool.com/gdpr/fine/ap-experian-2025-10) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 October 2025 · Appeal status: not appealed Credit-scoring business used personal data from many sources without a valid legal basis and did not inform the people concerned. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/actueel/experian-krijgt-boete-van-27-miljoen-euro-voor-privacyovertredingen) ## [McDonald’s Polska Sp. z o.o.: PLN 16,932,657](https://dposchool.com/gdpr/fine/uodo-mcdonalds-2025-07) Prezes Urzędu Ochrony Danych Osobowych (Polish Data Protection Authority), Poland · Announced on 21 July 2025 · Appeal status: unknown Outsourced staff scheduling without risk analysis or supervision of the processor, so employee data (names, PESEL or passport numbers, shifts) ended up in a public directory. Not fully confirmed: Decision date not shown on the page (announcement date used). Three fines: PLN 1,632,063 + 13,600,528 + 1,700,066. The processor was fined PLN 183,858 in total. Articles taken from the narrative; the page does not give a single list of infringed articles. [Source: the authority](https://uodo.gov.pl/pl/138/3827) ## [TikTok Technology Limited: EUR 530,000,000](https://dposchool.com/gdpr/fine/dpc-tiktok-2025-04) Data Protection Commission (Ireland), Ireland · Decision of 30 April 2025 · Appeal status: under appeal Allowed staff in China to access EEA users' data without showing equivalent protection, and did not tell users about these transfers. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-tiktok-technology-limited) ## [Luka Inc.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-luka-replika-2025-04) Garante per la protezione dei dati personali, Italy · Decision of 10 April 2025 · Appeal status: unknown AI companion chatbot ran with no identified legal basis, an inadequate privacy policy and no effective age verification despite excluding minors. [Source: the authority](https://www.edpb.europa.eu/news/ai-the-italian-supervisory-authority-fines-company-behind-chatbot-replika_en) ## [Vodafone GmbH: EUR 45,000,000](https://dposchool.com/gdpr/fine/bfdi-vodafone-2025-03) Federal Commissioner for Data Protection and Freedom of Information (BfDI), Germany · Decision of 10 March 2025 · Appeal status: unknown Two fines: EUR 15 million for poor supervision and auditing of partner shops acting as processors (staff misused customer data for fraud) and EUR 30 million for weak authentication in the online portal and hotline that allowed eSIM misuse. [Source: the authority](https://www.edpb.europa.eu/news/german-federal-sa-administrative-fines-in-the-amount-of-eu15-000-000-and-eu30-000-000-as-well_en) ## [Meta Platforms Ireland Limited: EUR 251,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2024-12) Data Protection Commission (Ireland), Ireland · Decision of 12 December 2024 · Appeal status: under appeal A 2018 'View As' token flaw exposed about 29 million Facebook accounts (about 3 million in the EU/EEA); incomplete breach notification and poor design and default safeguards. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiries-meta-platforms-ireland-limited-token-breach) ## [Netflix International B.V.: EUR 4,750,000](https://dposchool.com/gdpr/fine/ap-netflix-2024-11) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 26 November 2024 · Appeal status: unknown Did not tell customers clearly enough, in its privacy statement and access replies, about purposes, legal bases, recipients, retention and transfers (2018 to 2020). [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/fine-netflix) ## [Posti: EUR 2,400,000](https://dposchool.com/gdpr/fine/fi-posti-2024-11) Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman, Finland), Finland · Decision of 13 November 2024 · Appeal status: unknown Automatically opened an OmaPosti electronic mailbox for customers, tied to other services, with a pre-ticked box and without clear information. Not fully confirmed: Confirmed on the EDPB news page. Fine for Art. 5 and 6(1); reprimand and order for Art. 13; instruction on Art. 25. Company name given only as 'Posti'. [Source: the authority](https://www.edpb.europa.eu/news/finnish-sa-administrative-fine-imposed-on-posti-for-unlawful-processing-of-personal-data_en) ## [Foodinho s.r.l.