The past few years have seen massive GDPR fines handed out to firms. Here's a breakdown of the top 20 penalties from 2018 to 2025 thus far.
Since its introduction in May 2018, massive General Data Protection Regulation (GDPR) fines have been handed out to firms across the European Union.
In 2023, the EU imposed approximately €2.1 billion in fines for GDPR violations – record-breaking. This alarming figure indicates how critical comprehensive employee GDPR training is, and the importance of understanding the key aspects of GDPR fines. Below is a breakdown of the top 20 penalties from 2018 to 2025.
At the core of the GDPR are seven key principles, laid out in Article 5 of the legislation, and designed to guide how to handle people's data: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability.
Article 6 outlines the lawful basis for processing personal data, where at least one must apply: consent, contract, legal obligation, vital interest, public task, and legitimate interests.
We track the largest GDPR penalties each year. If you're interested in details about the UK specifically, check out the all-time biggest Information Commissioner's Office (ICO) fines below, and our recent fines in 2026 blog post for the United Kingdom and the EU.
GDPR breaches - Art. 46 (1)
Ireland's Data Protection Commission (DPC) found Meta violated GDPR international transfer guidelines. The record-breaking €1.2 billion fine was issued to Facebook's parent company after mishandling personal data when transferring it between Europe and the United States (US).
In addition to the fine, Meta was ordered to bring its data transfers into compliance with the GDPR. They appealed the decision, and the legal battle continues.
GDPR breaches - Non-compliance with general data processing principles
In 2021, Luxembourg's National Commission for Data Protection (CNPD) fined Amazon Europe €746 million for how it used customer data for targeted advertising.
The penalty resulted from a complaint made in 2018 by French privacy rights group La Quadrature du Net (which also targeted Apple, Facebook, Google and LinkedIn). Alongside the fine, the CNPD ruled that Amazon had to commit to changing its business practices.
GDPR breaches - Art. 13 (1) f), Art. 46 (1)
The DPC fined TikTok €530 million ($601 million) for breaching the General Data Protection Regulation. The Irish regulator found the social media platform transferred European users' personal data to servers in China without ensuring protections equivalent to those required under EU law.
GDPR breaches - Art. 4
Meta was hit with a massive €479 million fine after a Madrid court found they unlawfully processed user data. The ruling sided with 87 Spanish media companies, saying Meta’s data practices gave it an unfair competitive advantage in the online ad market.
Meta appealed – it’s ongoing.
GDPR breaches - Art. 5 (1) a), c), Art. 6 (1), Art. 12 (1), Art. 24, Art. 25 (1), (2), Art. 35
The DPC fined Meta Platforms Ireland Ltd. (Instagram) €405 million for processing children's data incorrectly. They violated eight specific articles, including lawfulness of Processing and data minimisation.
GDPR breaches - Art. 5 (1) a), Art. 6 (1), Art. 12, Art. 13 (1) c)
Meta Platforms Ireland Ltd. makes a second appearance with a €390 million fine for unlawfully requesting to use people's data for ads on Facebook and Instagram.
During the investigation, the DPC also found Meta wasn’t clear enough about how and why it would use the data.
GDPR breaches - Art. 5 (1) c), 5 (1) f), Art. 12 (1), Art. 13 (1) e), Art. 24 (1), Art. 25 (1), (2)
The DPC fined TikTok €345 million for breaching numerous GDPR rules, including putting 13-17-year-old users' accounts on public settings by default, failing to supply transparent information to child users, and “not properly taking into account the risks posed to under-13s on the platform who were placed on a public setting”.
GDPR breaches - Art. 5 (1) a), Art. 6 (1) a), e), f), Art. 13 (1) c), Art. 14 (1) c)
The DPC fined LinkedIn Ireland €310 million and issued a reprimand following an investigation into the company's processing of personal data for behavioural analysis and targeted advertising.
