AI and biometrics
AI and facial recognition privacy fines
Regulators have not waited for AI-specific laws. They use privacy law to act on chatbots trained on personal data, facial recognition in shops and schools, and decisions made about people without human review.
No fine under the EU AI Act itself has been published yet. Its dates are listed below with the legal text as the source.
Last checked . Amounts are in the original currency; conversions are approximate.
Fines
-
US$1.4bn about £1.09bn
Meta Platforms (formerly Facebook)
Texas said Facebook's Tag Suggestions feature ran facial recognition on faces in uploaded photos for over a decade without informing Texans or getting consent. This first settlement under the Texas biometric law is payable over five years.
Texas Capture or Use of Biometric Identifier Act (CUBI) / Texas DTPA
Read the TX-AG decision on Meta Platforms (formerly Facebook) -
US$1.38bn about £1.05bn
Google
Texas said Google signed a settlement resolving two state lawsuits over tracking the location, incognito browsing activity and biometric identifiers of Texans.
Texas state law (location, incognito and biometric claims)
Read the TX-AG decision on Google -
€825m about £707m
Uber
The Dutch regulator found that between 2018 and 2022 Uber's software automatically suspended or permanently deactivated drivers over suspected fraud or low ratings with no human review, cutting off their income, and that drivers were not properly told about this automated decision making.
GDPR
Read the AP decision on Uber -
€30.5m about £25.6m
Clearview AI
The Dutch regulator found that Clearview scraped billions of facial images from the internet and turned them into biometric codes without any lawful exception, did not inform people and ignored access requests. It added orders backed by penalties of up to EUR 5.1 million and warned Dutch organisations that using Clearview is unlawful.
GDPR
Read the AP decision on Clearview AI -
€5m about £4.21m
Luka Inc.
The Italian regulator found that the company behind the Replika chatbot had not identified a legal basis for its processing, had an inadequate privacy policy and had no age verification despite saying it excluded minors. It ordered compliance and opened a separate probe into how the underlying AI model was trained.
GDPR
Read the GPDP decision on Luka Inc. -
US$193k about £156k
DoNotPay
Part of the FTC's Operation AI Comply sweep: the FTC found the 'robot lawyer' service could not support claims that its AI chatbot matched a human lawyer. The final order requires 193,000 dollars in monetary relief and notice to 2021 to 2023 subscribers.
FTC Act s5
Read the FTC decision on DoNotPay -
€158k about £135k
Character Technologies Inc.
The Italian regulator fined the operator of Character.AI for privacy notice gaps, a late impact assessment and a late EU representative, and ordered working age verification, an effective block on re-registration by removed minors and private by default profiles for minors.
GDPR
Read the GPDP decision on Character Technologies Inc.
Orders, reprimands and findings
-
Order or finding
Clearview AI
The Court of Quebec upheld the CAI's December 2021 order requiring Clearview AI to stop collecting Quebecers' images scraped from the internet and to destroy their images and biometric identifiers. The court rejected Clearview's arguments that Quebec law did not apply to it and that the consent rules unjustifiably limited free expression.
Quebec Private Sector Act
Read the CAI decision on Clearview AI -
Order or finding
X Corp. and X.AI LLC (Grok)
After reports that the Grok chatbot generated sexually explicit deepfakes of real people, the OPC opened its own complaints and found that X Corp. and xAI had no valid consent for this use of personal information and that a reasonable person would see the practice as inappropriate. The matter was found well-founded and not resolved, with the companies disagreeing with the conclusions.
PIPEDA, s 5(3), s 11(2)
Read the OPC decision on X Corp. and X.AI LLC (Grok) -
Order or finding
OpenAI OpCo, LLC
A joint federal and provincial investigation examined how OpenAI collected personal information from public websites, licensed datasets and user chats to train and run the GPT-3.5 and GPT-4 models behind ChatGPT. The OPC found the complaint well-founded and conditionally resolved on the basis of mitigation measures OpenAI described, while the BC and Alberta commissioners found the training-data issue well-founded and unresolved under their laws.
PIPEDA; Quebec Private Sector Act; PIPA (BC); PIPA (Alberta)
Read the OPC decision on OpenAI OpCo, LLC -
Order or finding
Kmart Australia Limited
The Privacy Commissioner found that Kmart collected biometric data of every shopper entering 28 stores, and everyone at returns counters, through facial recognition aimed at refund fraud between 2020 and 2022, without notice or consent. She found the collection disproportionate and rejected Kmart's reliance on the unlawful activity exemption, noting less intrusive options existed.
Privacy Act 1988 (Cth)
Read the OAIC decision on Kmart Australia Limited -
Order or finding
Metro Inc.
The CAI barred Metro from putting into service a biometric database for a facial recognition pilot meant to spot past shoplifters and fraudsters in Metro, Super C and Jean Coutu stores, because identity verification by biometrics needs express consent it did not plan to obtain. It was the first order under section 45 of the IT framework act.
Act to establish a legal framework for information technology (LCCJTI); Quebec Private Sector Act, LCCJTI s 44, LCCJTI s 45
Read the CAI decision on Metro Inc. -
Order or finding
Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence
The Italian regulator ordered an urgent, immediate limitation on DeepSeek's processing of Italian users' data and opened an investigation after the companies gave an unsatisfactory reply and said EU law did not apply to them.