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-foodinho-2024-11) Garante per la protezione dei dati personali, Italy · Decision of 13 November 2024 · Appeal status: unknown Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601) ## [OpenAI: EUR 15,000,000](https://dposchool.com/gdpr/fine/garante-openai-2024-11) Garante per la protezione dei dati personali, Italy · Decision of 2 November 2024 · Appeal status: annulled ChatGPT: training on personal data without an identified legal basis, lack of transparency, no age verification, and failure to notify a March 2023 breach; also ordered a six-month public information campaign. Not fully confirmed: Read in the Garante press release of 20 December 2024 (decision no. 755 of 2 November 2024). The decision itself has been removed from the Garante's website after the Tribunal of Rome (judgment no. 4153/2026, published 18 March 2026) upheld the company's objection. 'Annulled' reflects the Garante's own note that the objection was upheld; whether a further appeal is pending was not stated. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432) ## [LinkedIn Ireland Unlimited Company: EUR 310,000,000](https://dposchool.com/gdpr/fine/dpc-linkedin-2024-10) Data Protection Commission (Ireland), Ireland · Decision of 22 October 2024 · Appeal status: under appeal Processed members' data for behavioural analysis and targeted advertising without a valid legal basis, and without fair and clear information. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-linkedin-ireland-unlimited-company-october-2024) ## [Meta Platforms Ireland Limited: EUR 91,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2024-09) Data Protection Commission (Ireland), Ireland · Decision of 26 September 2024 · Appeal status: under appeal Stored some Facebook users' passwords in plain text, notified the breach late and did not document it. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-september-2024) ## [Apoteket AB: SEK 37,000,000](https://dposchool.com/gdpr/fine/imy-apoteket-2024-08) Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), Sweden · Decision of 29 August 2024 · Appeal status: unknown A pharmacy's Meta pixel sent sensitive purchase data (for example, self-tests and treatments) to Meta for over two years because of weak security routines. [Source: the authority](https://www.imy.se/nyheter/sanktionsavgifter-mot-apoteket-och-apohem-for-overforing-av-personuppgifter-till-meta/) ## [Uber Technologies Inc. en Uber B.V.: EUR 290,000,000](https://dposchool.com/gdpr/fine/ap-uber-2024-07) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 22 July 2024 · Appeal status: under appeal Transferred European drivers' data, including sensitive data, to the US for over two years without transfer tools. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/documenten/boete-uber-doorgifte-naar-vs) ## [Clearview AI Inc.: EUR 30,500,000](https://dposchool.com/gdpr/fine/ap-clearview-2024-05) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 May 2024 · Appeal status: not appealed Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/decision-fine-clearview-ai) ## [Avast Software s.r.o.: CZK 351,000,000](https://dposchool.com/gdpr/fine/uoou-avast-2024-04) Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Czech Republic · Decision of 10 April 2024 · Appeal status: upheld Antivirus maker passed pseudonymised browsing histories of about 100 million users to a sister company that sold insights to marketers, while telling users the data was anonymous and used only for statistics. [Source: the authority](https://uoou.gov.cz/novinky/vse/uoou-ulozil-pokutu-351-mil-kc-za-poruseni-gdpr) ## [Enel Energia S.p.A.: EUR 79,107,101](https://dposchool.com/gdpr/fine/garante-enel-energia-2024-02) Garante per la protezione dei dati personali, Italy · Decision of 8 February 2024 · Appeal status: upheld Telemarketing: weak control of sales-agent access let unauthorised agencies place contracts obtained through unlawful calls into the company's systems; failures of security, accountability, privacy by design and processor contracts. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9988710) ## [Amazon France Logistique: EUR 32,000,000](https://dposchool.com/gdpr/fine/cnil-amazon-france-logistique-2023-12) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 27 December 2023 · Appeal status: reduced Warehouse employee monitoring: scanner-based productivity indicators kept in detail for 31 days, some judged to lack a legal basis, plus poor information to temporary staff and on CCTV, and weak security. