Platforms and software

This is a state-aid recovery, not a fine. The Commission ordered Apple to repay illegal tax benefits granted by Ireland, which produced effective tax rates as low as 0.005%. After being annulled in 2020, the order was reinstated by the EU's top court in 2024.

Fifty-one state and territory attorneys general settled claims that Meta designed Instagram and Facebook to be addictive for minors, knowingly exposed young users to mental-health harm, and misled the public about how safe its platforms were. Meta will pay a guaranteed $12.1B over ten years, rising to $17.1B if other major social platforms agree to adopt the same safeguards.

The FTC imposed a $5B penalty and sweeping new privacy restrictions after finding that Facebook deceived users about their ability to control personal data, in violation of a 2012 consent order. Third-party apps had harvested data on up to 87 million users in the Cambridge Analytica episode. It was the largest privacy penalty in history at the time.

The Commission ruled that Google required phone makers to pre-install Search and Chrome as a condition of licensing the Play Store, paid manufacturers for exclusivity, and blocked forked versions of Android. It remains the largest antitrust fine the EU has issued.

The Commission found that Google abused its dominance across the advertising-technology stack by favouring its own ad exchange (AdX) in both its publisher ad server and its ad-buying tools, a conflict of interest across the chain.

The European Commission found that Google abused its search dominance by systematically placing its own comparison-shopping service at the top of results while demoting rival services.

The FTC settled claims that Amazon tricked consumers into enrolling in Prime through deceptive sign-up flows and made cancellation deliberately difficult, an internal process nicknamed Iliad. The settlement comprised a $1B civil penalty and $1.5B in refunds to about 35 million customers.

Following a Spotify complaint, the Commission found that Apple banned music apps from telling iPhone users about cheaper subscription options available outside the App Store.

The Commission fined Google for imposing clauses on websites using AdSense for Search that blocked them from displaying rival search ads. In September 2024 the EU General Court annulled the decision, and the Commission has appealed to the Court of Justice.

Texas settled claims that Meta captured facial-recognition data of millions of Texans through photo tag suggestions without consent, in violation of Texas biometric law. It was the largest single-state privacy settlement at the time.

Texas settled claims that Google unlawfully captured biometric data such as face and voice identifiers and made misleading claims about Incognito mode and location tracking. It is one of the largest single-state privacy settlements on record.

The Irish DPC fined Meta for continuing to transfer EU users' personal data to US servers after the Schrems II ruling, exposing that data to potential US surveillance without adequate safeguards. It is the largest GDPR fine ever issued.

The Cyberspace Administration of China imposed a sweeping penalty on Didi for extensive data-security and personal-information violations following a year-long investigation.

The European Commission found that Google gave its own shopping, hotel, transport, and sports results preferential ranking over third-party services in Google Search, and separately blocked Android app developers from telling users about cheaper purchase options outside Google Play. The €890M total splits into €460M for the search conduct and €430M for the Play Store conduct.

Texas reached its own settlement with Meta over the safety of children on its platforms, separate from the 51 attorneys general deal announced the same day. The Attorney General's release says Meta will pay over $1 billion to the state and adopt new safeguards for young users.

New Mexico became the first US state to beat a major technology company at trial over harm to young people. A Santa Fe jury found that Meta made false or misleading statements about platform safety and engaged in unconscionable trade practices that exploited the inexperience of children, and the court then added a $567M remedial award on top of the $375M in civil penalties.

The Commission penalised Microsoft for charging unreasonable royalties for the interoperability information required by the 2004 decision. On appeal the penalty was trimmed to €860M.

The European Commission found that Meta tied Facebook Marketplace to its social network and imposed unfair conditions on rival online-classifieds services.

Italy's AGCM found that Amazon tied key seller benefits, such as the Prime badge and better visibility, to using its own logistics service (FBA), disadvantaging rival logistics providers. The administrative court upheld that finding in 2025 but struck the penalty uplift, and the AGCM cut the fine from €1.128B to €752.4M.

Luxembourg's CNPD fined Amazon for processing personal data for behavioural advertising without valid consent, the largest GDPR fine at the time. In March 2026 the Administrative Court annulled the penalty and remanded it, so no money is currently owed.

All 50 states, plus the District of Columbia, Puerto Rico and the US Virgin Islands, settled antitrust claims over Play Store billing restrictions and deals that limited rival app stores. Of the total, $630M is for a consumer fund and $70M for the states. A federal court gave final approval in August 2026.

A class-action settlement resolved claims that Facebook's tag-suggestion faceprinting violated Illinois' Biometric Information Privacy Act. Roughly 1.6 million Illinois users received payouts.

