--- title: "Privacy Fines Tracker" date: 2026-07-31 author: "Irene Austria" featured_image: "https://sqmagazine.co.uk/wp-content/uploads/2026/08/privacy-fines-tracker.jpg" --- # Privacy Fines Tracker Canonical URL: Cite as: SQ Magazine, *Privacy Fines Tracker*. **What is in scope:** Penalties where the issuing authority itself published the decision. Penalties disclosed only by the fined company are outside this rule — including the Luxembourg CNPD penalty against Amazon, which the authority never published and which the Luxembourg Administrative Court annulled in March 2026. 21 records. Every figure is traced to the primary source linked on its row. Last verified 7 September 2026. Re-checked every 30 days. | Record | Authority | Amount | Decided | Law | Violation | Status | Verified | Source | |---|---|---|---|---|---|---|---|---| | Google (LLC and Ireland) | CNIL (France) | €325 million | 2025-09-01 | French DPA Act Art. 82; CPCE Art. L.34-5 | Ads inserted in Gmail Promotions/Social tabs and cookies placed at account creation without valid consent | final | 2026-09-07 | [CNIL decision](https://www.cnil.fr/en/cookies-and-advertisements-inserted-between-emails-google-fined-325-million-euros-cnil) | | 23andMe | Information Commissioner's Office (UK) | £2.31 million | 2025-06-17 | UK GDPR (security of processing) | Credential-stuffing attack exposed personal information of 155,592 UK residents, including genetic data | final | 2026-09-07 | [ICO news release](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/23andme-fined-for-failing-to-protect-uk-users-genetic-data/) | | TikTok Technology Limited | Data Protection Commission (Ireland) | €530 million | 2025-04-30 | GDPR Arts. 46(1), 13(1)(f) | Transfers of EEA user data to China and transparency failures; compliance ordered within 6 months | appealed | 2026-09-07 | [Data Protection Commission](https://www.dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following) | | Meta Platforms Ireland (token breach) | Data Protection Commission (Ireland) | €251 million | 2024-12-17 | GDPR Art. 33(3), 33(5), 25(1) and 25(2) | A flaw in Facebook's 'View As' feature combined with the video uploader issued fully permissioned user tokens, exposing profile information for roughly 29 mill… | | 2026-09-07 | [Data Protection Commission](https://www.dataprotection.ie/en/news-media/press-releases/irish-data-protection-commission-fines-meta-eu251-million) | | LinkedIn Ireland Unlimited Company | Data Protection Commission (Ireland) | €310 million | 2024-10-22 | GDPR Art. 6(1)(a), 6(1)(b), 6(1)(f), 5(1)(a), 13(1)(c) and 14(1)(c) | Behavioural analysis and targeted advertising of LinkedIn members using first-party and partner-supplied data, without a valid lawful basis and without telling… | | 2026-09-07 | [Data Protection Commission](https://www.dataprotection.ie/en/news-media/press-releases/irish-data-protection-commission-fines-linkedin-ireland-eu310-million) | | Uber | Autoriteit Persoonsgegevens (Netherlands) | €290 million | 2024-08-26 | | European drivers' data transferred to US servers for over two years without transfer tools, from August 2021 | appealed | 2026-09-07 | [Autoriteit Persoonsgegevens](https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us) | | TikTok Technology Limited (children’s data) | Data Protection Commission (Ireland) | €345 million | 2023-09-01 | GDPR Arts. 5(1)(a), 5(1)(c), 5(1)(f), 24(1), 25(1), 25(2), 12(1), 13(1)(e) | Public-by-default settings for child users, Family Pairing settings, age verification at registration, and transparency toward child users | | 2026-09-07 | [Data Protection Commission](https://www.dataprotection.ie/en/news-media/press-releases/DPC-announces-345-million-euro-fine-of-TikTok) | | TikTok (UK) | Information Commissioner's Office (UK) | £12.7 million | 2023-05-15 | UK GDPR | Unlawful use of children's personal data, including under-13 users without parental consent | appealed | 2026-09-07 | [ICO enforcement record](https://ico.org.uk/action-weve-taken/enforcement/2023/05/tiktok/) | | Meta Platforms Ireland (Facebook) | Data Protection Commission (Ireland) | €1.2 billion | 2023-05-12 | GDPR Art. 46(1) | Continued EU/EEA-to-US Facebook data transfers after the CJEU's Schrems II judgment | appealed | 2026-09-07 | [Data Protection Commission](https://www.dataprotection.ie/en/news-media/press-releases/Data-Protection-Commission-announces-conclusion-of-inquiry-into-Meta-Ireland) | | Meta Platforms Ireland (behavioural advertising) | Data Protection Commission (Ireland) | €210 million (Facebook) + €180 million (Instagram) | 2023-01-04 | GDPR (contract as legal basis) | Relied on the contract legal basis to deliver behavioural advertising on Facebook (€210m) and Instagram (€180m) | | 2026-09-07 | [Data Protection