SQ Magazine The Threat Index Privacy Fines Tracker
Privacy Fines Tracker
Major privacy penalties as the authorities themselves published them: the amount in the decision's own currency, the law it enforced, and whether it survived appeal. A fine reported only by the fined company never gets a row.
21 records updated through 7 Sep 2026 next review by 7 Oct 2026
Latest change Four Irish DPC penalties added: Instagram 405m, Meta behavioural advertising 390m, WhatsApp 225m, TikTok children 345m (31 Jul 2026) All changes
All records
21 penalties, newest decision first. Filter or search below.
What is in scope Penalties where the issuing authority itself published the decision. Penalties disclosed only by the fined company are outside this rule — including the Luxembourg CNPD penalty against Amazon, which the authority never published and which the Luxembourg Administrative Court annulled in March 2026.
21 penalties issued by 8 authorities. Data Protection Commission (Ireland) accounts for 9 of them.
| Organization | Authority | Decided | Amount (as stated) | Legal basis | Status | Source | Record detail |
|---|---|---|---|---|---|---|---|
| Google (LLC and Ireland) | CNIL (France) | 1 Sep 2025 | €325 million | French DPA Act Art. 82; CPCE Art. L.34-5 | Final | CNIL decision ↗ | |
|
|||||||
| 23andMe | Information Commissioner's Office (UK) | 17 Jun 2025 | £2.31 million | UK GDPR (security of processing) | Final | ICO news release ↗ | |
|
|||||||
| TikTok Technology Limited | Data Protection Commission (Ireland) | 30 Apr 2025 | €530 million | GDPR Arts. 46(1), 13(1)(f) | Under appeal | Data Protection Commission ↗ | |
|
|||||||
| Meta Platforms Ireland (token breach) | Data Protection Commission (Ireland) | 17 Dec 2024 | €251 million | GDPR Art. 33(3), 33(5), 25(1) and 25(2) | Data Protection Commission ↗ | ||
|
|||||||
| LinkedIn Ireland Unlimited Company | Data Protection Commission (Ireland) | 22 Oct 2024 | €310 million | GDPR Art. 6(1)(a), 6(1)(b), 6(1)(f), 5(1)(a), 13(1)(c) and 14(1)(c) | Data Protection Commission ↗ | ||
|
|||||||
| Uber | Autoriteit Persoonsgegevens (Netherlands) | 26 Aug 2024 | €290 million | — | Under appeal | Autoriteit Persoonsgegevens ↗ | |
|
|||||||
| TikTok Technology Limited (children’s data) | Data Protection Commission (Ireland) | 1 Sep 2023 | €345 million | GDPR Arts. 5(1)(a), 5(1)(c), 5(1)(f), 24(1), 25(1), 25(2), 12(1), 13(1)(e) | Data Protection Commission ↗ | ||
|
|||||||
| TikTok (UK) | Information Commissioner's Office (UK) | 15 May 2023 | £12.7 million | UK GDPR | Under appeal | ICO enforcement record ↗ | |
|
|||||||
| Meta Platforms Ireland (Facebook) | Data Protection Commission (Ireland) | 12 May 2023 | €1.2 billion | GDPR Art. 46(1) | Under appeal | Data Protection Commission ↗ | |
|
|||||||
| Meta Platforms Ireland (behavioural advertising) | Data Protection Commission (Ireland) | 4 Jan 2023 | €210 million (Facebook) + €180 million (Instagram) | GDPR (contract as legal basis) | Data Protection Commission ↗ | ||
|
|||||||
| Epic Games | Federal Trade Commission (US) | 19 Dec 2022 | $520 million (two orders: $275M penalty, $245M refunds) | COPPA and FTC Act Section 5 | Final | Federal Trade Commission ↗ | |
|
|||||||
| Meta Platforms Ireland (data scraping) | Data Protection Commission (Ireland) | 25 Nov 2022 | €265 million | GDPR Art. 25(1) and 25(2) | Data Protection Commission ↗ | ||
|
|||||||
| Google (location tracking, multistate) | 40 US state attorneys general (multistate coalition) | 14 Nov 2022 | $391.5 million | State consumer-protection statutes | Final | Colorado Attorney General — settlement announcement ↗ | |
|
|||||||
| Meta Platforms Ireland (Instagram) | Data Protection Commission (Ireland) | 15 Sep 2022 | €405 million | GDPR Art. 6(1) and children's data provisions | Data Protection Commission ↗ | ||
