SQ Magazine The Threat Index Privacy Fines Tracker

Privacy Fines Tracker

Major privacy penalties as the authorities themselves published them: the amount in the decision's own currency, the law it enforced, and whether it survived appeal. A fine reported only by the fined company never gets a row.

21 records updated through 8 Oct 2026 last verified 12 Oct 2026 next review by 7 Nov 2026

At a glance

Largest fine in euros: Meta Platforms Ireland (Facebook) €1.2 billion
Most recent decision: Google (LLC and Ireland) 1 Sep 2025

All records

21 penalties, newest decision first. Filter or search below.

How to use this tracker

Search & filter
Filter by authority, status or month, or use the search box to find a specific penalty.
Explore the data
Sort by newest first or A to Z.
Inspect records
Select Detail on any row to open its full record, then copy a link that opens that row directly.
Verify sources
Every row links the primary source it came from, most often dataprotection.ie.

Organization	Authority	Decided	Amount (as stated)	Legal basis	Status	Source
Google (LLC and Ireland)	CNIL (France)	1 Sep 2025	€325 million	French DPA Act Art. 82; CPCE Art. L.34-5	Final	CNIL decision
Violation Ads inserted in Gmail Promotions/Social tabs and cookies placed at account creation without valid consent Primary source CNIL decision ↗ Last confirmed 8 Oct 2026 Recent change €200m (Google LLC) + €125m (Google Ireland); compliance ordered within six months
23andMe	Information Commissioner's Office (UK)	17 Jun 2025	£2.31 million	UK GDPR (security of processing)	Final	ICO news release
Violation Credential-stuffing attack exposed personal information of 155,592 UK residents, including genetic data Primary source ICO news release ↗ Last confirmed 8 Oct 2026 Recent change Fine issued June 17, 2025 after joint investigation with Canada's OPC
TikTok Technology Limited	Data Protection Commission (Ireland)	30 Apr 2025	€530 million	GDPR Arts. 46(1), 13(1)(f)	Under appeal	Data Protection Commission
Violation Transfers of EEA user data to China and transparency failures; compliance ordered within 6 months Primary source Data Protection Commission ↗ Last confirmed 8 Oct 2026 Recent change Final decision adopted April 30, 2025; TikTok appealed
Meta Platforms Ireland (token breach)	Data Protection Commission (Ireland)	17 Dec 2024	€251 million	GDPR Art. 33(3), 33(5), 25(1) and 25(2)		Data Protection Commission
Violation A flaw in Facebook's 'View As' feature combined with the video uploader issued fully permissioned user tokens, exposing profile information for roughly 29 mill… Primary source Data Protection Commission ↗ Last confirmed 8 Oct 2026 Recent change Added 3 Aug 2026. Verified against the DPC's own press release: decision 17 Dec 2024, fines totalling €251m split €8m (Art. 33(3)), €3m (Art. 33(5)), €130m (Art. 25(1)) and €110m (Art. 25(2)). Appeal…
LinkedIn Ireland Unlimited Company	Data Protection Commission (Ireland)	22 Oct 2024	€310 million	GDPR Art. 6(1)(a), 6(1)(b), 6(1)(f), 5(1)(a), 13(1)(c) and 14(1)(c)		Data Protection Commission
Violation Behavioural analysis and targeted advertising of LinkedIn members using first-party and partner-supplied data, without a valid lawful basis and without telling… Primary source Data Protection Commission ↗ Last confirmed 8 Oct 2026 Recent change Added 3 Aug 2026. Verified against the DPC's own press release: decision notified to LinkedIn 22 Oct 2024, announced 24 Oct, fines totalling €310m split €105m/€110m/€95m across the Article 6 and Arti…
Uber	Autoriteit Persoonsgegevens (Netherlands)	26 Aug 2024	€290 million	not available	Under appeal	Autoriteit Persoonsgegevens
Violation European drivers' data transferred to US servers for over two years without transfer tools, from August 2021 Primary source Autoriteit Persoonsgegevens ↗ Last confirmed 8 Oct 2026 Recent change Violation window narrowed to what the authority states; the article citation was removed because the decision notice does not name one
TikTok Technology Limited (children’s data)	Data Protection Commission (Ireland)	1 Sep 2023	€345 million	GDPR Arts. 5(1)(a), 5(1)(c), 5(1)(f), 24(1), 25(1), 25(2), 12(1), 13(1)(e)		Data Protection Commission
Violation Public-by-default settings for child users, Family Pairing settings, age verification at registration, and transparency toward child users Primary source Data Protection Commission ↗ Last confirmed 8 Oct 2026 Recent change Added 31 Jul 2026; appeal status not yet verified against a court record
TikTok (UK)	Information Commissioner's Office (UK)	15 May 2023	£12.7 million	UK GDPR	Under appeal	ICO enforcement record
Violation Unlawful use of children's personal data, including under-13 users without parental consent Primary source ICO enforcement record ↗ Last confirmed 8 Oct 2026 Recent change Decision date corrected to 15 May 2023 to match the ICO enforcement record; ICO (July 2025) confirms TikTok has appealed
Meta Platforms Ireland (Facebook)	Data Protection Commission (Ireland)	12 May 2023	€1.2 billion	GDPR Art. 46(1)	Under appeal	Data Protection Commission
Violation Continued EU/EEA-to-US Facebook data transfers after the CJEU's Schrems II judgment Primary source Data Protection Commission ↗ Last confirmed 8 Oct 2026 Recent change Fine imposed with order to suspend future transfers; Meta appealed
Meta Platforms Ireland (behavioural advertising)	Data Protection Commission (Ireland)	4 Jan 2023	€210 million (Facebook) + €180 million (Instagram)	GDPR (contract as legal basis)		Data Protection Commission
Violation Relied on the contract legal basis to deliver behavioural advertising on Facebook (€210m) and Instagram (€180m) Primary source Data Protection Commission ↗ Last confirmed 8 Oct 2026 Recent change Corrected: the DPC announced two fines in this decision, €210M for Facebook and €180M for Instagram. The previous €390 million was our sum, which the authority never stated.
Epic Games	Federal Trade Commission (US)	19 Dec 2022	$520 million (two orders: $275M penalty, $245M refunds)	COPPA and FTC Act Section 5	Final	Federal Trade Commission