Commission](https://www.dataprotection.ie/en/news-media/data-protection-commission-announces-conclusion-two-inquiries-meta-ireland) | | Epic Games | Federal Trade Commission (US) | $520 million (two orders: $275M penalty, $245M refunds) | 2022-12-19 | COPPA and FTC Act Section 5 | Collected personal information from under-13 Fortnite players without parental consent and enabled live voice and text chat for children by default (COPPA, $27… | final | 2026-09-07 | [Federal Trade Commission](https://www.ftc.gov/news-events/news/press-releases/2022/12/fortnite-video-game-maker-epic-games-pay-more-half-billion-dollars-over-ftc-allegations) | | Meta Platforms Ireland (data scraping) | Data Protection Commission (Ireland) | €265 million | 2022-11-25 | GDPR Art. 25(1) and 25(2) | Facebook Search, Facebook Messenger Contact Importer and Instagram Contact Importer allowed a collated dataset of Facebook personal data to be scraped and late… | | 2026-09-07 | [Data Protection Commission](https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-in-facebook-data-scraping-inquiry) | | Google (location tracking, multistate) | 40 US state attorneys general (multistate coalition) | $391.5 million | 2022-11-14 | State consumer-protection statutes | Between 2014 and 2020 Google misled users into believing that turning Location History off disabled location tracking, while other settings continued recording… | final | 2026-09-07 | [Colorado Attorney General — settlement announcement](https://coag.gov/press-releases/11-14-22/) | | Meta Platforms Ireland (Instagram) | Data Protection Commission (Ireland) | €405 million | 2022-09-15 | GDPR Art. 6(1) and children's data provisions | Public disclosure of children's email addresses and phone numbers via business accounts, and a public-by-default setting on children's personal accounts | | 2026-09-07 | [Data Protection Commission](https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-instagram-inquiry) | | Didi Global | Cyberspace Administration of China (CAC) | ¥8.026 billion | 2022-07-21 | Cybersecurity Law, Data Security Law and Personal Information Protection Law (C… | Sixteen categories of illegal collection and processing of user personal information over seven years — including facial recognition data, precise location, an… | | 2026-09-07 | [Cyberspace Administration of China](http://www.cac.gov.cn/2022-07/21/c_1660021534306352.htm) | | Twitter, Inc. | Federal Trade Commission (US) | $150 million | 2022-05-25 | FTC Act Section 5; violation of the 2011 FTC consent order | Phone numbers and email addresses collected for two-factor authentication and account security were also used for targeted advertising, affecting more than 140… | final | 2026-09-07 | [Federal Trade Commission](https://www.ftc.gov/news-events/news/press-releases/2022/05/ftc-charges-twitter-deceptively-using-account-security-data-sell-targeted-ads) | | Google (cookies, 2021) | CNIL (France) | €150 million | 2021-12-31 | Article 82, French Data Protection Act (ePrivacy cookies) | google.fr and youtube.com offered a one-click accept for cookies but no equivalent one-click refuse, making refusal materially harder than consent. €90M agains… | | 2026-09-07 | [CNIL](https://www.cnil.fr/en/cookies-google-fined-150-million-euros) | | WhatsApp Ireland | Data Protection Commission (Ireland) | €225 million | 2021-09-02 | GDPR transparency obligations | Failed to provide required privacy information to users and to non-users, and to make it available in an easily accessible form | | 2026-09-07 | [Data Protection Commission](https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-whatsapp-inquiry) | | British Airways | Information Commissioner's Office (UK) | £20 million | 2020-10-16 | GDPR (security of processing) | 2018 breach exposed personal and payment data of more than 400,000 customers | final | 2026-09-07 | [ICO penalty notice](https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf) | | Facebook, Inc. (FTC) | Federal Trade Commission (US) | $5 billion | 2019-07-24 | FTC Act; 2012 FTC consent order | Violated 2012 FTC order by deceiving users about their ability to control the privacy of their personal information | final | 2026-09-07 | [FTC press release](https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook) | | Equifax | Federal Trade Commission (US), with CFPB and 50 states | $575 million (up to $700 million) | 2019-07-22 | FTC Act Section 5 and the GLBA Safeguards Rule | The 2017 breach exposed personal data of approximately 147 million people — including Social Security numbers — after Equifax failed to patch a known vulnerabi… | final | 2026-09-07 | [Federal Trade Commission](https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach) | Quoting a figure with a link to this page needs no permission. Reuse of the compiled dataset is licensed under CC BY 4.0: credit SQ Magazine and link back.