European Union and EEA
GDPR fines in the EU and EEA
European regulators issue the largest privacy fines in the world, led by Ireland's Data Protection Commission for the big platforms and France's CNIL for cookies. Several large decisions are under appeal; where the regulator says so, the record shows it.
Cookie and tracking fines in the EU are usually brought under national ePrivacy laws rather than the GDPR itself, which is why the law named on each record varies by country.
Last checked . Amounts are in the original currency; conversions are approximate.
Fines, largest first
-
€1.2bn about £1.04bn
Meta Platforms Ireland Limited
The DPC found that Meta kept transferring Facebook users' data from the EU to the US after the Schrems II ruling, relying on standard contractual clauses that did not give adequate protection. It ordered Meta to suspend the transfers and stop storing the unlawfully transferred data in the US, with the fine set after an EDPB binding decision.
GDPR, Art. 46(1), Art. 58(2)(j), Art. 58(2)(d)
Read the DPC decision on Meta Platforms Ireland Limited -
€825m about £707m
Uber
The Dutch regulator found that between 2018 and 2022 Uber's software automatically suspended or permanently deactivated drivers over suspected fraud or low ratings with no human review, cutting off their income, and that drivers were not properly told about this automated decision making.
GDPR
Read the AP decision on Uber -
€530m about £452m
TikTok Technology Limited
The DPC found that TikTok allowed staff in China to access EEA users' data remotely without showing that the data got protection essentially equivalent to EU standards, and that its 2021 privacy policy did not name China or explain the transfers. TikTok was given six months to comply or suspend transfers to China.
GDPR, Art. 46(1), Art. 13(1)(f)
Read the DPC decision on TikTok Technology Limited -
€403m about £346m
Google Ireland Limited
The DPC found that Google processed location data through Web & App Activity and Location History unlawfully or unfairly, could not demonstrate compliance for Location Accuracy, was not transparent about all three settings and kept location data too long. Google was given six months to comply.
GDPR
Read the DPC decision on Google Ireland Limited -
€345m about £295m
TikTok Technology Limited
The DPC found that TikTok set child users' accounts to public by default, let unverified adults pair with child accounts through Family Pairing, and did not explain these settings clearly to children in late 2020. A fairness finding was added at the EDPB's direction and TikTok was ordered to fix its processing within three months.
GDPR, Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(f), Art. 12(1), Art. 13(1)(e), Art. 24(1), Art. 25(1), Art. 25(2)
Read the DPC decision on TikTok Technology Limited -
€325m about £282m
Google LLC and Google Ireland Limited
The CNIL found that Gmail showed ads styled as emails in the Promotions and Social tabs without consent, and that the Google account sign-up flow steered users towards personalised ad cookies without making clear they were a condition of using the service. The total was split as 200 million euros for Google LLC and 125 million euros for Google Ireland.
French Data Protection Act art. 82 (ePrivacy); French Postal and Electronic Communications Code art. L.34-5, Art. 82 Loi Informatique et Libertés, Art. L.34-5 CPCE
Read the CNIL decision on Google LLC and Google Ireland Limited -
€310m about £258m
LinkedIn Ireland Unlimited Company
The DPC found that LinkedIn had no valid lawful basis (consent, legitimate interests or contract) for using members' data for behavioural analysis and targeted advertising, and that it did not explain its lawful bases properly. LinkedIn was reprimanded, fined and ordered to bring its processing into compliance.
GDPR, Art. 6, Art. 5(1)(a), Art. 13(1)(c), Art. 14(1)(c)
Read the DPC decision on LinkedIn Ireland Unlimited Company -
€290m about £245m
Uber
The Dutch regulator found that for over two years Uber sent European drivers' data, including ID documents, location data and in some cases criminal and medical data, to its US headquarters without a valid transfer tool after it stopped using standard contractual clauses in August 2021.
GDPR
Read the AP decision on Uber -
€251m about £207m
Meta Platforms Ireland Limited
The DPC fined Meta over a 2018 Facebook breach in which attackers exploited a video upload bug to reach about 29 million accounts, including about 3 million in the EU/EEA. Most of the fine (EUR 240 million) was for failing to build data protection by design and by default into the feature, with the rest for an incomplete breach notification and poor breach records.
