The past few years have seen massive GDPR fines handed out to firms. Here's a breakdown of the top 20 penalties from 2018 to 2025 thus far.
Since its introduction in May 2018, massive General Data Protection Regulation (GDPR) fines have been handed out to firms across the European Union.
In 2023, the EU imposed approximately €2.1 billion in fines for GDPR violations – record-breaking. This alarming figure indicates how critical comprehensive employee GDPR training is, and the importance of understanding the key aspects of GDPR fines. Below is a breakdown of the top 20 penalties from 2018 to 2025.
Key takeaways
- To avoid GDPR fines, adhere to the seven principles, such as purpose limitation and data minimisation, and the six lawful bases for processing personal data, including consent and contract.
- GDPR fines range from Meta Platforms Ireland (a whopping €1.2 billion in 2023) for mishandling personal data transfer to Criteo (€40 million in 2023) for its behavioural retargeting and tracking practices.
Simple steps to avoid GDPR fines
At the core of the GDPR are seven key principles, laid out in Article 5 of the legislation, and designed to guide how to handle people's data: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability.
Article 6 outlines the lawful basis for processing personal data, where at least one must apply: consent, contract, legal obligation, vital interest, public task, and legitimate interests.
Top 20 GDPR breach fines
- Meta Platforms Ireland Ltd. - €1.2 billion fine (2023)
- Amazon Europe - €746 million fine (2021)
- TikTok - €530 million fine (2025)
- Meta - €479 million fine (2025)
- Meta Platforms, Inc. - €405 million fine (2022)
- Meta Platforms Ireland Ltd. - €390 million fine (2023)
- TikTok Ltd - €345 million fine (2023)
- LinkedIn - €310 million fine (2024)
- Uber - €290 million fine (2024)
- Meta Platforms Ireland Limited - €265 million fine (2022)
- Meta - €251 million fine (2024)
- WhatsApp Ireland - €225 million fine (2021)
- Google LLC - €200 million fine (2025)
- Infinite Styles Services Co. Limited - €150 million fine (2025)
- Google Ireland Limited - €125 million fine (2025)
- Meta Platforms Ireland Limited - €91 million fine
- Enel Energia SpA - €79.1 million fine (2024)
- Google Inc - €50 million fine (2019)
- Vodafone - €45 million fine (2025)
- Criteo - €40 million fine (2023)
We track the largest GDPR penalties each year. If you're interested in details about the UK specifically, check out the all-time biggest Information Commissioner's Office (ICO) fines below, and our recent fines in 2026 blog post for the United Kingdom and the EU.
The 20 biggest GDPR fines in detail
1. Meta Platforms Ireland Ltd. - €1.2bn fine (2023)
GDPR breaches - Art. 46 (1)
Ireland's Data Protection Commission (DPC) found Meta violated GDPR international transfer guidelines. The record-breaking €1.2 billion fine was issued to Facebook's parent company after mishandling personal data when transferring it between Europe and the United States (US).
In addition to the fine, Meta was ordered to bring its data transfers into compliance with the GDPR. They appealed the decision, and the legal battle continues.
2. Amazon Europe - €746m fine (2021)
GDPR breaches - Non-compliance with general data processing principles
In 2021, Luxembourg's National Commission for Data Protection (CNPD) fined Amazon Europe €746 million for how it used customer data for targeted advertising.
The penalty resulted from a complaint made in 2018 by French privacy rights group La Quadrature du Net (which also targeted Apple, Facebook, Google and LinkedIn). Alongside the fine, the CNPD ruled that Amazon had to commit to changing its business practices.
3. TikTok - €530m fine (2025)
GDPR breaches - Art. 13 (1) f), Art. 46 (1)
The DPC fined TikTok €530 million ($601 million) for breaching the General Data Protection Regulation. The Irish regulator found the social media platform transferred European users' personal data to servers in China without ensuring protections equivalent to those required under EU law.
4. Meta - €479m fine (2025)
GDPR breaches - Art. 4
Meta was hit with a massive €479 million fine after a Madrid court found they unlawfully processed user data. The ruling sided with 87 Spanish media companies, saying Meta’s data practices gave it an unfair competitive advantage in the online ad market.
Meta appealed – it’s ongoing.
5. Meta Platforms, Inc. - €405m fine (2022)
GDPR breaches - Art. 5 (1) a), c), Art. 6 (1), Art. 12 (1), Art. 24, Art. 25 (1), (2), Art. 35
The DPC fined Meta Platforms Ireland Ltd. (Instagram) €405 million for processing children's data incorrectly. They violated eight specific articles, including lawfulness of Processing and data minimisation.
