Data Privacy fines

The FTC imposed a $5B penalty and sweeping new privacy restrictions after finding that Facebook deceived users about their ability to control personal data, in violation of a 2012 consent order. Third-party apps had harvested data on up to 87 million users in the Cambridge Analytica episode. It was the largest privacy penalty in history at the time.

Texas settled claims that Google unlawfully captured biometric data such as face and voice identifiers and made misleading claims about Incognito mode and location tracking. It is one of the largest single-state privacy settlements on record.

The Irish DPC fined Meta for continuing to transfer EU users' personal data to US servers after the Schrems II ruling, exposing that data to potential US surveillance without adequate safeguards. It is the largest GDPR fine ever issued.

The Cyberspace Administration of China imposed a sweeping penalty on Didi for extensive data-security and personal-information violations following a year-long investigation.

Luxembourg's CNPD fined Amazon for processing personal data for behavioural advertising without valid consent, the largest GDPR fine at the time. In March 2026 the Administrative Court annulled the penalty and remanded it, so no money is currently owed.

The Irish DPC fined TikTok for unlawfully transferring EU users' data to China without ensuring equivalent protection, and for related transparency failures.

The Irish DPC found that Google Ireland processed users' location data through Web & App Activity, Location History and Location Accuracy in breach of the GDPR between 25 May 2018 and 4 February 2020. The findings cover lawfulness and fairness, accountability, transparency, and keeping location data longer than necessary.

The PIPC found that a 2025 breach at Coupang, carried out by a former employee using authentication signing keys the company had not revoked, stemmed from basic security failures rather than sophisticated hacking, and that Coupang notified it late. Separately, it found that Coupang collected the online behaviour of about 11.17 million users on other websites and apps without consent.

The DPC found that Instagram business accounts publicly exposed children's phone numbers and email addresses by default.

The DPC found that Facebook (€210M) and Instagram (€180M) relied on a terms-of-service contract, rather than valid consent, to justify personalised advertising. The decision forced a change in how Meta seeks a legal basis for ads.

Forty US states settled claims that Google misled users into believing location tracking was off while it kept collecting location data through other settings such as Web & App Activity. It was the largest multistate privacy settlement at the time.

The Irish DPC found that TikTok set children's accounts to public by default and had weak age-assurance safeguards, exposing young users' content.

The CNIL's largest cookie penalty against Google covered advertising inserted directly into Gmail inboxes without consent, alongside continued cookie-consent failures.

The Irish DPC found that LinkedIn, owned by Microsoft, processed members' personal data for behavioural advertising without a valid legal basis and without adequate transparency.

The Dutch data-protection authority fined Uber for transferring EU drivers' personal data, including identity documents and criminal and health data, to the US without adequate safeguards.

The DPC found that design failures allowed the scraping of roughly 533 million users' phone numbers and personal details, which were later leaked online.

The Irish DPC found that a video upload feature, combined with Facebook's "View As" tool, generated access tokens that let attackers log in as other users. Between 14 and 28 September 2018 attackers exploited the flaw against about 29 million accounts worldwide, about 3 million of them in the EU and EEA. The DPC held that Meta had not built data protection into the design of its systems and had not fully notified or documented the breach.

The DPC found that WhatsApp failed to properly explain to users and non-users how their data was processed and shared with other Meta companies.

In one of the first Digital Markets Act fines, the Commission found that Meta's pay-or-consent model forced Facebook and Instagram users to either pay a subscription or accept full data combination for personalised ads, without a genuine less-data alternative. Meta adjusted the model after the decision.

The FTC and the New York Attorney General alleged that YouTube collected personal data from viewers of child-directed channels through cookies, without parental consent, and used it for targeted advertising. It was a record COPPA penalty at the time.

The CNIL found that Google made refusing cookies far harder than accepting them, a dark-pattern design that did not amount to valid consent.