The inquiry, initiated after a complaint from the French Data Protection Authority, found LinkedIn’s data practices violated several GDPR provisions.
GDPR breaches - Art. 44
Uber was fined €290 million ($324 million) by the Dutch data protection authority (DPA) for illegally transferring European taxi drivers' personal data to the US, violating EU regulations.
Although Uber has since stopped this practice, it disagreed with the fine, calling it "unjustified" and appealed (still ongoing).
GDPR breaches - Art. 25 (1), (2)
Meta Platforms Ireland Limited, the data controller of the Facebook social media network, was issued a €265 million fine alongside corrective measures.
An inquiry began after reports that a dataset of Facebook personal data was made available online. The main issue involved compliance with the GDPR obligation for ‘Data Protection by Design and Default’.
GDPR breach - Art. 33 (3), (5), Art. 25 (1), (2)
The DPC fined Meta $263.5 million (€251 million) over a 2018 Facebook security breach that exposed the sensitive data of 29 million users globally.
The breach exploited a vulnerability in Facebook's "view as" feature, allowing unauthorised access to personal information such as names, contact details, locations, workplaces, and even data about users' children. Meta appealed – still ongoing.
GDPR breaches - Articles 5, 12, 13, 14
Ireland's data authority fined WhatsApp £193 million in 2021 for violating privacy standards. The investigation began in 2018, revealing WhatsApp wasn’t transparent enough with customers about how it collected, managed and processed their data.
GDPR breaches - Art. 82 loi Informatique et Libertés, Article L. 34-5 CPCE
France’s data watchdog, the National Commission for Information Technology and Civil Liberties (CNIL), fined Google LLC €200 million for breaching privacy rules by inserting advertisements disguised as emails into Gmail users’ inboxes without valid consent.
CNIL ruled this practice violated EU privacy law via unsolicited direct marketing. It also criticised Google’s account-creation process, saying users were unfairly steered toward accepting advertising cookies.
GDPR breaches - Art. 82 loi Informatique et Libertés
Infinite provides marketplace and operational services for the fashion retailer SHEIN in Europe. CNIL fined Infinite €150 million for placing cookies on users’ devices without valid consent on shein.com.
GDPR breaches - Art. 82 loi Informatique et Libertés, Article L. 34-5 CPCE
CNIL fined Google Ireland Limited €125 million for breaching EU privacy laws on cookie consent.
They found users weren’t properly informed about advertising cookies during account creation, and that the consent interface failed to clearly explain third-party data collection or provide a simple way to refuse.
GDPR breaches - Art. 5 (1) f), Art. 32 (1), Art. 33 (1), (5)
The DPC fined Meta Platforms Ireland Limited €91 million for GDPR violations regarding mishandling social media users' passwords. The investigation began in 2019 when Meta disclosed that certain user passwords were stored in plaintext on its internal systems without encryption, exposing them to potential misuse.
The DPC found Meta failed to implement adequate technical and organisational measures to secure these passwords, breaching GDPR principles of integrity and confidentiality. They rectified the issue and cooperated with the investigation.
GDPR breaches - Art. 5 (1) f), Art. 5 (2), Art. 24 (1), Art. 25, Art. 28, Art. 32
Garante, the Italian data protection authority, issued Enel Energia its largest GDPR fine to date – over €79 million – for telemarketing misconduct. This followed the cancellation of a previous €26.5 million fine due to procedural delays.
The Garante criticised ENEL Energia for not implementing adequate measures to prevent telemarketing abuses, but acknowledged efforts to improve security.
GDPR breaches - Articles 4, 5, 6, 13, 14
In one of 2019’s most high-profile cases, the , CNIL fined Google €50 million for a "lack of transparency, inadequate information and lack of valid consent regarding ads personalisation". Additionally, the choice to receive personalised ads was "pre-ticked" when opening a new account, directly defying the GDPR.
