What the data shows
The directory currently tracks 81 penalties totalling roughly $56.6B (every penalty type except tax recovery, which adds $14B and is counted separately) across 17 companies and 25 regulators. Amounts below use the USD approximation at the time of each decision. Annulled penalties are excluded from every total.
Total imposed by company
By violation category
Privacy and antitrust dominate. Nearly every major penalty reduces to one of three failures: collecting or using personal data without a valid legal basis, abusing platform dominance to disadvantage rivals, or deceiving consumers through dark patterns and hidden behaviour.
By year
The billion-euro era begins with the GDPR (2018) and the Digital Markets Act (2023 onward). The largest penalty in the directory is the Meta settlement at roughly $12.1B, 65% of the $18.6B that the European Commission has imposed across every penalty listed here. Tax recovery (Apple) orders repayment of unlawful tax benefits rather than punishing conduct, so it is counted separately; see the methodology.
By jurisdiction
The EU set the pace for a decade, and Ireland’s Data Protection Commission and the European Commission still account for most of the largest European penalties. But 2026 shifted the centre of gravity: the three largest child-safety penalties in the directory all come from US states (a $12.1B multistate settlement, a $1B Texas settlement and a $942M New Mexico court judgment).
By regulator (top 10)
Every penalty type except tax recovery, on the same basis as every chart above. A regulator here is the body that imposed the penalty; courts and state attorneys general appear under their own names.
The pattern beneath the numbers
Read as a security and identity practitioner rather than a headline-watcher, the record is remarkably consistent. The recurring root cause is not a single bad actor but a business model: personal data collected by default, a legal basis assembled after the fact, and consent flows engineered to produce a “yes.” The biometric settlements in Texas and Illinois, the GDPR transfer fines, and the cookie-consent penalties are variations on the same theme.
The second pattern is that fines rarely change behaviour on their own. Independent analyses estimate that the 2025 penalties across Apple, Alphabet, Meta, and Amazon amount to roughly a month of their combined free cash flow. Structural remedies, such as the DMA's conduct rules or forced unbundling, move the needle more than the euros do.
The 2026 child-safety cases are the clearest test of that reading so far. What Meta agreed to in the multistate settlement is not really the money: it is default two-hour time limits for minors, an overnight block, hidden like counts, age assurance with removal of under-13 accounts, and an independent auditor who reports to the attorneys general. New Mexico's judgment goes further and orders an under-13 prediction model and deletion of data already collected from children. Those are product mandates enforced by a court, which is a different instrument from a fine, and they arrive alongside an age assurance problem that every consumer platform now has to solve.
If you build or buy customer-identity and privacy systems, these cases are a checklist of what regulators now treat as unlawful by design. That is the throughline in the CIAM Compass and the cybersecurity research on guptadeepak.com.
Every figure here comes from the full directory, filterable by company, category, jurisdiction, and status.