France's competition authority found that Apple's App Tracking Transparency consent design over-burdened third-party apps while Apple's own advertising faced lighter requirements, an abuse of its dominant position.

The FTC and DOJ penalised Twitter, now X, for using phone numbers and email addresses collected for account security, such as two-factor authentication, to target advertising.

Italy's competition authority found that Apple abused its dominant position in app distribution on iOS through its App Tracking Transparency policy, in force since April 2021. Because the ATT prompt does not meet EU privacy-law consent requirements on its own, third-party developers had to ask users for consent twice for the same purpose.

The CNIL fined Google for placing advertising cookies on users' devices without prior consent and without adequate information.

The CNIL fined Microsoft for depositing advertising cookies on bing.com without consent and for making it harder to refuse cookies than to accept them.

France's CNIL issued one of the first major GDPR fines, finding that Google lacked transparency and valid consent for ads personalisation during Android device setup.

South Korea's PIPC found that hackers extracted authentication credentials from KT's femtocells, loaded them into rogue femtocells and used them to reach KT's network, intercepting traffic between subscribers' phones and the network from October 2024 to September 2025. The commission held that KT owned and operated the femtocells and failed to apply baseline access controls to its internal network.

The CNIL fined Amazon for placing advertising cookies on amazon.fr visitors' devices without consent or adequate information.

The CNIL found that Free Mobile's security was inadequate for the volume and sensitivity of its data, with weak authentication on the VPN used for remote work and ineffective detection of abnormal activity, after an attacker reached its systems in October 2024. It also found that the breach notice sent to subscribers lacked required information, and that Free Mobile kept millions of former subscribers' records for an excessive period.

Brazil's data-protection authority fined ByteDance for processing the personal data of children and adolescents without a valid legal basis, across both logged-in accounts and guest browsing, and for failing to stop minors from registering in the first place.

The FTC settled claims that Amazon kept children's Alexa voice recordings indefinitely, against COPPA and parents' deletion requests.

The FTC penalised Google for circumventing Safari's default cookie-blocking to track users for advertising, despite telling those users they were protected. It was a record FTC civil penalty at the time.

The UK Information Commissioner found that Reddit processed the personal data of children under 13 without a lawful basis, because it had no robust age assurance in place, although its own terms barred them. It also found that Reddit had not carried out a data protection impact assessment on the risks its processing posed to children.

The DPC fined Meta over a series of twelve data breaches in 2018, finding it had failed to have appropriate technical and organisational measures in place.

The CNIL found that Free, the broadband operator, did not secure its subscribers' data to a level matching its volume and sensitivity, with weak VPN authentication and ineffective detection of abnormal activity, after an attacker reached the systems of Free and Free Mobile in October 2024. It also found that the breach notice sent to subscribers lacked required information on the consequences and on how to protect themselves.

Italy's Garante alleged that ChatGPT was trained on personal data without an adequate legal basis, failed transparency obligations, did not report a March 2023 breach, and lacked age verification for minors. In March 2026 the Court of Rome annulled the fine on procedural grounds, not because the practices were ruled lawful.

The UK Information Commissioner found that TikTok processed the data of children under 13 without parental consent, did not carry out adequate checks to identify and remove underage users, and did not clearly explain how it collected, used and shared data. The ICO estimated that up to 1.4 million UK children under 13 used the platform in 2020, although its own rules barred them.

South Korea's PIPC fined Meta for collecting sensitive data, including religion, political views, and sexual orientation, on roughly 980,000 users for advertising without consent.

Norway's Datatilsynet found that Xandr, the advertising technology company formerly called AppNexus and now owned by Microsoft, was a joint controller with Grindr when it relayed Norwegian Grindr users' data through real-time bidding between July 2018 and April 2020. The data revealed users' sexual orientation, which required explicit consent, and Xandr did not check that Grindr's consents were valid.

The FTC settled claims that Ring employees and contractors improperly accessed customers' home camera videos, and that lax security allowed outside access.