Enforcement actions
Landmark penalties across regimes. Amounts are approximate euro equivalents at the time of the decision, which is how they can be compared at all — and also why none of them is exact.
| Organisation | Amount | Authority | Jurisdiction | Year | Ground | Outcome |
|---|---|---|---|---|---|---|
| Meta (Facebook) | €4.5bn | FTC (US) | United States | 2019 | Privacy-order violations after Cambridge Analytica | Final |
| Meta | €1.2bn | DPC (Ireland) / EDPB | Ireland | 2023 | EU–US transfers without valid safeguards | Under appeal |
| Didi Global | €1.2bn | CAC (China) | China | 2022 | PIPL, cybersecurity and data-security violations | Final |
| Amazon | €746m | CNPD (Luxembourg) | Luxembourg | 2021 | Advertising personalisation without valid consent | Annulled |
| TikTok | €530m | DPC (Ireland) | Ireland | 2025 | China transfers and transparency failures | Under appeal |
| €405m | DPC (Ireland) | Ireland | 2022 | Children’s accounts public by default | Final | |
| Meta | €390m | DPC (Ireland) / EDPB | Ireland | 2023 | ‘Contract’ as an invalid basis for behavioural ads | Final |
| TikTok | €345m | DPC (Ireland) | Ireland | 2023 | Children’s default settings and age design | Final |
| €325m | CNIL (France) | France | 2025 | Ads inside Gmail and cookie consent failures | Under appeal | |
| €310m | DPC (Ireland) | Ireland | 2024 | Legal bases for behavioural advertising | Under appeal | |
| Uber | €290m | AP (Netherlands) | Netherlands | 2024 | Driver data to the US without safeguards | Under appeal |
| Meta | €265m | DPC (Ireland) | Ireland | 2022 | Data scraping — protection-by-design failures | Under appeal |
| Epic Games | €259m | FTC (US) | United States | 2022 | COPPA — children’s data and default chat settings | Final |
| Meta | €251m | DPC (Ireland) | Ireland | 2024 | 2018 ‘View As’ breach — notification and design duties | Final |
| €225m | DPC (Ireland) / EDPB | Ireland | 2021 | Transparency failures | Under appeal | |
| SHEIN | €150m | CNIL (France) | France | 2025 | Cookies set without consent | Under appeal |
| Meta | €91m | DPC (Ireland) | Ireland | 2024 | Passwords stored in plaintext | Final |
| €90m | CNIL (France) | France | 2022 | Refusing cookies made harder than accepting | Final | |
| Enel Energia | €79.107m | Garante (Italy) | Italy | 2024 | Unlawful telemarketing at scale | Final |
| Criteo | €40m | CNIL (France) | France | 2023 | Adtech — no proof of consent | Final |
| H&M | €35.259m | Hamburg DPA (Germany) | Germany | 2020 | Covert employee profiling | Final |
| Amazon France Logistique | €32m | CNIL (France) | France | 2024 | Excessive warehouse worker surveillance | Final |
| Clearview AI | €30.5m | AP (Netherlands) | Netherlands | 2024 | Unlawful biometric database (Art 9); Transparency and access failures (Arts 12, 14, 15) | Final |
| British Airways | €22m | ICO (UK) | United Kingdom | 2020 | 2018 breach — security failures | Final |
| Clearview AI | €20m | Garante (Italy) | Italy | 2022 | Unlawful biometric processing via web scraping; Transparency and data subject rights failures | Final |
| Clearview AI | €20m | Hellenic DPA (Greece) | Greece | 2022 | Lawfulness and transparency (Arts 5, 6, 9); Arts 12, 14, 15, 27 failures | Final |
| Clearview AI | €20m | CNIL (France) | France | 2022 | Unlawful processing (Art 6); Data subject rights failures; Non-cooperation with the CNIL | Final |
| Marriott | €20m | ICO (UK) | United Kingdom | 2020 | Starwood breach — due diligence and security | Final |
| OpenAI | €15m | Garante (Italy) | Italy | 2024 | ChatGPT — legal basis, transparency, age checks | Under appeal |
| Clearview AI | €8.8m | ICO (UK) | United Kingdom | 2022 | Unlawful web scraping of UK residents' images; Biometric database without lawful basis | Under appeal |
| Replika (Luka) | €5m | Garante (Italy) | Italy | 2025 | AI companion — legal basis and child safeguards | Final |
Year only — the source data does not record decision dates, so no record here claims one.