The European Commission found that AliExpress fell short of its duty to diligently assess the risk of illegal, unsafe and counterfeit products spreading on its marketplace, and failed to take effective measures to reduce that risk. It is the largest fine issued under the Digital Services Act so far.

The Commission fined Microsoft for breaking a legally binding commitment to show Windows users a browser-choice screen, which silently disappeared for roughly 15 million users. It was the first EU fine for breaching commitments.

The Irish DPC fined TikTok for unlawfully transferring EU users' data to China without ensuring equivalent protection, and for related transparency failures.

France's competition authority fined Google for failing to negotiate in good faith with news publishers over payment for news snippets under the EU's neighbouring-rights rules.

In the first Digital Markets Act fine against Apple, the Commission found that Apple prevented developers from freely informing users about, and directing them to, cheaper purchasing options outside the App Store.

In a landmark case, the Commission found that Microsoft abused its Windows dominance by bundling Media Player and withholding interoperability information from rival server-software makers.

Apple agreed to a US class-action settlement of up to $500M, roughly $25 per affected iPhone, over the same undisclosed performance throttling.

The Irish DPC found that Google Ireland processed users' location data through Web & App Activity, Location History and Location Accuracy in breach of the GDPR between 25 May 2018 and 4 February 2020. The findings cover lawfulness and fairness, accountability, transparency, and keeping location data longer than necessary.

The PIPC found that a 2025 breach at Coupang, carried out by a former employee using authentication signing keys the company had not revoked, stemmed from basic security failures rather than sophisticated hacking, and that Coupang notified it late. Separately, it found that Coupang collected the online behaviour of about 11.17 million users on other websites and apps without consent.

The DPC found that Instagram business accounts publicly exposed children's phone numbers and email addresses by default.

The DPC found that Facebook (€210M) and Instagram (€180M) relied on a terms-of-service contract, rather than valid consent, to justify personalised advertising. The decision forced a change in how Meta seeks a legal basis for ads.

France's competition authority fined Apple over anticompetitive agreements with premium resellers that froze the reseller market and kept prices aligned. On appeal the fine was cut to €372M.

Forty US states settled claims that Google misled users into believing location tracking was off while it kept collecting location data through other settings such as Web & App Activity. It was the largest multistate privacy settlement at the time.

The Irish DPC found that TikTok set children's accounts to public by default and had weak age-assurance safeguards, exposing young users' content.

Russia imposed a turnover-based fine on Google for repeatedly failing to delete content the government deemed banned, following an earlier 2021 penalty. Enforcement and collection were complicated after 2022, and the amounts are largely uncollected in practice.

The CNIL's largest cookie penalty against Google covered advertising inserted directly into Gmail inboxes without consent, alongside continued cookie-consent failures.

The Irish DPC found that LinkedIn, owned by Microsoft, processed members' personal data for behavioural advertising without a valid legal basis and without adequate transparency.

The Dutch data-protection authority fined Uber for transferring EU drivers' personal data, including identity documents and criminal and health data, to the US without adequate safeguards.

The Commission imposed a periodic penalty for Microsoft's failure to comply with the 2004 decision, specifically for not supplying complete interoperability information on reasonable terms.

The DPC found that design failures allowed the scraping of roughly 533 million users' phone numbers and personal details, which were later leaked online.

The Commission ordered Luxembourg to recover tax advantages from Amazon, but EU courts annulled the decision, a ruling made final in 2023. It is included for completeness given its prominence.

The Irish DPC found that a video upload feature, combined with Facebook's "View As" tool, generated access tokens that let attackers log in as other users. Between 14 and 28 September 2018 attackers exploited the flaw against about 29 million accounts worldwide, about 3 million of them in the EU and EEA. The DPC held that Meta had not built data protection into the design of its systems and had not fully notified or documented the breach.

The DPC found that WhatsApp failed to properly explain to users and non-users how their data was processed and shared with other Meta companies.

France's competition authority found that Google favoured its own ad server and ad exchange in online display advertising, and accepted binding commitments alongside the fine.

The European Commission found that Temu failed to diligently identify, analyse and assess the systemic risk of illegal products being sold to EU consumers on its marketplace. Its 2024 risk assessment relied on general information about e-commerce rather than evidence specific to Temu, understated how often consumers would meet illegal items, and did not assess how recommender systems and influencer programmes could spread them.

In one of the first Digital Markets Act fines, the Commission found that Meta's pay-or-consent model forced Facebook and Instagram users to either pay a subscription or accept full data combination for personalised ads, without a genuine less-data alternative. Meta adjusted the model after the decision.