Violation Collected personal information from under-13 Fortnite players without parental consent and enabled live voice and text chat for children by default (COPPA, $27… Primary source Federal Trade Commission ↗ Last confirmed 8 Oct 2026 Recent change Added 3 Aug 2026 (completeness sweep). Two stipulated federal orders announced together; recorded as one entry with the split stated because the FTC announced them as a single $520M action. Status fi…
Meta Platforms Ireland (data scraping)	Data Protection Commission (Ireland)	25 Nov 2022	€265 million	GDPR Art. 25(1) and 25(2)		Data Protection Commission
Violation Facebook Search, Facebook Messenger Contact Importer and Instagram Contact Importer allowed a collated dataset of Facebook personal data to be scraped and late… Primary source Data Protection Commission ↗ Last confirmed 8 Oct 2026 Recent change Added 3 Aug 2026. Verified against the DPC's own press release: decision adopted 25 Nov 2022, announced 28 Nov, fines totalling €265m for infringements of Art. 25(1) and 25(2). Appeal status not veri…
Google (location tracking, multistate)	40 US state attorneys general (multistate coalition)	14 Nov 2022	$391.5 million	State consumer-protection statutes	Final	Colorado Attorney General — settlement announcement
Violation Since at least 2014 Google misled users into believing that turning Location History off disabled location tracking, while other settings continued recording… Primary source Colorado Attorney General — settlement announcement ↗ Last confirmed 12 Oct 2026 Recent change Added 3 Aug 2026 (completeness sweep, second pass). A coalition action: recorded once at the coalition total rather than forty times at state shares. The New Jersey coalition-level release is bot-wal…
Meta Platforms Ireland (Instagram)	Data Protection Commission (Ireland)	15 Sep 2022	€405 million	GDPR Art. 6(1) and children's data provisions		Data Protection Commission
Violation Public disclosure of children's email addresses and phone numbers via business accounts, and a public-by-default setting on children's personal accounts Primary source Data Protection Commission ↗ Last confirmed 8 Oct 2026 Recent change Added 31 Jul 2026; appeal status not yet verified against a court record
Didi Global	Cyberspace Administration of China (CAC)	21 Jul 2022	¥8.026 billion	Cybersecurity Law, Data Security Law and Personal Information Protection Law (C…		Cyberspace Administration of China
Violation Sixteen categories of illegal collection and processing of user personal information over seven years — including facial recognition data, precise location, an… Primary source Cyberspace Administration of China ↗ Last confirmed 8 Oct 2026 Recent change Added 3 Aug 2026 (completeness sweep). The largest privacy penalty issued outside the US and EU, and third-largest anywhere after the FTC's $5B and the DPC's €1.2B. Verified against the CAC's own ann…
Twitter, Inc.	Federal Trade Commission (US)	25 May 2022	$150 million	FTC Act Section 5; violation of the 2011 FTC consent order	Final	Federal Trade Commission
Violation Phone numbers and email addresses collected for two-factor authentication and account security were also used for targeted advertising, affecting more than 140… Primary source Federal Trade Commission ↗ Last confirmed 8 Oct 2026 Recent change Added 3 Aug 2026 (completeness sweep). Recorded under the corporate name at the time of the decision. Status final: stipulated order.
Google (cookies, 2021)	CNIL (France)	31 Dec 2021	€150 million	Article 82, French Data Protection Act (ePrivacy cookies)		CNIL press release, 6 January 2022 (archived); deliberation SAN-2021-023 on Légifrance
Violation google.fr and youtube.com offered a one-click accept for cookies but no equivalent one-click refuse, making refusal materially harder than consent. €90M agains… Primary source CNIL press release, 6 January 2022 (archived); deliberation SAN-2021-023 on Légifrance ↗ Last confirmed 12 Oct 2026 Recent change Added 3 Aug 2026 (completeness sweep). A separate decision from the €325M CNIL penalty already recorded — deliberation of 31 December 2021, announced 6 January 2022, under the ePrivacy cookies regime…
WhatsApp Ireland	Data Protection Commission (Ireland)	2 Sep 2021	€225 million	GDPR transparency obligations		Data Protection Commission
Violation Failed to provide required privacy information to users and to non-users, and to make it available in an easily accessible form Primary source Data Protection Commission ↗ Last confirmed 8 Oct 2026 Recent change Added 31 Jul 2026; fine set after an EDPB binding decision required the DPC to increase it. Appeal status not yet verified against a court record
British Airways	Information Commissioner's Office (UK)	16 Oct 2020	£20 million	GDPR (security of processing)	Final	ICO penalty notice
Violation 2018 breach exposed personal and payment data of more than 400,000 customers Primary source ICO penalty notice ↗ Last confirmed 8 Oct 2026 Recent change Penalty issued October 16, 2020, reduced from the £183.39m notice of intent
Facebook, Inc. (FTC)	Federal Trade Commission (US)	24 Jul 2019	$5 billion	FTC Act; 2012 FTC consent order	Final	FTC press release
Violation Violated 2012 FTC order by deceiving users about their ability to control the privacy of their personal information Primary source FTC press release ↗ Last confirmed 8 Oct 2026 Recent change Stipulated final order filed in D.D.C. with 20-year privacy program requirements
Equifax	Federal Trade Commission (US), with CFPB and 50 states	22 Jul 2019	$575 million (up to $700 million)	FTC Act Section 5 and the GLBA Safeguards Rule	Final	Federal Trade Commission
Violation The 2017 breach exposed personal data of approximately 147 million people — including Social Security numbers — after Equifax failed to patch a known vulnerabi… Primary source Federal Trade Commission ↗ Last confirmed 8 Oct 2026 Recent change Added 3 Aug 2026 (completeness sweep). A settlement rather than a contested penalty, recorded because the issuing authorities published the decision and the amount — the scope test. Status final: cou…