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048989272) ## [Uber Technologies Inc. en Uber B.V.: EUR 10,000,000](https://dposchool.com/gdpr/fine/ap-uber-2023-12) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 11 December 2023 · Appeal status: under appeal Unclear to drivers on retention periods and transfers outside Europe, and made it hard for them to exercise access and portability rights. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/documenten/boete-uber-privacyrechten) ## [EOS Matrix d.o.o.: EUR 5,470,000](https://dposchool.com/gdpr/fine/azop-eos-matrix-2023-10) Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Croatia · Announced on 5 October 2023 · Appeal status: unknown Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice. [Source: the authority](https://azop.hr/agenciji-za-naplatu-potrazivanja-eos-matrix-d-o-o-izrecena-upravna-novcana-kazna-u-iznosu-od-547-milijuna-eura/) ## [TikTok Technology Limited: EUR 345,000,000](https://dposchool.com/gdpr/fine/dpc-tiktok-2023-09) Data Protection Commission (Ireland), Ireland · Decision of 1 September 2023 · Appeal status: under appeal Child users' accounts were public by default, 'Family Pairing' was weak, and children were not told clearly about the settings; the EDPB added a fairness ('dark patterns') finding. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-tiktok-technology-limited-september-2023) ## [CRITEO: EUR 40,000,000](https://dposchool.com/gdpr/fine/cnil-criteo-2023-06) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 15 June 2023 · Appeal status: unknown Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063) ## [Spotify AB: SEK 58,000,000](https://dposchool.com/gdpr/fine/imy-spotify-2023-06) Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), Sweden · Decision of 12 June 2023 · Appeal status: upheld Gave users their data on request but did not explain clearly enough how it was used (purposes, categories, recipients, retention, sources, transfer safeguards). [Source: the authority](https://www.imy.se/tillsyner/spotify-ratten-till-tillgang/) ## [Meta Platforms Ireland Limited: EUR 1,200,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2023-05) Data Protection Commission (Ireland), Ireland · Decision of 12 May 2023 · Appeal status: under appeal Kept transferring Facebook users' data to the US on standard contractual clauses after the Schrems II judgment, without addressing the risks the court identified. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-data-transfers-eueea-us-meta-platforms-ireland-limited-its-facebook-service) ## [Meta Platforms Ireland Limited: EUR 210,000,000](https://dposchool.com/gdpr/fine/dpc-meta-facebook-2022-12) Data Protection Commission (Ireland), Ireland · Decision of 31 December 2022 · Appeal status: under appeal Facebook relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-december-2022) ## [Meta Platforms Ireland Limited: EUR 180,000,000](https://dposchool.com/gdpr/fine/dpc-meta-instagram-2022-12) Data Protection Commission (Ireland), Ireland · Decision of 31 December 2022 · Appeal status: under appeal Instagram relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-december-2022) ## [Meta Platforms Ireland Limited: EUR 265,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2022-11) Data Protection Commission (Ireland), Ireland · Decision of 25 November 2022 · Appeal status: under appeal Facebook search and contact-importer tools allowed scraping of a large dataset of user data; failure of data protection by design and by default. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-meta-dataset-november-2022) ## [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/cnil-clearview-2022-10) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 17 October 2022 · Appeal status: unknown Facial-recognition firm scraped photos of people in France from the web with no legal basis, ignored access and erasure requests and did not cooperate with the CNIL; ordered to stop and delete, with a daily penalty. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046444859) ## [Meta Platforms Ireland Limited: EUR 405,000,000](https://dposchool.com/gdpr/fine/dpc-instagram-2022-09) Data Protection Commission (Ireland), Ireland · Decision of 2 September 2022 · Appeal status: under appeal Instagram let 13 to 17 year olds run business accounts that published their phone numbers or emails, and set child accounts to public by default. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-processing-personal-data-relating-child-users-instagram-social-networking-service) ## [Clearview AI, Inc: EUR 20,000,000](https://dposchool.com/gdpr/fine/hdpa-clearview-2022-07) Hellenic Data Protection Authority, Greece · Decision of 13 July 2022 · Appeal status: unknown Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative. [Source: the authority](https://www.dpa.gr/en/en/enimerwtiko/prakseisArxis/imposition-fine-clearview-ai-inc) ## [Google LLC: EUR 10,000,000](https://dposchool.com/gdpr/fine/aepd-google-2022-05) Agencia Española de Protección de Datos (AEPD), Spain · Announced on 18 May 2022 · Appeal status: unknown Search and video platform forwarded people's content-removal requests (identity, email, reasons, URLs) to a public third-party database without a legal basis, which frustrated the right to erasure. Not fully confirmed: AEPD press release of 18 May 2022 (procedure PS/00140/2020). The decision date and the split of the fine between the two infringements are not confirmed. [Source: the authority](https://www.aepd.es/en/prensa-y-comunicacion/notas-de-prensa/the-aepd-has-imposed-sanction-on-google-llc-for-transferring-personal-data-to-third-parties) ## [Minister van Financiën (controller for the Belastingdienst, Dutch Tax Administration): EUR 3,700,000](https://dposchool.com/gdpr/fine/ap-belastingdienst-2022-04) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 7 April 2022 · Appeal status: unknown Kept an unlawful fraud blacklist (FSV) on about 270,000 people for over six years: no legal basis, inaccurate data, weak security, DPO not involved in the DPIA. [Source: the authority](https://autoriteitpersoonsgegevens.nl/actueel/boete-belastingdienst-voor-zwarte-lijst-fsv) ## [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/garante-clearview-2022-02) Garante per la protezione dei dati personali, Italy · Decision of 10 February 2022 · Appeal status: unknown Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362) ## [IAB Europe: EUR 250,000](https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02) Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), Belgium · Decision of 2 February 2022 · Appeal status: upheld The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO. [Source: the authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr) ## [Grindr LLC: NOK 65,000,000](https://dposchool.com/gdpr/fine/dt-grindr-2021-12) Datatilsynet (Norwegian Data Protection Authority), Norway · Decision of 13 December 2021 · Appeal status: upheld Shared users' data (including the fact of using a gay dating app) with advertising partners without valid consent. [Source: the authority](https://www.datatilsynet.no/en/regulations-and-tools/regulations/avgjorelser-fra-datatilsynet/2021/gebyr-til-grindr/) ## [WhatsApp Ireland Ltd: EUR 225,000,000](https://dposchool.com/gdpr/fine/dpc-whatsapp-2021-08) Data Protection Commission (Ireland), Ireland · Decision of 20 August 2021 · Appeal status: under appeal Did not tell users and non-users clearly enough how their data was processed, including sharing with other group companies. Not fully confirmed: The DPC summary page tags only Articles 5 and 13 (no sub-paragraphs); the full decision also covers other transparency articles. Fine raised after EDPB binding decision 1/2021. DPC fines table: Pending Appeal. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/decision-concerning-whatsapp-ireland-ltd) ## [Deliveroo Italy s.r.l.: EUR 2,500,000](https://dposchool.com/gdpr/fine/garante-deliveroo-2021-07) Garante per la protezione dei dati personali, Italy · Decision of 22 July 2021 · Appeal status: unknown Food-delivery platform managed about 8,000 riders through opaque algorithms (booking and work allocation), collected excessive data including location, and lacked a DPIA and proper records. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9685994) ## [Amazon Europe Core S.à r.l.: EUR 746,000,000](https://dposchool.com/gdpr/fine/cnpd-amazon-2021-07) Commission nationale pour la protection des données (Luxembourg), Luxembourg · Decision of 15 July 2021 · Appeal status: annulled Behavioural advertising processing without a valid legal basis, plus failures on information and data subject rights. Not fully confirmed: CNPD pages cite no article numbers. The Luxembourg courts' news page (justice.public.lu, 19 Mar 2025) lists Articles 6, 12 to 17 and 21. Administrative Tribunal upheld the fine on 18 Mar 2025; the Administrative Court on 12 Mar 2026 confirmed most findings but annulled the fine (later CJEU case law on fault) and sent the fine question back to the CNPD. [Source: the authority](https://cnpd.public.lu/en/actualites/national/2025/03/amazon-decision.html) ## [VODAFONE