South Korea's Fair Trade Commission fined Google for blocking device makers from using customised (forked) versions of Android.

The FTC and the New York Attorney General alleged that YouTube collected personal data from viewers of child-directed channels through cookies, without parental consent, and used it for targeted advertising. It was a record COPPA penalty at the time.

The CNIL found that Google made refusing cookies far harder than accepting them, a dark-pattern design that did not amount to valid consent.

France's competition authority found that Apple's App Tracking Transparency consent design over-burdened third-party apps while Apple's own advertising faced lighter requirements, an abuse of its dominant position.

The Competition Commission of India fined Google for abusing Android's dominance through forced pre-installs and anti-forking restrictions on device makers.

The FTC and DOJ penalised Twitter, now X, for using phone numbers and email addresses collected for account security, such as two-factor authentication, to target advertising.

The European Commission found three transparency breaches at X: the paid blue checkmark deceives users because anyone can buy verified status without being verified, the advertising repository is neither searchable nor complete, and researchers are blocked from the public data the DSA requires platforms to share.

Italy's competition authority found that Apple abused its dominant position in app distribution on iOS through its App Tracking Transparency policy, in force since April 2021. Because the ATT prompt does not meet EU privacy-law consent requirements on its own, third-party developers had to ask users for consent twice for the same purpose.

In a companion decision, the CCI fined Google for forcing app developers to use Google Play Billing and its associated commission.

Thirty-four US states settled claims over the hidden iPhone throttling, separate from the consumer class action.

The CNIL fined Google for placing advertising cookies on users' devices without prior consent and without adequate information.

The Irish DPC found that Meta stored some users' social media passwords in plaintext on its internal systems, without encryption, and that it failed to notify and document the breach properly after reporting it in March 2019. The decision found infringements of Articles 5(1)(f), 32(1), 33(1) and 33(5) of the GDPR.

Alabama settled claims that TikTok Inc. built its platform with addictive features, knowingly exposed young users to serious mental harm, and misled the public about its safety. The case was set for trial the following week and would have been the first state case against TikTok to reach trial.

The CNIL fined Microsoft for depositing advertising cookies on bing.com without consent and for making it harder to refuse cookies than to accept them.

France's CNIL issued one of the first major GDPR fines, finding that Google lacked transparency and valid consent for ads personalisation during Android device setup.

The Dutch ACM levied ten consecutive weekly penalties of €5M after Apple repeatedly failed to comply with an order to let dating apps use alternative payment systems.

The CNIL fined Amazon for placing advertising cookies on amazon.fr visitors' devices without consent or adequate information.

Brazil's data-protection authority fined ByteDance for processing the personal data of children and adolescents without a valid legal basis, across both logged-in accounts and guest browsing, and for failing to stop minors from registering in the first place.

France's DGCCRF fined Apple for failing to tell consumers that iOS updates could slow older iPhones to manage aging batteries, part of the wider Batterygate episode.

The FTC settled claims that Amazon kept children's Alexa voice recordings indefinitely, against COPPA and parents' deletion requests.

The FTC penalised Google for circumventing Safari's default cookie-blocking to track users for advertising, despite telling those users they were protected. It was a record FTC civil penalty at the time.

The DPC fined Meta over a series of twelve data breaches in 2018, finding it had failed to have appropriate technical and organisational measures in place.

Italy's Garante alleged that ChatGPT was trained on personal data without an adequate legal basis, failed transparency obligations, did not report a March 2023 breach, and lacked age verification for minors. In March 2026 the Court of Rome annulled the fine on procedural grounds, not because the practices were ruled lawful.

The UK Information Commissioner found that TikTok processed the data of children under 13 without parental consent, did not carry out adequate checks to identify and remove underage users, and did not clearly explain how it collected, used and shared data. The ICO estimated that up to 1.4 million UK children under 13 used the platform in 2020, although its own rules barred them.

South Korea's PIPC fined Meta for collecting sensitive data, including religion, political views, and sexual orientation, on roughly 980,000 users for advertising without consent.

Italy's AGCM fined Apple for misleading marketing about iPhone water resistance and for refusing warranty service on water-damaged phones.

Norway's Datatilsynet found that Xandr, the advertising technology company formerly called AppNexus and now owned by Microsoft, was a joint controller with Grindr when it relayed Norwegian Grindr users' data through real-time bidding between July 2018 and April 2020. The data revealed users' sexual orientation, which required explicit consent, and Xandr did not check that Grindr's consents were valid.

The FTC settled claims that Ring employees and contractors improperly accessed customers' home camera videos, and that lax security allowed outside access.