About this data

Scope: Penalties where the issuing authority itself published the decision. Penalties disclosed only by the fined company are outside this rule — including the Luxembourg CNPD penalty against Amazon, which the authority never published and which the Luxembourg Administrative Court annulled in March 2026.
Key facts: 21 penalties issued by 8 authorities. Data Protection Commission (Ireland) accounts for 9 of them.
Reading the table: Penalties as each data-protection authority published them, in the currency the decision states: a £12.7m ICO penalty never becomes dollars. Appeal status is recorded where a court record confirms it and left blank otherwise, rather than assumed final. Informational only, not legal advice.

Using this data in research or journalism?

Quoting a figure with a link to this page needs no permission. Reuse of the compiled dataset is licensed under CC BY 4.0: credit SQ Magazine and link back.

Download CSV

What the data shows

The charts below redraw the table above as the trends and comparisons a table cannot show.

Decisions by authority

Published penalties per issuing authority. Amounts are not added up: each stays in the currency its authority set.

Where decisions stand

Penalties by appeal status, as the authority or court last published it.

Verification ledger

5 most recent of 6 logged updates · RSS

11 Oct 2026 Latest Re-verified (primary source)
Source moved to the archived CNIL release
Google (cookies, 2021)
11 Oct 2026 Re-verified (primary source)
Between 2014 and 2020 to since at least 2014
Google (location tracking, multistate)
8 Oct 2026 Re-verified
Re-verify pass: 21 rows due. 19 re-confirmed against their cited source, 0 updated, 2 not re-checked this pass and left at their old date.
31 Jul 2026 Added
Four Irish DPC penalties added: Instagram 405m, Meta behavioural advertising 390m, WhatsApp 225m, TikTok children 345m
31 Jul 2026 Updated
TikTok UK decision date corrected to 15 May 2023 per the ICO enforcement record; Uber violation window narrowed to the authority statement

How this tracker is maintained

Every penalty is one the issuing authority published itself.

Sourced

Penalties enter when the authority publishes its own decision or announcement. A penalty disclosed only by the fined company does not qualify, because there is no decision to cite and no way to verify the amount or the finding.
Dated

Each row carries the date the authority decided, not the date it was reported. Where an authority notifies a company before announcing publicly, the decision date is the one recorded.
Re-checked

Decisions are re-checked every 30 days for appeals, reductions and annulments, which are common at this scale and frequently change the final figure years after the headline.

Why does one regulator issue most of these?: Under the GDPR one-stop-shop a company answers to the authority where its EU establishment sits, and most of the largest platforms are established in the same jurisdiction. The concentration is a feature of how the regulation is enforced, not of how this table was built.
Was the fine actually paid?: Often not, or not in full. Penalties at this scale are routinely appealed, and some are reduced or annulled entirely on procedural grounds. The amount here is the decision as issued; the status field records what we have been able to verify since.
Why is a well-known fine missing?: Almost always because the issuing authority published no decision to cite, or because the penalty was annulled. Both are recorded in the scope note rather than left for a reader to wonder about.

This is informational content and does not constitute legal advice. Penalties are frequently appealed, reduced, or annulled after the decision date, and an amount here reflects the decision as issued rather than what was ultimately paid. Confirm current status with the issuing authority or the court record before relying on a figure.