Platforms and software

This is a state-aid recovery, not a fine. The Commission ordered Apple to repay illegal tax benefits granted by Ireland, which produced effective tax rates as low as 0.005%. After being annulled in 2020, the order was reinstated by the EU's top court in 2024.

Fifty-one state and territory attorneys general settled claims that Meta designed Instagram and Facebook to be addictive for minors, knowingly exposed young users to mental-health harm, and misled the public about how safe its platforms were. Meta will pay a guaranteed $12.1B over ten years, rising to $17.1B if other major social platforms agree to adopt the same safeguards.

The FTC imposed a $5B penalty and sweeping new privacy restrictions after finding that Facebook deceived users about their ability to control personal data, in violation of a 2012 consent order. Third-party apps had harvested data on up to 87 million users in the Cambridge Analytica episode. It was the largest privacy penalty in history at the time.

The Commission ruled that Google required phone makers to pre-install Search and Chrome as a condition of licensing the Play Store, paid manufacturers for exclusivity, and blocked forked versions of Android. It remains the largest antitrust fine the EU has issued.

The Commission found that Google abused its dominance across the advertising-technology stack by favouring its own ad exchange (AdX) in both its publisher ad server and its ad-buying tools, a conflict of interest across the chain.

The European Commission found that Google abused its search dominance by systematically placing its own comparison-shopping service at the top of results while demoting rival services.

The FTC settled claims that Amazon tricked consumers into enrolling in Prime through deceptive sign-up flows and made cancellation deliberately difficult, an internal process nicknamed Iliad. The settlement comprised a $1B civil penalty and $1.5B in refunds to about 35 million customers.

Following a Spotify complaint, the Commission found that Apple banned music apps from telling iPhone users about cheaper subscription options available outside the App Store.

The Commission fined Google for imposing clauses on websites using AdSense for Search that blocked them from displaying rival search ads. In September 2024 the EU General Court annulled the decision.

Texas settled claims that Meta captured facial-recognition data of millions of Texans through photo tag suggestions without consent, in violation of Texas biometric law. It was the largest single-state privacy settlement at the time.

Texas settled claims that Google unlawfully captured biometric data such as face and voice identifiers and made misleading claims about Incognito mode and location tracking. It is one of the largest single-state privacy settlements on record.

The Irish DPC fined Meta for continuing to transfer EU users' personal data to US servers after the Schrems II ruling, exposing that data to potential US surveillance without adequate safeguards. It is the largest GDPR fine ever issued.

Italy's AGCM found that Amazon tied key seller benefits, such as the Prime badge and better visibility, to using its own logistics service (FBA), disadvantaging rival logistics providers.

The Cyberspace Administration of China imposed a sweeping penalty on Didi for extensive data-security and personal-information violations following a year-long investigation.

The European Commission found that Google gave its own shopping, hotel, transport, and sports results preferential ranking over third-party services in Google Search, and separately blocked Android app developers from telling users about cheaper purchase options outside Google Play. The €890M total splits into €460M for the search conduct and €430M for the Play Store conduct.

New Mexico became the first US state to beat a major technology company at trial over harm to young people. A Santa Fe jury found that Meta made false or misleading statements about platform safety and engaged in unconscionable trade practices that exploited the inexperience of children, and the court then added a $567M remedial award on top of the $375M in civil penalties.

The Commission penalised Microsoft for charging unreasonable royalties for the interoperability information required by the 2004 decision. On appeal the penalty was trimmed to €860M.

The European Commission found that Meta tied Facebook Marketplace to its social network and imposed unfair conditions on rival online-classifieds services.

Luxembourg's CNPD fined Amazon for processing personal data for behavioural advertising without valid consent, the largest GDPR fine at the time. In March 2026 the Administrative Court annulled the penalty and remanded it, so no money is currently owed.

All 50 states settled antitrust claims over Play Store billing restrictions and deals that limited rival app stores. Of the total, $630M went to a consumer fund and $70M to the states.

A class-action settlement resolved claims that Facebook's tag-suggestion faceprinting violated Illinois' Biometric Information Privacy Act. Roughly 1.6 million Illinois users received payouts.

The Commission fined Microsoft for breaking a legally binding commitment to show Windows users a browser-choice screen, which silently disappeared for roughly 15 million users. It was the first EU fine for breaching commitments.

The Irish DPC fined TikTok for unlawfully transferring EU users' data to China without ensuring equivalent protection, and for related transparency failures.

France's competition authority fined Google for failing to negotiate in good faith with news publishers over payment for news snippets under the EU's neighbouring-rights rules.

In the first Digital Markets Act fine against Apple, the Commission found that Apple prevented developers from freely informing users about, and directing them to, cheaper purchasing options outside the App Store.

In a landmark case, the Commission found that Microsoft abused its Windows dominance by bundling Media Player and withholding interoperability information from rival server-software makers.

Apple agreed to a US class-action settlement of up to $500M, roughly $25 per affected iPhone, over the same undisclosed performance throttling.

The DPC found that Instagram business accounts publicly exposed children's phone numbers and email addresses by default.

The DPC found that Facebook (€210M) and Instagram (€180M) relied on a terms-of-service contract, rather than valid consent, to justify personalised advertising. The decision forced a change in how Meta seeks a legal basis for ads.

France's competition authority fined Apple over anticompetitive agreements with premium resellers that froze the reseller market and kept prices aligned. On appeal the fine was cut to €372M.

Forty US states settled claims that Google misled users into believing location tracking was off while it kept collecting location data through other settings such as Web & App Activity. It was the largest multistate privacy settlement at the time.

The Irish DPC found that TikTok set children's accounts to public by default and had weak age-assurance safeguards, exposing young users' content.

Russia imposed a turnover-based fine on Google for repeatedly failing to delete content the government deemed banned, following an earlier 2021 penalty. Enforcement and collection were complicated after 2022, and the amounts are largely uncollected in practice.

The CNIL's largest cookie penalty against Google covered advertising inserted directly into Gmail inboxes without consent, alongside continued cookie-consent failures.

The Irish DPC found that LinkedIn, owned by Microsoft, processed members' personal data for behavioural advertising without a valid legal basis and without adequate transparency.

The Dutch data-protection authority fined Uber for transferring EU drivers' personal data, including identity documents and criminal and health data, to the US without adequate safeguards.

The Commission imposed a periodic penalty for Microsoft's failure to comply with the 2004 decision, specifically for not supplying complete interoperability information on reasonable terms.

The DPC found that design failures allowed the scraping of roughly 533 million users' phone numbers and personal details, which were later leaked online.

The Commission ordered Luxembourg to recover tax advantages from Amazon, but EU courts annulled the decision, a ruling made final in 2023. It is included for completeness given its prominence.

The DPC found that WhatsApp failed to properly explain to users and non-users how their data was processed and shared with other Meta companies.

France's competition authority found that Google favoured its own ad server and ad exchange in online display advertising, and accepted binding commitments alongside the fine.

In one of the first Digital Markets Act fines, the Commission found that Meta's pay-or-consent model forced Facebook and Instagram users to either pay a subscription or accept full data combination for personalised ads, without a genuine less-data alternative. Meta adjusted the model after the decision.

South Korea's Fair Trade Commission fined Google for blocking device makers from using customised (forked) versions of Android.

The FTC and the New York Attorney General alleged that YouTube collected personal data from viewers of child-directed channels through cookies, without parental consent, and used it for targeted advertising. It was a record COPPA penalty at the time.

The CNIL found that Google made refusing cookies far harder than accepting them, a dark-pattern design that did not amount to valid consent.

France's competition authority found that Apple's App Tracking Transparency consent design over-burdened third-party apps while Apple's own advertising faced lighter requirements, an abuse of its dominant position.

The Competition Commission of India fined Google for abusing Android's dominance through forced pre-installs and anti-forking restrictions on device makers.

The FTC and DOJ penalised Twitter, now X, for using phone numbers and email addresses collected for account security, such as two-factor authentication, to target advertising.

The European Commission found three transparency breaches at X: the paid blue checkmark deceives users because anyone can buy verified status without being verified, the advertising repository is neither searchable nor complete, and researchers are blocked from the public data the DSA requires platforms to share.

In a companion decision, the CCI fined Google for forcing app developers to use Google Play Billing and its associated commission.

Thirty-four US states settled claims over the hidden iPhone throttling, separate from the consumer class action.

The CNIL fined Google for placing advertising cookies on users' devices without prior consent and without adequate information.

The CNIL fined Microsoft for depositing advertising cookies on bing.com without consent and for making it harder to refuse cookies than to accept them.

France's CNIL issued one of the first major GDPR fines, finding that Google lacked transparency and valid consent for ads personalisation during Android device setup.

The Dutch ACM levied ten consecutive weekly penalties of €5M after Apple repeatedly failed to comply with an order to let dating apps use alternative payment systems.

The CNIL fined Amazon for placing advertising cookies on amazon.fr visitors' devices without consent or adequate information.

Brazil's data-protection authority fined ByteDance for processing the personal data of children and adolescents without a valid legal basis, across both logged-in accounts and guest browsing, and for failing to stop minors from registering in the first place.

France's DGCCRF fined Apple for failing to tell consumers that iOS updates could slow older iPhones to manage aging batteries, part of the wider Batterygate episode.

The FTC settled claims that Amazon kept children's Alexa voice recordings indefinitely, against COPPA and parents' deletion requests.

The FTC penalised Google for circumventing Safari's default cookie-blocking to track users for advertising, despite telling those users they were protected. It was a record FTC civil penalty at the time.

The DPC fined Meta over a series of twelve data breaches in 2018, finding it had failed to have appropriate technical and organisational measures in place.

Italy's Garante alleged that ChatGPT was trained on personal data without an adequate legal basis, failed transparency obligations, did not report a March 2023 breach, and lacked age verification for minors. In March 2026 the Court of Rome annulled the fine on procedural grounds, not because the practices were ruled lawful.

South Korea's PIPC fined Meta for collecting sensitive data, including religion, political views, and sexual orientation, on roughly 980,000 users for advertising without consent.

Italy's AGCM fined Apple for misleading marketing about iPhone water resistance and for refusing warranty service on water-damaged phones.

The FTC settled claims that Ring employees and contractors improperly accessed customers' home camera videos, and that lax security allowed outside access.