GDPR, Art. 33(3), Art. 33(5), Art. 25(1), Art. 25(2)
Read the DPC decision on Meta Platforms Ireland Limited -
€150m about £130m
Infinite Styles Services Co. Limited (SHEIN)
The CNIL found that shein.com set advertising cookies as soon as visitors arrived, showed banners that did not explain the advertising purpose or name third parties, and kept setting and reading cookies after users clicked Reject all or withdrew consent.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Infinite Styles Services Co. Limited (SHEIN) -
€100m about £86.4m
MLU B.V. (Yango)
In a joint investigation with the Norwegian and Finnish regulators, the Dutch regulator found that the Yango taxi app stored customers' and drivers' data, including licence scans, precise locations, chat content and social security numbers, on servers in Russia without adequate protection. MLU was ordered to stop the transfers immediately.
GDPR
Read the AP decision on MLU B.V. (Yango) -
€91m about £75.9m
Meta Platforms Ireland Limited
The DPC found that Meta stored some users' passwords in plain text on internal systems, did not notify the regulator of the breach and did not document it. It issued a reprimand and a fine for weak security and breach handling.
GDPR, Art. 33(1), Art. 33(5), Art. 5(1)(f), Art. 32(1)
Read the DPC decision on Meta Platforms Ireland Limited -
€79.1m about £67.5m
Enel Energia
The Italian regulator found that weak security in Enel Energia's customer and activation systems let unauthorised agents run nuisance calls and sign up customers, with at least 9,300 contracts affected, including 978 bought in from companies outside its sales network.
GDPR
Read the GPDP decision on Enel Energia -
€50m about £41.6m
Orange
The CNIL found that Orange displayed ads disguised as emails inside its webmail inboxes without consent, and that orange.fr kept reading previously set cookies after users withdrew consent.
French Data Protection Act art. 82 (ePrivacy); French Postal and Electronic Communications Code art. L.34-5, Art. 82 Loi Informatique et Libertés, Art. L.34-5 CPCE
Read the CNIL decision on Orange -
€30.5m about £25.6m
Clearview AI
The Dutch regulator found that Clearview scraped billions of facial images from the internet and turned them into biometric codes without any lawful exception, did not inform people and ignored access requests. It added orders backed by penalties of up to EUR 5.1 million and warned Dutch organisations that using Clearview is unlawful.
GDPR
Read the AP decision on Clearview AI -
€10m about £8.54m
Uber Technologies, Inc. and Uber B.V.
The Dutch regulator found that Uber made it needlessly hard for drivers to request access to their data, with the request form buried in the app and replies that were hard to read. Its privacy terms also did not state retention periods or name the non-EEA countries receiving driver data.
GDPR
Read the AP decision on Uber Technologies, Inc. and Uber B.V. -
€10m about £8.69m
Yahoo EMEA Limited
The CNIL fined Yahoo for reading and writing advertising cookies without first collecting consent and for the way users could withdraw cookie consent. France's highest administrative court later rejected Yahoo's challenge and found the amount was not disproportionate.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Yahoo EMEA Limited -
NOK 92m about £7.27m
Xandr Inc. (Microsoft)
Datatilsynet found the ad exchange Xandr received and relayed Grindr users' ad IDs, IP addresses and the fact they used Grindr in real time bidding without a valid legal basis, relying on Grindr's invalid consent. It held each joint controller must check consent itself.
GDPR, Art. 6(1), Art. 9(1), Art. 4(11), Art. 7
Read the Datatilsynet-NO decision on Xandr Inc. (Microsoft) -
€7m about £5.86m
Fnac Darty Participations et Services and Fnac Direct
The CNIL found the Fnac mobile app sent a user identifier and browsing activity to a third party domain via an API to power product recommendations and train the algorithm, even when users had not consented. It held that personalisation trackers of this kind are not exempt from consent.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Fnac Darty Participations et Services and Fnac Direct -
NOK 65m about £4.83m
Grindr
Norway's Court of Appeal upheld the regulator's 2021 fine in full, agreeing that Grindr lacked valid consent to share users' data with advertising partners and that the fact someone uses the app is special category data.
