Enforcement library
Privacy and GDPR fines tracker
Every record here comes from the regulator's own decision or press release, not from press coverage or another tracker. We read the amount, the date and the organisation on that page, note whether the decision is final, reduced or under appeal, and link straight to it.
Use it to see what regulators actually penalise: tracking before consent, advertising pixels on sensitive pages, weak security, data sent abroad without safeguards, unanswered privacy requests and AI built on personal data.
Last checked . Amounts are in the original currency; conversions are approximate.
Latest decisions
-
£105k about €126k
Bluon Energy Ltd
The solar firm instigated 194,379 live marketing calls between April 2024 and April 2025 to numbers registered with the Telephone Preference Service, leading to 61 complaints. An enforcement notice was also issued.
PECR, Reg. 21
Read the ICO decision on Bluon Energy Ltd -
US$220m about £165m
General Motors
A coalition of 36 attorneys general said GM enrolled drivers in its Smart Driver program from 2016 to 2024 and sold their driving and location data to data brokers, who passed it to insurers that used it to set premiums. Connecticut receives more than 6 million dollars.
Connecticut Data Privacy Act (CTDPA) and other state laws
Read the CT-AG decision on General Motors -
€7m about £5.86m
Fnac Darty Participations et Services and Fnac Direct
The CNIL found the Fnac mobile app sent a user identifier and browsing activity to a third party domain via an API to power product recommendations and train the algorithm, even when users had not consented. It held that personalisation trackers of this kind are not exempt from consent.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Fnac Darty Participations et Services and Fnac Direct -
Order or finding
Clearview AI
The Court of Quebec upheld the CAI's December 2021 order requiring Clearview AI to stop collecting Quebecers' images scraped from the internet and to destroy their images and biometric identifiers. The court rejected Clearview's arguments that Quebec law did not apply to it and that the consent rules unjustifiably limited free expression.
Quebec Private Sector Act
Read the CAI decision on Clearview AI -
NOK 92m about £7.27m
Xandr Inc. (Microsoft)
Datatilsynet found the ad exchange Xandr received and relayed Grindr users' ad IDs, IP addresses and the fact they used Grindr in real time bidding without a valid legal basis, relying on Grindr's invalid consent. It held each joint controller must check consent itself.
GDPR, Art. 6(1), Art. 9(1), Art. 4(11), Art. 7
Read the Datatilsynet-NO decision on Xandr Inc. (Microsoft) -
€403m about £346m
Google Ireland Limited
The DPC found that Google processed location data through Web & App Activity and Location History unlawfully or unfairly, could not demonstrate compliance for Location Accuracy, was not transparent about all three settings and kept location data too long. Google was given six months to comply.
GDPR
Read the DPC decision on Google Ireland Limited -
Order or finding
Children's Health Ireland at Tallaght
After protected disclosures and an unannounced inspection, the DPC found the hospital's junior doctors' office and confidential waste bins did not keep personal data secure. It issued a reprimand and ordered the hospital to finalise and implement impact assessments for records and waste handling.
GDPR, Art. 5(1)(f), Art. 32(1)
Read the DPC decision on Children's Health Ireland at Tallaght -
€645k about £552k
Health Service Executive
Inspections found paper health records kept in derelict or unsuitable stores and damaged by mould, water and animal droppings, and records held longer than needed. The DPC also found the HSE notified breaches late and did not tell affected people, and treated earlier similar failings as aggravating.
GDPR, Art. 5(1)(e), Art. 5(1)(f), Art. 32(1), Art. 33(1), Art. 34(1)
Read the DPC decision on Health Service Executive -
€825m about £707m
Uber
The Dutch regulator found that between 2018 and 2022 Uber's software automatically suspended or permanently deactivated drivers over suspected fraud or low ratings with no human review, cutting off their income, and that drivers were not properly told about this automated decision making.
GDPR
Read the AP decision on Uber -
€300k about £256k
EXTIA
The CNIL found that an IT consulting firm left a dozen 2024 erasure requests unprocessed and did not tell 166 requesters what it had done, with others told months late.
GDPR, Art. 12, Art. 17
Read the CNIL decision on EXTIA -
€500k about £426k
Hôpital Privé de la Loire
An attacker used a single compromised account to extract patient data over several days because remote access had no VPN or multi factor authentication, access was not limited to care teams and there was no alerting. The CNIL also found more than 202,000 trusted third parties whose data was stolen were never told.