ESPAÑA, S.A.U.: EUR 6,000,000](https://dposchool.com/gdpr/fine/aepd-vodafone-espana-2021-02) Agencia Española de Protección de Datos (AEPD), Spain · Decision of 11 February 2021 · Appeal status: unknown Telecom operator failed to control the marketing firms calling and texting on its behalf, including processors outside the EU, so people who had objected kept receiving marketing. [Source: the authority](https://www.aepd.es/documento/ps-00059-2020.pdf) ## [notebooksbilliger.de AG: EUR 10,400,000](https://dposchool.com/gdpr/fine/lfd-ni-notebooksbilliger-2021-01) State Commissioner for Data Protection of Lower Saxony (LfD Niedersachsen), Germany · Announced on 8 January 2021 · Appeal status: unknown Online electronics retailer video-monitored employees (workplaces, warehouses, break areas) for at least two years with no legal basis, keeping footage for 60 days; some cameras also covered customer seating. Not fully confirmed: Press release created 8 January 2021 (page last updated 11 July 2025); no GDPR article numbers are cited and the page still says the fine is not final. [Source: the authority](https://www.lfd.niedersachsen.de/startseite/infothek/presseinformationen/lfd-niedersachsen-verhangt-bussgeld-uber-10-4-millionen-euro-gegen-notebooksbilliger-de-196019.html) ## [CAIXABANK, S.A.: EUR 6,000,000](https://dposchool.com/gdpr/fine/aepd-caixabank-2021-01) Agencia Española de Protección de Datos (AEPD), Spain · Decision of 7 January 2021 · Appeal status: unknown Bank relied on invalid consent and its privacy information was unclear when it profiled customers and shared data across its group for commercial purposes. Not fully confirmed: Operative part of resolution PS/00477/2019 read: EUR 2,000,000 for Articles 13 and 14 and EUR 4,000,000 for Article 6; a charge under Article 22 was dismissed. The resolution text carries no visible date; 7 January 2021 comes from a later AEPD document. [Source: the authority](https://www.aepd.es/documento/ps-00477-2019.pdf) ## [Booking.com B.V.: EUR 475,000](https://dposchool.com/gdpr/fine/ap-booking-2020-12) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 10 December 2020 · Appeal status: not appealed Reported a data breach (hotel-staff phishing in the UAE, 4,109 people affected) 22 days late. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/current/bookingcom-fined-for-delay-in-reporting-data-breach) ## [Twitter International Company: USD 500,000](https://dposchool.com/gdpr/fine/dpc-twitter-2020-12) Data Protection Commission (Ireland), Ireland · Decision of 9 December 2020 · Appeal status: unknown Notified a personal data breach late and did not document it properly (a bug that exposed protected tweets). [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-twitter-international-company-tic) ## [Carrefour France: EUR 2,250,000](https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 18 November 2020 · Appeal status: unknown Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings. Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb\_aar\_2020\_final\_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756) ## [Marriott International Inc: GBP 18,400,000](https://dposchool.com/gdpr/fine/ico-marriott-2020-10) Information Commissioner's Office (United Kingdom), United Kingdom · Decision of 30 October 2020 · Appeal status: unknown Starwood's systems, compromised in 2014 and later acquired by Marriott, were not detected as breached until September 2018; security of guest data was inadequate. [Source: the authority](https://ico.org.uk/media2/migrated/2618524/marriott-international-inc-mpn-20201030.pdf) ## [British Airways plc: GBP 20,000,000](https://dposchool.com/gdpr/fine/ico-ba-2020-10) Information Commissioner's Office (United Kingdom), United Kingdom · Decision of 16 October 2020 · Appeal status: unknown An attacker used compromised remote-access credentials and altered a script on the airline's website to send customers' card data to an outside domain (22 June to 5 September 2018). [Source: the authority](https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf) ## [H&M Hennes & Mauritz Online Shop A.B. & Co. KG: EUR 35,258,707.95](https://dposchool.com/gdpr/fine/hmbbfdi-hm-2020-10) Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Germany · Announced on 1 October 2020 · Appeal status: unknown Service-centre managers recorded and stored detailed notes on hundreds of employees' private lives, health and religious beliefs after 'welcome