GDPR
Read the Datatilsynet decision on Grindr -
€5m about £4.32m
IQVIA Operations France
The CNIL found that IQVIA's pharmacy and patient record data warehouses did not meet the conditions of their health data authorisations, lacked log review and multi factor authentication, and that pharmacy customers were not told their data went to IQVIA. It rejected the claim that the data was anonymous, finding it re-identifiable.
GDPR; French Data Protection Act art. 66, Art. 14, Art. 25
Read the CNIL decision on IQVIA Operations France -
€5m about £4.36m
France Travail
Attackers used social engineering to take over partner advisers' accounts and pull data on people registered over 20 years. The CNIL found weak authentication, poor logging and overly broad access rights, and noted the agency had identified the needed measures but not put them in place.
GDPR, Art. 32
Read the CNIL decision on France Travail -
€5m about £4.21m
Luka Inc.
The Italian regulator found that the company behind the Replika chatbot had not identified a legal basis for its processing, had an inadequate privacy policy and had no age verification despite saying it excluded minors. It ordered compliance and opened a separate probe into how the underlying AI model was trained.
GDPR
Read the GPDP decision on Luka Inc. -
€4.75m about £3.92m
Netflix
The Dutch regulator found that between 2018 and 2020 Netflix's privacy statement was unclear about purposes, legal bases, sharing, retention and safeguards for transfers outside Europe, and that customers who asked what data was held did not get enough information.
GDPR
Read the AP decision on Netflix -
€3.5m about £3.05m
Unnamed company (not identified by the CNIL)
The CNIL found a company had sent loyalty members' email addresses and phone numbers to a social network for ad targeting since 2018, relying on marketing consent that never mentioned this use. More than 10.5 million people were affected and the decision was adopted with 16 other EU authorities.
GDPR, Art. 6, Art. 12, Art. 13, Art. 32
Read the CNIL decision on Unnamed company (not identified by the CNIL) -
SEK 37m about £2.75m
Apoteket AB
IMY found the pharmacy chain's use of the Meta Pixel on its website passed sensitive customer purchase data to Meta, and that it lacked appropriate technical and organisational security measures. The issue came to light through the company's own breach notification in 2022.
GDPR, Art. 32, Art. 58(2), Art. 83
Read the IMY decision on Apoteket AB -
NOK 20m about £1.6m
Elkjøp Nordic AS and Elkjøp Norge AS
Norway's regulator found that the electronics retailer ran its customer club without valid consent, reused data for new purposes without assessment, relied on thin legitimate interest assessments and answered data subject requests late.
GDPR
Read the Datatilsynet decision on Elkjøp Nordic AS and Elkjøp Norge AS -
€1.5m about £1.31m
American Express Carte France
The CNIL found the French American Express website set advertising cookies before visitors made a choice, set them even after a refusal, and kept reading existing cookies after consent was withdrawn.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on American Express Carte France -
SEK 15m about £1.13m
Avanza Bank AB
IMY found the bank accidentally switched on extra Meta Pixel features on its website and app, sending data such as holdings, loan amounts, account numbers and personal ID numbers of up to one million people to Meta between 2019 and 2021.
GDPR, Art. 32
Read the IMY decision on Avanza Bank AB -
€750k about £661k
Les Publications Condé Nast (vanityfair.fr)
Despite an earlier order to comply, the CNIL found vanityfair.fr still set consent based cookies on arrival, labelled some cookies as strictly necessary without explaining them, and placed or read cookies after users refused or withdrew consent.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Les Publications Condé Nast (vanityfair.fr) -
SEK 8m about £594k
Apohem AB
IMY found the online pharmacy's Meta Pixel transferred sensitive customer data to Meta without adequate security measures. The administrative court upheld the fine in May 2026 and the company has appealed further.
GDPR, Art. 32, Art. 58(2), Art. 83
Read the IMY decision on Apohem AB -
€645k about £552k
Health Service Executive
Inspections found paper health records kept in derelict or unsuitable stores and damaged by mould, water and animal droppings, and records held longer than needed. The DPC also found the HSE notified breaches late and did not tell affected people, and treated earlier similar failings as aggravating.