GDPR
Read the GPDP decision on Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence -
Order or finding
Bunnings Group Limited
The Privacy Commissioner found that Bunnings used facial recognition on CCTV to capture the faces of everyone entering 63 stores in Victoria and New South Wales between 2018 and 2021, without consent, adequate notice or required privacy policy content, and ordered it not to repeat the conduct. On review in February 2026 the Administrative Review Tribunal upheld the notice and governance findings but accepted that Bunnings could rely on an exemption from the consent requirement.
Privacy Act 1988 (Cth), APP 1, APP 3.3, APP 5
Read the OAIC decision on Bunnings Group Limited -
Order or finding
Chelmer Valley High School
The school introduced facial recognition for cashless canteen payments without first completing a data protection impact assessment, and received a reprimand.
UK GDPR, Art. 35(1)
Read the ICO decision on Chelmer Valley High School -
Order or finding
Serco Leisure Operating Limited and associated trusts
Enforcement notices ordered Serco Leisure, Serco Jersey and seven leisure trusts to stop using facial recognition and fingerprint scanning to track attendance of more than 2,000 staff at 38 sites, which the ICO found unlawful.
UK GDPR
Read the ICO decision on Serco Leisure Operating Limited and associated trusts -
Order or finding
Rite Aid Corporation
The FTC said the pharmacy chain used AI facial recognition in hundreds of stores without reasonable safeguards, producing false shoplifter matches that fell disproportionately on women and people of colour. The order bans its use of facial recognition for surveillance for five years.
FTC Act s5 / 2010 FTC data security order
Read the FTC decision on Rite Aid Corporation
Laws, deadlines and guidance
-
Law and guidance
New resources on transparency for use of AI and automated decision-making | OAIC
From 10 December 2026, organisations covered by the Privacy Act must say in their privacy policy when a computer program makes, or substantially helps make, decisions that could significantly affect people, and what personal information it uses. The OAIC released fact sheets, a flowchart and updated APP 1 guidelines on 30 September 2026.
Privacy Act 1988 (Cth) as amended by Privacy and Other Legislation Amendment Act 2024, APP 1.7, APP 1.8, APP 1.9
Read the OAIC decision on New resources on transparency for use of AI and automated decision-making | OAIC -
Law and guidance
AI Act | Shaping Europe's digital future
The AI Act became generally applicable on 2 August 2026, including Article 50 transparency duties for chatbots and AI generated content and AI Office and national enforcement, while the high risk rules were pushed back by the Digital Omnibus.
EU AI Act, Art. 50, Art. 113
Read the EC decision on AI Act | Shaping Europe's digital future -
Law and guidance
Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI)
The Digital Omnibus on AI, Regulation (EU) 2026/1744, published on 24 July 2026 and in force from 27 July 2026, delays high risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI in Annex I products. The Commission proposed it on 19 November 2025.
EU AI Act (as amended by Regulation (EU) 2026/1744), Art. 113
Read the EC decision on Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI) -
Law and guidance
California Finalizes Regulations to Strengthen Consumers' Privacy
California's updated CCPA regulations on automated decisionmaking technology, risk assessments and cybersecurity audits took effect on 1 January 2026. ADMT duties for significant decisions apply from 1 January 2027, risk assessment attestations are due 1 April 2028, and audit certifications are phased from 2028 to 2030 by revenue.
CCPA regulations
Read the CPPA decision on California Finalizes Regulations to Strengthen Consumers' Privacy -
Law and guidance
Regulation (EU) 2024/1689 (Artificial Intelligence Act)
Obligations for providers of general purpose AI models, the governance provisions and the penalties chapter (apart from Commission GPAI fines under Article 101) have applied since 2 August 2025.
EU AI Act, Chapter V, Chapter XII, Art. 113
Read the EC decision on Regulation (EU) 2024/1689 (Artificial Intelligence Act) -
Law and guidance
Regulation (EU) 2024/1689 (Artificial Intelligence Act)
Chapters I and II of the AI Act, which cover AI literacy and the list of prohibited AI practices, have applied since 2 February 2025.
EU AI Act, Art. 4, Art. 5, Art. 113
Read the EC decision on Regulation (EU) 2024/1689 (Artificial Intelligence Act) -
Law and guidance
EDPB opinion on AI models: GDPR principles support responsible AI
At the Irish DPC's request, the EDPB issued Opinion 28/2024 on when AI models can be treated as anonymous, how the legitimate interest test applies to developing and deploying them, and what follows if a model was built on unlawfully processed personal data.
GDPR
Read the EDPB decision on EDPB opinion on AI models: GDPR principles support responsible AI -
Law and guidance
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)
Regulation (EU) 2024/1689, the AI Act, was published on 12 July 2024 and entered into force on 1 August 2024. Fines reach 35 million euros or 7% of worldwide turnover for prohibited practices, 15 million or 3% for most other obligations and 7.5 million or 1% for misleading information, with the lower figure applying to SMEs.
EU AI Act, Art. 99, Art. 113
Read the EC decision on Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)
Would your website pass?
The free Trust Center scan checks the failures behind these decisions: trackers before consent, advertising pixels, security headers, where visitor data goes, privacy requests and AI tools.
How this list is built
- Every record links to the regulator's own decision, press release, the official journal or a court judgment. Trackers and news coverage are used only to find cases.
- The amount, date and organisation were read on that page. Where a regulator first proposed a different amount, the final one is shown.
- Status follows the regulator: final, reduced, or under appeal. Decisions overturned in court are removed from this list.
- Summaries are our own words and describe what the regulator found. They are not legal advice.
- Conversions use the European Central Bank reference rate on the decision date. The data is also available as JSON at /api/fines.