GDPR, Art. 32, Art. 34
Read the CNIL decision on Hôpital Privé de la Loire -
€158k about £135k
Character Technologies Inc.
The Italian regulator fined the operator of Character.AI for privacy notice gaps, a late impact assessment and a late EU representative, and ordered working age verification, an effective block on re-registration by removed minors and private by default profiles for minors.
GDPR
Read the GPDP decision on Character Technologies Inc.
Largest fines
-
US$1.4bn about £1.09bn
Meta Platforms (formerly Facebook)
Texas said Facebook's Tag Suggestions feature ran facial recognition on faces in uploaded photos for over a decade without informing Texans or getting consent. This first settlement under the Texas biometric law is payable over five years.
Texas Capture or Use of Biometric Identifier Act (CUBI) / Texas DTPA
Read the TX-AG decision on Meta Platforms (formerly Facebook) -
€1.2bn about £1.04bn
Meta Platforms Ireland Limited
The DPC found that Meta kept transferring Facebook users' data from the EU to the US after the Schrems II ruling, relying on standard contractual clauses that did not give adequate protection. It ordered Meta to suspend the transfers and stop storing the unlawfully transferred data in the US, with the fine set after an EDPB binding decision.
GDPR, Art. 46(1), Art. 58(2)(j), Art. 58(2)(d)
Read the DPC decision on Meta Platforms Ireland Limited -
US$1.38bn about £1.05bn
Google
Texas said Google signed a settlement resolving two state lawsuits over tracking the location, incognito browsing activity and biometric identifiers of Texans.
Texas state law (location, incognito and biometric claims)
Read the TX-AG decision on Google -
€825m about £707m
Uber
The Dutch regulator found that between 2018 and 2022 Uber's software automatically suspended or permanently deactivated drivers over suspected fraud or low ratings with no human review, cutting off their income, and that drivers were not properly told about this automated decision making.
GDPR
Read the AP decision on Uber -
€530m about £452m
TikTok Technology Limited
The DPC found that TikTok allowed staff in China to access EEA users' data remotely without showing that the data got protection essentially equivalent to EU standards, and that its 2021 privacy policy did not name China or explain the transfers. TikTok was given six months to comply or suspend transfers to China.
GDPR, Art. 46(1), Art. 13(1)(f)
Read the DPC decision on TikTok Technology Limited -
€403m about £346m
Google Ireland Limited
The DPC found that Google processed location data through Web & App Activity and Location History unlawfully or unfairly, could not demonstrate compliance for Location Accuracy, was not transparent about all three settings and kept location data too long. Google was given six months to comply.
GDPR
Read the DPC decision on Google Ireland Limited -
€345m about £295m
TikTok Technology Limited
The DPC found that TikTok set child users' accounts to public by default, let unverified adults pair with child accounts through Family Pairing, and did not explain these settings clearly to children in late 2020. A fairness finding was added at the EDPB's direction and TikTok was ordered to fix its processing within three months.
GDPR, Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(f), Art. 12(1), Art. 13(1)(e), Art. 24(1), Art. 25(1), Art. 25(2)
Read the DPC decision on TikTok Technology Limited -
€325m about £282m
Google LLC and Google Ireland Limited
The CNIL found that Gmail showed ads styled as emails in the Promotions and Social tabs without consent, and that the Google account sign-up flow steered users towards personalised ad cookies without making clear they were a condition of using the service. The total was split as 200 million euros for Google LLC and 125 million euros for Google Ireland.
French Data Protection Act art. 82 (ePrivacy); French Postal and Electronic Communications Code art. L.34-5, Art. 82 Loi Informatique et Libertés, Art. L.34-5 CPCE
Read the CNIL decision on Google LLC and Google Ireland Limited -
€310m about £258m
LinkedIn Ireland Unlimited Company
The DPC found that LinkedIn had no valid lawful basis (consent, legitimate interests or contract) for using members' data for behavioural analysis and targeted advertising, and that it did not explain its lawful bases properly. LinkedIn was reprimanded, fined and ordered to bring its processing into compliance.
GDPR, Art. 6, Art. 5(1)(a), Art. 13(1)(c), Art. 14(1)(c)
Read the DPC decision on LinkedIn Ireland Unlimited Company
New laws, deadlines and guidance
-
Law and guidance
New resources on transparency for use of AI and automated decision-making | OAIC
From 10 December 2026, organisations covered by the Privacy Act must say in their privacy policy when a computer program makes, or substantially helps make, decisions that could significantly affect people, and what personal information it uses. The OAIC released fact sheets, a flowchart and updated APP 1 guidelines on 30 September 2026.
