Big tech fines in 2023

The Irish DPC fined Meta for continuing to transfer EU users' personal data to US servers after the Schrems II ruling, exposing that data to potential US surveillance without adequate safeguards. It is the largest GDPR fine ever issued.

All 50 states, plus the District of Columbia, Puerto Rico and the US Virgin Islands, settled antitrust claims over Play Store billing restrictions and deals that limited rival app stores. Of the total, $630M is for a consumer fund and $70M for the states. A federal court gave final approval in August 2026.

The DPC found that Facebook (€210M) and Instagram (€180M) relied on a terms-of-service contract, rather than valid consent, to justify personalised advertising. The decision forced a change in how Meta seeks a legal basis for ads.

The Irish DPC found that TikTok set children's accounts to public by default and had weak age-assurance safeguards, exposing young users' content.

The FTC settled claims that Amazon kept children's Alexa voice recordings indefinitely, against COPPA and parents' deletion requests.

The UK Information Commissioner found that TikTok processed the data of children under 13 without parental consent, did not carry out adequate checks to identify and remove underage users, and did not clearly explain how it collected, used and shared data. The ICO estimated that up to 1.4 million UK children under 13 used the platform in 2020, although its own rules barred them.

The FTC settled claims that Ring employees and contractors improperly accessed customers' home camera videos, and that lax security allowed outside access.