GDPR breaches - Art. 28(1)
Vodafone's German subsidiary was fined €45 million for past breaches of EU data protection laws.
Germany's data protection authority (BfDI) issued two penalties: €15 million for poor internal data protection controls and €30 million for security flaws in handling customer data via the "MeinVodafone" portal and hotline.
Vodafone Germany stated it fully cooperated with the investigation, accepted the penalties, and paid the fines. They expressed regret over the incident and noted that under new leadership, data protection was a top priority, with systems and processes comprehensively overhauled.
GDPR breaches - Art. 7 (1), (3), Art. 12, Art. 13, Art. 15 (1), Art. 17 (1), Art. 26
The CNIL fined Criteo, an online advertising specialist, €40 million in response to complaints from non-profit organisations Privacy International and None of Your Business (NOYB) about its behavioural retargeting and tracking practices.
The €40 million penalty amounted to approximately 2% of the company's global revenue, reduced from an initial proposal of €60 million.
Before the UK GDPR, the ICO could issue fines capped at £500,000. This limitation meant large global organisations were unlikely to feel the impact of the penalty. Since the regulation came in, it has the power to fine companies up to 4% of their annual turnover.
Over the years, it’s handed out some of the biggest penalties for breaches where companies failed to protect customer data. From 2020 to 2021, the ICO issued a record £42 million in fines – a 1580% increase from the previous year.
Here are some of the biggest fines the ICO has issued:
Before the GDPR, Yahoo wore the crown for the biggest data breach of the 21st century. In September 2016, the internet giant revealed that its 2014 data breach had compromised the personal information of 500 million users. Later that year, another from 2013 came to light, that had impacted one billion accounts – one for every seven or eight people on the planet!
But the full extent of the breaches wasn’t uncovered until October 2017, when Yahoo's new owner, Verizon, discovered it wasn’t one but three billion – every single account under the company, including Flickr and Tumblr.
In October 2018, Yahoo agreed to pay $50 million in damages.
What would have happened if this breach had taken place post-GDPR?
Of course, the scope was significant. However, what would have been crucial today is that Yahoo didn’t disclose the extent of the breach within 72 hours, as the GDPR requires. And with revenue in excess of $4 billion for 2012/2013, they could have faced as much as a $160 million fine.
In 2018, just a couple of months before the GDPR came into effect, Facebook was slapped with a £500,000 fine for its role in the Cambridge Analytica scandal. The information of 87 million Facebook users was improperly shared with the political consultancy through a quiz that collected data from participants and their friends.
Facebook was found guilty of allowing application developers access to user information without sufficient consent, failing to make suitable checks to secure personal information, and not taking action once the data misuse was discovered.
Equifax was fined £500,000 after failing to protect the personal information of up to 15 million UK customers during a cyber attack in 2017. Hackers stole data including names, dates of birth, addresses, passwords, driving licences and financial details. The company had retained data for longer than necessary, making it vulnerable to unauthorised access.
The compromised systems were based in the US, but because the UK branch failed to ensure its American parent protected UK customers, the ICO was forced to issue the fine.
Organisations found in violation of the GDPR in the UK and the EU may face fines of up to £17.5 million (€20) or 4% of their global annual revenue, whichever is higher.
They’re closely aligned, but separate legal frameworks. The United Kingdom GDPR is for organisations processing personal data in the UK, while the EU GDPR applies across the European Union. Some may need to comply with both. The UK also has the Data Protection Act (DPA) 2018 – domestic legislation to tailor, supplement and enforce the GDPR.
A security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
For focused training, our Data Protection and GDPR Compliance Training Hub offers a complete solution for your compliance programme. Courses include:
Our e-learning courses are designed to engage employees, including our microlearning, which supports knowledge retention.
Our Compliance Portal also features a range of tools to digitise and automate your compliance learning. These include our:
If you’d like to access leading insights and compliance tips, browse our free resources by topic to find guides, modules, compliance bites and more.