GDPR, Art. 5(1)(e), Art. 5(1)(f), Art. 32(1), Art. 33(1), Art. 34(1)
Read the DPC decision on Health Service Executive -
SEK 6m about £492k
Sportadmin i Skandinavien AB
A January 2025 cyber attack on a sports club administration platform exposed data on over 2.1 million people, mostly children and young people, including health data, which was posted on the darknet. The Swedish regulator found known weaknesses left unfixed and no real time intrusion detection.
GDPR, Art. 32
Read the IMY decision on Sportadmin i Skandinavien AB -
€500k about £426k
Hôpital Privé de la Loire
An attacker used a single compromised account to extract patient data over several days because remote access had no VPN or multi factor authentication, access was not limited to care teams and there was no alerting. The CNIL also found more than 202,000 trusted third parties whose data was stolen were never told.
GDPR, Art. 32, Art. 34
Read the CNIL decision on Hôpital Privé de la Loire -
€300k about £256k
EXTIA
The CNIL found that an IT consulting firm left a dozen 2024 erasure requests unprocessed and did not tell 166 requesters what it had done, with others told months late.
GDPR, Art. 12, Art. 17
Read the CNIL decision on EXTIA -
€278k about £240k
Permanent TSB
Fraudsters posing as customers phoned the bank's contact centre, changed account details and obtained further account information because security checks were not followed, and some customers lost money. The DPC also found the bank reported the breaches late, and issued a reprimand with the fines.
GDPR, Art. 5(1)(f), Art. 32(1), Art. 33(1)
Read the DPC decision on Permanent TSB -
€158k about £135k
Character Technologies Inc.
The Italian regulator fined the operator of Character.AI for privacy notice gaps, a late impact assessment and a late EU representative, and ordered working age verification, an effective block on re-registration by removed minors and private by default profiles for minors.
GDPR
Read the GPDP decision on Character Technologies Inc. -
€50k about £43k
AS Watson (Health & Beauty Continental Europe) B.V. (Kruidvat)
The AP found Kruidvat.nl tracked visitors with cookies without valid consent, using pre-ticked boxes and making refusal take many steps, which could reveal sensitive drugstore purchases. After the company's objection the AP cut the original 600,000 euro fine to 50,000 euros.
Proposed at €600k before the final decision.
GDPR (AVG)
Read the AP decision on AS Watson (Health & Beauty Continental Europe) B.V. (Kruidvat) -
NOK 250k about £19k
Timegrip AS
After a retail chain went bankrupt, its time tracking provider refused to give unpaid employees their timesheet data. Norway's regulator treated the provider as the de facto controller and fined it for intentionally refusing 80 access requests.
GDPR, Art. 15(1), Art. 15(3)
Read the Datatilsynet decision on Timegrip AS -
€3,000 about £2,597
Wallapop, S.L.
The AEPD found es.wallapop.com used cookies before users consented, that Reject all did not stop them and that installed cookies could not be removed through the settings panel. The 5,000 euro proposed fine was cut by 40 percent to 3,000 euros after Wallapop admitted responsibility and paid early.
Proposed at €5,000 before the final decision.
Spanish LSSI art. 22.2 (ePrivacy), Art. 22.2 LSSI, Art. 38.4(g) LSSI
Read the AEPD decision on Wallapop, S.L.
Orders, reprimands and findings
-
Order or finding
Children's Health Ireland at Tallaght
After protected disclosures and an unannounced inspection, the DPC found the hospital's junior doctors' office and confidential waste bins did not keep personal data secure. It issued a reprimand and ordered the hospital to finalise and implement impact assessments for records and waste handling.
GDPR, Art. 5(1)(f), Art. 32(1)
Read the DPC decision on Children's Health Ireland at Tallaght -
Order or finding
Amazon Italia Logistica srl
The Italian regulator ordered Amazon's logistics arm to stop processing data on more than 1,800 workers at its Passo Corese site after finding notes on health, strikes, union activity and family matters kept for up to ten years and widely accessible. It also ordered a stop to footage from cameras near toilets and break areas.
GDPR
Read the GPDP decision on Amazon Italia Logistica srl -
Order or finding
Lower Saxony media company (not named by the regulator)
The Hannover administrative court upheld the regulator's order against a media company, ruling that a banner with Accept all on the first layer must offer an equally visible Reject all button. It also criticised repeated banner prompts, a misleading Accept and close button and hidden information on partners and third country transfers.