|
|||||||
| Didi Global | Cyberspace Administration of China (CAC) | 21 Jul 2022 | ¥8.026 billion | Cybersecurity Law, Data Security Law and Personal Information Protection Law (C… | Cyberspace Administration of China ↗ | ||
|
|||||||
| Twitter, Inc. | Federal Trade Commission (US) | 25 May 2022 | $150 million | FTC Act Section 5; violation of the 2011 FTC consent order | Final | Federal Trade Commission ↗ | |
|
|||||||
| Google (cookies, 2021) | CNIL (France) | 31 Dec 2021 | €150 million | Article 82, French Data Protection Act (ePrivacy cookies) | CNIL ↗ | ||
|
|||||||
| WhatsApp Ireland | Data Protection Commission (Ireland) | 2 Sep 2021 | €225 million | GDPR transparency obligations | Data Protection Commission ↗ | ||
|
|||||||
| British Airways | Information Commissioner's Office (UK) | 16 Oct 2020 | £20 million | GDPR (security of processing) | Final | ICO penalty notice ↗ | |
|
|||||||
| Facebook, Inc. (FTC) | Federal Trade Commission (US) | 24 Jul 2019 | $5 billion | FTC Act; 2012 FTC consent order | Final | FTC press release ↗ | |
|
|||||||
| Equifax | Federal Trade Commission (US), with CFPB and 50 states | 22 Jul 2019 | $575 million (up to $700 million) | FTC Act Section 5 and the GLBA Safeguards Rule | Final | Federal Trade Commission ↗ | |
|
|||||||
No records match the current filters.
Verification ledger
3 most recent of 3 logged updates- Four Irish DPC penalties added: Instagram 405m, Meta behavioural advertising 390m, WhatsApp 225m, TikTok children 345m 31 Jul 2026
- TikTok UK decision date corrected to 15 May 2023 per the ICO enforcement record; Uber violation window narrowed to the authority statement 31 Jul 2026
- Tracker launched with 8 penalties verified from authority decisions 31 Jul 2026
How this tracker is maintained
Every penalty is one the issuing authority published itself.
-
Sourced
Penalties enter when the authority publishes its own decision or announcement. A penalty disclosed only by the fined company does not qualify, because there is no decision to cite and no way to verify the amount or the finding.
-
Dated
Each row carries the date the authority decided, not the date it was reported. Where an authority notifies a company before announcing publicly, the decision date is the one recorded.
-
Re-checked
Decisions are re-checked every 30 days for appeals, reductions and annulments, which are common at this scale and frequently change the final figure years after the headline.
- Why does one regulator issue most of these?
- Under the GDPR one-stop-shop a company answers to the authority where its EU establishment sits, and most of the largest platforms are established in the same jurisdiction. The concentration is a feature of how the regulation is enforced, not of how this table was built.
- Was the fine actually paid?
- Often not, or not in full. Penalties at this scale are routinely appealed, and some are reduced or annulled entirely on procedural grounds. The amount here is the decision as issued; the status field records what we have been able to verify since.
- Why is a well-known fine missing?
- Almost always because the issuing authority published no decision to cite, or because the penalty was annulled. Both are recorded in the scope note rather than left for a reader to wonder about.
This is informational content and does not constitute legal advice. Penalties are frequently appealed, reduced, or annulled after the decision date, and an amount here reflects the decision as issued rather than what was ultimately paid. Confirm current status with the issuing authority or the court record before relying on a figure.
Quoting a figure with a link to this page needs no permission. Cite it as you would any source. Reuse of the compiled dataset itself is licensed under CC BY 4.0: credit SQ Magazine and link back.
