Big tech fines in 2026

Fifty-one state and territory attorneys general settled claims that Meta designed Instagram and Facebook to be addictive for minors, knowingly exposed young users to mental-health harm, and misled the public about how safe its platforms were. Meta will pay a guaranteed $12.1B over ten years, rising to $17.1B if other major social platforms agree to adopt the same safeguards.

The European Commission found that Google gave its own shopping, hotel, transport, and sports results preferential ranking over third-party services in Google Search, and separately blocked Android app developers from telling users about cheaper purchase options outside Google Play. The €890M total splits into €460M for the search conduct and €430M for the Play Store conduct.

Texas reached its own settlement with Meta over the safety of children on its platforms, separate from the 51 attorneys general deal announced the same day. The Attorney General's release says Meta will pay over $1 billion to the state and adopt new safeguards for young users.

New Mexico became the first US state to beat a major technology company at trial over harm to young people. A Santa Fe jury found that Meta made false or misleading statements about platform safety and engaged in unconscionable trade practices that exploited the inexperience of children, and the court then added a $567M remedial award on top of the $375M in civil penalties.

The European Commission found that AliExpress fell short of its duty to diligently assess the risk of illegal, unsafe and counterfeit products spreading on its marketplace, and failed to take effective measures to reduce that risk. It is the largest fine issued under the Digital Services Act so far.

The Irish DPC found that Google Ireland processed users' location data through Web & App Activity, Location History and Location Accuracy in breach of the GDPR between 25 May 2018 and 4 February 2020. The findings cover lawfulness and fairness, accountability, transparency, and keeping location data longer than necessary.

The PIPC found that a 2025 breach at Coupang, carried out by a former employee using authentication signing keys the company had not revoked, stemmed from basic security failures rather than sophisticated hacking, and that Coupang notified it late. Separately, it found that Coupang collected the online behaviour of about 11.17 million users on other websites and apps without consent.

The European Commission found that Temu failed to diligently identify, analyse and assess the systemic risk of illegal products being sold to EU consumers on its marketplace. Its 2024 risk assessment relied on general information about e-commerce rather than evidence specific to Temu, understated how often consumers would meet illegal items, and did not assess how recommender systems and influencer programmes could spread them.

Alabama settled claims that TikTok Inc. built its platform with addictive features, knowingly exposed young users to serious mental harm, and misled the public about its safety. The case was set for trial the following week and would have been the first state case against TikTok to reach trial.

Brazil's data-protection authority fined ByteDance for processing the personal data of children and adolescents without a valid legal basis, across both logged-in accounts and guest browsing, and for failing to stop minors from registering in the first place.

Norway's Datatilsynet found that Xandr, the advertising technology company formerly called AppNexus and now owned by Microsoft, was a joint controller with Grindr when it relayed Norwegian Grindr users' data through real-time bidding between July 2018 and April 2020. The data revealed users' sexual orientation, which required explicit consent, and Xandr did not check that Grindr's consents were valid.