TDDDG s.25 and GDPR, § 25 TDDDG
Read the LfD-NI decision on Lower Saxony media company (not named by the regulator) -
Order or finding
Unnamed company (anonymised by the Garante)
The Garante found a website banner offered five unclear buttons with no indication of how to continue without non technical cookies, and reappeared on every visit. It issued a reprimand rather than a fine because the company fixed the banner during the proceedings.
GDPR; Italian Privacy Code art. 122 (ePrivacy); Garante cookie guidelines, Art. 4(11), Art. 5, Art. 7, Art. 12, Art. 13, Art. 24, Art. 25, Art. 122 Codice
Read the GPDP decision on Unnamed company (anonymised by the Garante) -
Order or finding
Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence
The Italian regulator ordered an urgent, immediate limitation on DeepSeek's processing of Italian users' data and opened an investigation after the companies gave an unsatisfactory reply and said EU law did not apply to them.
GDPR
Read the GPDP decision on Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence -
Order or finding
Several website publishers (not named)
After complaints, the CNIL ordered several publishers to fix cookie banners within one month where the reject option was a small or buried link, styled less prominently than accept, or worded vaguely while accept appeared several times.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Several website publishers (not named)
Laws, deadlines and guidance
-
Law and guidance
Outils de rejeu de session : la CNIL publie sa recommandation pour guider les acteurs
The CNIL published its recommendation on session replay tools, stating they always need prior consent because no exemption applies, and asking providers and site owners to mask sensitive inputs and explain the tool on the first layer of the consent interface.
French Data Protection Act art. 82 (ePrivacy); GDPR data minimisation, Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Outils de rejeu de session : la CNIL publie sa recommandation pour guider les acteurs -
Law and guidance
EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines
The EDPB adopted draft guidelines setting a five step method for deciding when regulators should fine rather than reprimand or order, with 14 worked examples, and finalised its guidelines on how the Digital Services Act and GDPR interact.
GDPR
Read the EDPB decision on EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines -
Law and guidance
AI Act | Shaping Europe's digital future
The AI Act became generally applicable on 2 August 2026, including Article 50 transparency duties for chatbots and AI generated content and AI Office and national enforcement, while the high risk rules were pushed back by the Digital Omnibus.
EU AI Act, Art. 50, Art. 113
Read the EC decision on AI Act | Shaping Europe's digital future -
Law and guidance
Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI)
The Digital Omnibus on AI, Regulation (EU) 2026/1744, published on 24 July 2026 and in force from 27 July 2026, delays high risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI in Annex I products. The Commission proposed it on 19 November 2025.
EU AI Act (as amended by Regulation (EU) 2026/1744), Art. 113
Read the EC decision on Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI) -
Law and guidance
Pixels de suivi dans les courriers électroniques : la CNIL publie ses recommandations pour mieux protéger la vie privée
The CNIL published its final recommendation on tracking pixels in emails, setting out when consent is needed, an exemption for measuring deliverability of service emails, and a three month window to inform recipients on existing lists.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Pixels de suivi dans les courriers électroniques : la CNIL publie ses recommandations pour mieux protéger la vie privée -
Law and guidance
EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus)
The EDPB and EDPS issued Joint Opinion 2/2026 on the Commission's Digital Omnibus proposal, which would amend the GDPR and related digital laws as part of a simplification package. The changes are proposals and not yet law.
GDPR (proposed amendments, Digital Omnibus COM(2025) 837)
Read the EDPB decision on EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus) -
Law and guidance
Simpler EU digital rules and new digital wallets to save billions for businesses and boost innovation (IP/25/2718)
The Commission proposed moving cookie rules for personal data into the GDPR, with one click refusal, choices respected for at least six months, browser level preference signals and no banner for low risk uses such as aggregated audience measurement. Breaches would carry GDPR level fines of up to 4 percent of global turnover.
Digital Omnibus proposal (amending GDPR and ePrivacy Directive)
Read the EC decision on Simpler EU digital rules and new digital wallets to save billions for businesses and boost innovation (IP/25/2718) -
Law and guidance
Withdrawal of Commission proposals (C/2025/5423)
The Official Journal listed the 2017 ePrivacy Regulation proposal among withdrawn Commission proposals, so the ePrivacy Directive and national cookie laws remain the applicable rules.