back' talks, and used them to profile staff. Not fully confirmed: Press release of 1 October 2020; it gives the exact amount and name but cites no GDPR article numbers, and the fine notice's own date is not stated. [Source: the authority](https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Pressemitteilungen/2020/2020-10-01-H_M.pdf) ## [Google LLC: SEK 75,000,000](https://dposchool.com/gdpr/fine/imy-google-2020-03) Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), Sweden · Decision of 10 March 2020 · Appeal status: reduced Failed to remove search results in time under the right to be forgotten, and told website owners about removals, which discouraged people from asking. [Source: the authority](https://www.imy.se/tillsyner/google/) ## [TIM S.p.A.: EUR 27,802,946](https://dposchool.com/gdpr/fine/garante-tim-2020-01) Garante per la protezione dei dati personali, Italy · Decision of 15 January 2020 · Appeal status: unknown Aggressive telemarketing: calls to people who had refused or were on internal block lists, marketing without valid consent, and weak control of call-centre partners. Not fully confirmed: Amount, date and name read in the decision (register no. 7 of 15 January 2020). Articles listed are those the decision states for its main finding (section 3.1, which also cites Article 130 of the Italian Code); later sections discuss further provisions (e.g. Articles 12 and 21), so the list may be incomplete. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9256486) ## [1&1 Telecom GmbH: EUR 9,550,000](https://dposchool.com/gdpr/fine/bfdi-1und1-2019-12) Federal Commissioner for Data Protection and Freedom of Information (BfDI), Germany · Announced on 9 December 2019 · Appeal status: reduced Telecom call centre released extensive customer data to anyone who could give a customer's name and date of birth; inadequate authentication. [Source: the authority](https://www.bfdi.bund.de/SharedDocs/Pressemitteilungen/DE/2019/30_BfDIverh%C3%A4ngtGeldbu%C3%9Fe1u1.html) ## [Deutsche Wohnen SE: EUR 14,500,000](https://dposchool.com/gdpr/fine/blnbdi-deutsche-wohnen-2019-10) Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), Germany · Decision of 30 October 2019 · Appeal status: reduced Property company kept years-old tenant documents (pay slips, bank statements, tax and health-insurance data) in an archive system with no means of deleting data no longer needed. [Source: the authority](https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/pressemitteilungen/2019/20191105-PR-Translation-Fine_DW.pdf) ## [Post AG: EUR 18,000,000](https://dposchool.com/gdpr/fine/dsb-post-2019-10) Datenschutzbehörde (Austrian Data Protection Authority), Austria · Decision of 23 October 2019 · Appeal status: reduced Calculated and stored 'party affinity' scores (likely political leanings) for about 2.2 million people and sold some, without consent; also reused parcel data for marketing. Not fully confirmed: The DSB page does not name the company; the name comes from the Federal Administrative Court's own news page (bvwg.gv.at, 3 Dec 2020). History: annulled 2020 on a procedural point, reinstated on further appeal, cut to EUR 16m (27 Dec 2024), finally set at EUR 13m by the Supreme Administrative Court on 24 Jun 2026. [Source: the authority](https://dsb.gv.at/aktuelles/vwgh-bestaetigt-unrechtmaessige-verarbeitung-von-partei-affinitaeten-und-setzt-geldbusse-mit-eur-13-mio-fest) ## [Google LLC: EUR 50,000,000](https://dposchool.com/gdpr/fine/cnil-google-2019-01) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 21 January 2019 · Appeal status: upheld Information on ad personalisation was scattered and unclear, and consent to it was not specific or informed (pre-ticked, bundled), so it gave no valid legal basis. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000038032552/) ## [Knuddels: EUR 20,000](https://dposchool.com/gdpr/fine/lfdi-bw-knuddels-2018-11) State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), Germany · Decision of 21 November 2018 · Appeal status: unknown First German GDPR fine: a chat platform stored users' passwords in plain text, exposed in a hack of about 330,000 accounts; low amount reflects exemplary cooperation. [Source: the authority](https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-sein-erstes-bussgeld-in-deutschland-nach-der-ds-gvo/) This is reference material, not legal advice. ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / Fines Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents