Big tech fines in 2024

Following a Spotify complaint, the Commission found that Apple banned music apps from telling iPhone users about cheaper subscription options available outside the App Store.

Texas settled claims that Meta captured facial-recognition data of millions of Texans through photo tag suggestions without consent, in violation of Texas biometric law. It was the largest single-state privacy settlement at the time.

The European Commission found that Meta tied Facebook Marketplace to its social network and imposed unfair conditions on rival online-classifieds services.

The Irish DPC found that LinkedIn, owned by Microsoft, processed members' personal data for behavioural advertising without a valid legal basis and without adequate transparency.

The Dutch data-protection authority fined Uber for transferring EU drivers' personal data, including identity documents and criminal and health data, to the US without adequate safeguards.

The Irish DPC found that a video upload feature, combined with Facebook's "View As" tool, generated access tokens that let attackers log in as other users. Between 14 and 28 September 2018 attackers exploited the flaw against about 29 million accounts worldwide, about 3 million of them in the EU and EEA. The DPC held that Meta had not built data protection into the design of its systems and had not fully notified or documented the breach.

The Irish DPC found that Meta stored some users' social media passwords in plaintext on its internal systems, without encryption, and that it failed to notify and document the breach properly after reporting it in March 2019. The decision found infringements of Articles 5(1)(f), 32(1), 33(1) and 33(5) of the GDPR.

Italy's Garante alleged that ChatGPT was trained on personal data without an adequate legal basis, failed transparency obligations, did not report a March 2023 breach, and lacked age verification for minors. In March 2026 the Court of Rome annulled the fine on procedural grounds, not because the practices were ruled lawful.

South Korea's PIPC fined Meta for collecting sensitive data, including religion, political views, and sexual orientation, on roughly 980,000 users for advertising without consent.