Proposed ePrivacy Regulation COM(2017)10 (2017/0003 (COD))
Read the EC decision on Withdrawal of Commission proposals (C/2025/5423) -
Law and guidance
Press Release No 106/25: Data Protection: the General Court dismisses an action for annulment of the new framework for the transfer of personal data between the European Union and the United States
The EU General Court dismissed a challenge to the EU-US Data Privacy Framework in Latombe v Commission (T-553/23), confirming that the US offered adequate protection when the adequacy decision was adopted in July 2023, so transfers under the framework remain lawful.
GDPR Chapter V; Commission Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework)
Read the CJEU decision on Press Release No 106/25: Data Protection: the General Court dismisses an action for annulment of the new framework for the transfer of personal data between the European Union and the United States -
Law and guidance
Regulation (EU) 2024/1689 (Artificial Intelligence Act)
Obligations for providers of general purpose AI models, the governance provisions and the penalties chapter (apart from Commission GPAI fines under Article 101) have applied since 2 August 2025.
EU AI Act, Chapter V, Chapter XII, Art. 113
Read the EC decision on Regulation (EU) 2024/1689 (Artificial Intelligence Act) -
Law and guidance
Regulation (EU) 2024/1689 (Artificial Intelligence Act)
Chapters I and II of the AI Act, which cover AI literacy and the list of prohibited AI practices, have applied since 2 February 2025.
EU AI Act, Art. 4, Art. 5, Art. 113
Read the EC decision on Regulation (EU) 2024/1689 (Artificial Intelligence Act) -
Law and guidance
EDPB opinion on AI models: GDPR principles support responsible AI
At the Irish DPC's request, the EDPB issued Opinion 28/2024 on when AI models can be treated as anonymous, how the legitimate interest test applies to developing and deploying them, and what follows if a model was built on unlawfully processed personal data.
GDPR
Read the EDPB decision on EDPB opinion on AI models: GDPR principles support responsible AI -
Law and guidance
Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive
The EDPB published the final version 2.0 of its guidelines on which technologies fall under the ePrivacy consent rule for device access, with use cases going beyond cookies to URL and pixel tracking, IP based tracking, IoT reporting and unique identifiers.
ePrivacy Directive 2002/58/EC art. 5(3), Art. 5(3) ePrivacy Directive
Read the EDPB decision on Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive -
Law and guidance
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)
Regulation (EU) 2024/1689, the AI Act, was published on 12 July 2024 and entered into force on 1 August 2024. Fines reach 35 million euros or 7% of worldwide turnover for prohibited practices, 15 million or 3% for most other obligations and 7.5 million or 1% for misleading information, with the lower figure applying to SMEs.
EU AI Act, Art. 99, Art. 113
Read the EC decision on Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) -
Law and guidance
EDPB: Consent or Pay models should offer real choice
In Opinion 08/2024 the EDPB said large online platforms will in most cases not obtain valid consent if users can only choose between behavioural ads and paying. It urged a free alternative with less or no personal data processing.
GDPR, Art. 64(2)
Read the EDPB decision on EDPB: Consent or Pay models should offer real choice -
Law and guidance
Report of the work undertaken by the Cookie Banner Taskforce
Landmark older item: EU authorities adopted a common report on cookie banner practices flagged by noyb complaints, which national regulators such as the CNIL now cite when judging reject buttons and deceptive designs.
ePrivacy Directive 2002/58/EC art. 5(3); GDPR
Read the EDPB decision on Report of the work undertaken by the Cookie Banner Taskforce
Would your website pass?
The free Trust Center scan checks the failures behind these decisions: trackers before consent, advertising pixels, security headers, where visitor data goes, privacy requests and AI tools.
How this list is built
- Every record links to the regulator's own decision, press release, the official journal or a court judgment. Trackers and news coverage are used only to find cases.
- The amount, date and organisation were read on that page. Where a regulator first proposed a different amount, the final one is shown.
- Status follows the regulator: final, reduced, or under appeal. Decisions overturned in court are removed from this list.
- Summaries are our own words and describe what the regulator found. They are not legal advice.
- Conversions use the European Central Bank reference rate on the decision date. The data is also available as JSON at /api/fines.