Privacy Act 1988 (Cth) as amended by Privacy and Other Legislation Amendment Act 2024, APP 1.7, APP 1.8, APP 1.9
Read the OAIC decision on New resources on transparency for use of AI and automated decision-making | OAIC -
Law and guidance
Outils de rejeu de session : la CNIL publie sa recommandation pour guider les acteurs
The CNIL published its recommendation on session replay tools, stating they always need prior consent because no exemption applies, and asking providers and site owners to mask sensitive inputs and explain the tool on the first layer of the consent interface.
French Data Protection Act art. 82 (ePrivacy); GDPR data minimisation, Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Outils de rejeu de session : la CNIL publie sa recommandation pour guider les acteurs -
Law and guidance
Les interfaces truquées : un obstacle à la protection des renseignements personnels
The CAI published a web page on deceptive design in digital services, warning that interfaces that steer people into sharing more data can invalidate their consent and make later use or disclosure of the data unlawful. The page covers types of dark patterns, legal obligations and good practice for organisations.
Quebec Private Sector Act
Read the CAI decision on Les interfaces truquées : un obstacle à la protection des renseignements personnels -
Law and guidance
ICO welcomes transition to new Information Commission and marks new chapter with Manchester head office opening | ICO
On 30 September 2026 the office of the Information Commissioner was replaced by the Information Commission, a body led by a board, which now carries out the regulator's functions. Day to day enforcement and guidance continue.
Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026
Read the ICO decision on ICO welcomes transition to new Information Commission and marks new chapter with Manchester head office opening | ICO -
Law and guidance
EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines
The EDPB adopted draft guidelines setting a five step method for deciding when regulators should fine rather than reprimand or order, with 14 worked examples, and finalised its guidelines on how the Digital Services Act and GDPR interact.
GDPR
Read the EDPB decision on EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines -
Law and guidance
AI Act | Shaping Europe's digital future
The AI Act became generally applicable on 2 August 2026, including Article 50 transparency duties for chatbots and AI generated content and AI Office and national enforcement, while the high risk rules were pushed back by the Digital Omnibus.
EU AI Act, Art. 50, Art. 113
Read the EC decision on AI Act | Shaping Europe's digital future -
Law and guidance
Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI)
The Digital Omnibus on AI, Regulation (EU) 2026/1744, published on 24 July 2026 and in force from 27 July 2026, delays high risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI in Annex I products. The Commission proposed it on 19 November 2025.
EU AI Act (as amended by Regulation (EU) 2026/1744), Art. 113
Read the EC decision on Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI) -
Law and guidance
C-36 (45-1) - LEGISinfo - Parliament of Canada
The federal government introduced Bill C-36 on 15 June 2026 to enact the Protecting Privacy and Consumer Data Act and amend PIPEDA, the latest attempt to replace Canada's private sector privacy law. As of this check the bill is at second reading in the House of Commons and is not law.
Bill C-36, Protecting Privacy and Consumer Data Act
Read the PARL-CA decision on C-36 (45-1) - LEGISinfo - Parliament of Canada -
Law and guidance
Final storage and access technologies guidance published | ICO
The ICO issued final guidance on storage and access technologies, covering cookies, tracking pixels, fingerprinting and similar tools and reflecting the Data (Use and Access) Act changes. A separate review of the regulation 6 consent rule for online advertising was passed to government as advice in May 2026.
PECR / UK GDPR, Reg. 6
Read the ICO decision on Final storage and access technologies guidance published | ICO
Would your website pass?
The free Trust Center scan checks the failures behind these decisions: trackers before consent, advertising pixels, security headers, where visitor data goes, privacy requests and AI tools.
How this list is built
- Every record links to the regulator's own decision, press release, the official journal or a court judgment. Trackers and news coverage are used only to find cases.
- The amount, date and organisation were read on that page. Where a regulator first proposed a different amount, the final one is shown.
- Status follows the regulator: final, reduced, or under appeal. Decisions overturned in court are removed from this list.
- Summaries are our own words and describe what the regulator found. They are not legal advice.
- Conversions use the European Central Bank reference rate on the decision date. The data is also available as JSON at /api/fines.