Every Major GDPR Fine,Searchable Decision Register

Record-breaking fine for transferring EU user data to the United States without adequate safeguards following the Schrems II ruling. The DPC found that Meta's reliance on Standard Contractual Clauses was insufficient to protect EU citizens' data from US surveillance programs.

Luxembourg's CNPD imposed this fine in July 2021 for Amazon's advertising-targeting system processing personal data without a valid Article 6 lawful basis, following complaints coordinated by the French digital-rights group La Quadrature du Net. The administrative tribunal upheld the decision in March 2025, but on 12 March 2026 the Cour administrative (Luxembourg's appeal court) annulled the fine, finding the CNPD had not properly assessed Amazon's degree of negligence or whether a measure other than a fine was appropriate. The court confirmed the CNPD's core findings (legitimate interest was not a valid basis for the advertising processing) and the case was remitted to the CNPD to reconsider the penalty.

The DPC fined TikTok for transferring European user data to China without adequate protections and for misleading the DPC about data storage practices. The investigation found that TikTok staff in China had access to EEA user data without equivalent protection measures.

Two combined fines (Facebook €210M + Instagram €180M) for forcing users to accept personalised advertising as a condition of using the service. The EDPB directed the DPC to investigate the lawful basis for processing, finding that Meta could not rely on 'contractual necessity' for behavioural advertising.

The CNIL fined Google €325M (€200M against Google LLC and €125M against Google Ireland) for inserting advertising disguised as emails between messages in the 'Promotions' and 'Social' tabs of Gmail without consent, and for placing advertising cookies when users created a Google account without valid consent. The cookie breach concerned more than 74 million French accounts, of which 53 million had been shown the ad-style emails. Like the earlier CNIL cookie fines, the decision rests on Article 82 of the French Data Protection Act (the ePrivacy regime) rather than the GDPR itself.

LinkedIn was fined for processing user data for behavioural analysis and targeted advertising without a valid legal basis. The DPC found that LinkedIn's reliance on legitimate interest and consent for behavioural advertising did not meet GDPR requirements, and transparency obligations were not fulfilled.

The Dutch DPA imposed the largest-ever fine by a non-Irish regulator for Uber's transfer of European driver data to the US without adequate protections. French drivers filed the initial complaint through the LQDN rights group, and the Dutch AP acted as lead supervisory authority given Uber's EU headquarters.

Facebook's personal data of over 533 million users from 106 countries was scraped and leaked online. The DPC found that Facebook failed to implement appropriate technical measures (data protection by design and default) to prevent the mass scraping of user data through its contact importer and search features.

Following two inquiries into the September 2018 Facebook 'View As' token breach (which exposed roughly 29 million accounts globally, about 3 million in the EU/EEA), the DPC fined Meta €251 million. The bulk fell under Article 25 data-protection-by-design and by-default (€130M for Art. 25(1) and €110M for Art. 25(2)), with a further €8M under Article 33(3) for an incomplete breach notification and €3M under Article 33(5) for failing to document the breaches adequately.

WhatsApp was fined for failing to meet transparency obligations regarding how it shared user data with other Meta companies. The initial DPC proposed fine was significantly lower, but the European Data Protection Board (EDPB) used its dispute resolution mechanism to increase it.

The CNIL fined Infinite Styles Services Co. Limited, the Irish entity operating shein.com, for placing advertising cookies on visitors' devices before any consent was given and for continuing to read cookies after users clicked 'Refuse all' or withdrew consent. The information banners also failed to describe the advertising purpose of the cookies. The decision followed an inspection of the site that began in August 2023 and, like the parallel Google case, rests on Article 82 of the French Data Protection Act.

CNIL fined Google for making it difficult for users to refuse cookies on google.fr and youtube.com. While accepting all cookies required one click, refusing them required multiple steps across several pages, which the CNIL deemed a violation of free consent principles.

Meta was fined after an investigation found that hundreds of millions of Facebook user passwords had been stored in plaintext on internal systems since 2012. The investigation was triggered by Meta's own notification to the DPC in 2019.

CNIL fined Google Ireland €90M (alongside Google LLC's €150M) for making it difficult for youtube.com users to refuse cookies compared to accepting them. The restricted formation noted that the refusal mechanism required several clicks while acceptance was a single click.

CNIL fined Microsoft for depositing advertising cookies on users' computers visiting bing.com without prior consent. The CNIL found that Microsoft placed cookies for advertising purposes before users could express their preferences.

CNIL fined Facebook for making it overly complex for facebook.com users in France to refuse cookies. While a single click accepted all tracking, refusing required navigating through multiple settings pages, violating the requirement for freely given consent.

The first major GDPR fine. CNIL found that Google's consent architecture for personalised advertising lacked transparency and valid consent. Information about data processing was spread across multiple documents, and consent for ad personalisation was pre-checked by default.

Criteo, a major advertising technology company, was fined for processing personal data for advertising purposes without valid consent. Users' data was collected via cookies placed by Criteo's partners without proper information or freely given consent.

H&M's Nuremberg service centre recorded extensive personal details about employees including health issues, family problems, and religious beliefs during return-to-work interviews. This data was stored and accessible to managers for profiling employees.

The Dutch AP imposed a €30.5M fine on Clearview AI, the largest of the European Clearview penalties, for building an illegal database of biometric facial codes by scraping images from the internet without a lawful basis, unlawfully processing special-category biometric data under Article 9, failing to inform data subjects or answer access requests, and not designating an EU representative under Article 27. The AP also warned that using Clearview's services is itself unlawful and attached penalty payments of up to €5.1M for continued non-compliance.

TIM conducted millions of unwanted marketing calls, including to numbers registered on the national opt-out list. The Garante identified systematic failures in consent management, data retention, and a failure to honour data subjects' opt-out requests.

After an October 2024 breach in which an attacker exploited insufficient VPN authentication and ineffective abnormal-behaviour detection to access personal data on some 24 million Free Mobile and Free subscriber contracts (including IBANs for dual customers), the CNIL fined Free Mobile €27M for inadequate security under Article 32. The regulator also found the breach-notification email to affected individuals did not contain all the information required by Article 34, and that data on former subscribers had been retained beyond the period necessary, breaching Article 5(1)(e).

Enel Energia was fined for aggressive telemarketing using personal data without valid consent. The investigation uncovered a complex chain of data brokers and call centres operating with inadequate consent management, resulting in millions of unsolicited calls.

British Airways suffered a data breach in 2018 where attackers exploited vulnerabilities to skim payment card details from the ba.com website and mobile app. The ICO initially proposed a GBP183M fine but reduced it to GBP20M citing COVID-19 economic impacts and BA's cooperation.

Marriott's Starwood guest reservation database was breached, exposing approximately 339 million guest records globally, including 30 million EEA residents. The breach originated from a 2014 compromise of Starwood systems that Marriott failed to detect during its 2016 acquisition due diligence.