6. Meta Platforms Ireland Ltd. - €390m fine (2023)
GDPR breaches - Art. 5 (1) a), Art. 6 (1), Art. 12, Art. 13 (1) c)
Meta Platforms Ireland Ltd. makes a second appearance with a €390 million fine for unlawfully requesting to use people's data for ads on Facebook and Instagram.
During the investigation, the DPC also found Meta wasn’t clear enough about how and why it would use the data.
7. TikTok Ltd - €345m fine (2023)
GDPR breaches - Art. 5 (1) c), 5 (1) f), Art. 12 (1), Art. 13 (1) e), Art. 24 (1), Art. 25 (1), (2)
The DPC fined TikTok €345 million for breaching numerous GDPR rules, including putting 13-17-year-old users' accounts on public settings by default, failing to supply transparent information to child users, and “not properly taking into account the risks posed to under-13s on the platform who were placed on a public setting”.
8. LinkedIn - €310m fine (2024)
GDPR breaches - Art. 5 (1) a), Art. 6 (1) a), e), f), Art. 13 (1) c), Art. 14 (1) c)
The DPC fined LinkedIn Ireland €310 million and issued a reprimand following an investigation into the company's processing of personal data for behavioural analysis and targeted advertising.
The inquiry, initiated after a complaint from the French Data Protection Authority, found LinkedIn’s data practices violated several GDPR provisions.
9. Uber - €290m fine (2024)
GDPR breaches - Art. 44
Uber was fined €290 million ($324 million) by the Dutch data protection authority (DPA) for illegally transferring European taxi drivers' personal data to the US, violating EU regulations.
Although Uber has since stopped this practice, it disagreed with the fine, calling it "unjustified" and appealed (still ongoing).
10. Meta Platforms Ireland Limited - €265m fine (2022)
GDPR breaches - Art. 25 (1), (2)
Meta Platforms Ireland Limited, the data controller of the Facebook social media network, was issued a €265 million fine alongside corrective measures.
An inquiry began after reports that a dataset of Facebook personal data was made available online. The main issue involved compliance with the GDPR obligation for ‘Data Protection by Design and Default’.
11. Meta - €251m fine (2024)
GDPR breach - Art. 33 (3), (5), Art. 25 (1), (2)
The DPC fined Meta $263.5 million (€251 million) over a 2018 Facebook security breach that exposed the sensitive data of 29 million users globally.
The breach exploited a vulnerability in Facebook's "view as" feature, allowing unauthorised access to personal information such as names, contact details, locations, workplaces, and even data about users' children. Meta appealed – still ongoing.
12. WhatsApp Ireland - €225m fine (2021)
GDPR breaches - Articles 5, 12, 13, 14
Ireland's data authority fined WhatsApp £193 million in 2021 for violating privacy standards. The investigation began in 2018, revealing WhatsApp wasn’t transparent enough with customers about how it collected, managed and processed their data.
13. Google LLC - €200m fine (2025)
GDPR breaches - Art. 82 loi Informatique et Libertés, Article L. 34-5 CPCE
France’s data watchdog, the National Commission for Information Technology and Civil Liberties (CNIL), fined Google LLC €200 million for breaching privacy rules by inserting advertisements disguised as emails into Gmail users’ inboxes without valid consent.
CNIL ruled this practice violated EU privacy law via unsolicited direct marketing. It also criticised Google’s account-creation process, saying users were unfairly steered toward accepting advertising cookies.
14. Infinite Styles Services Co. Limited - €150m fine (2025)
GDPR breaches - Art. 82 loi Informatique et Libertés
Infinite provides marketplace and operational services for the fashion retailer SHEIN in Europe. CNIL fined Infinite €150 million for placing cookies on users’ devices without valid consent on shein.com.
15. Google Ireland Limited - €125m fine (2025)
GDPR breaches - Art. 82 loi Informatique et Libertés, Article L. 34-5 CPCE
CNIL fined Google Ireland Limited €125 million for breaching EU privacy laws on cookie consent.
They found users weren’t properly informed about advertising cookies during account creation, and that the consent interface failed to clearly explain third-party data collection or provide a simple way to refuse.
16. Meta Platforms Ireland Limited - €91m fine
GDPR breaches - Art. 5 (1) f), Art. 32 (1), Art. 33 (1), (5)
The DPC fined Meta Platforms Ireland Limited €91 million for GDPR violations regarding mishandling social media users' passwords. The investigation began in 2019 when Meta disclosed that certain user passwords were stored in plaintext on its internal systems without encryption, exposing them to potential misuse.
The DPC found Meta failed to implement adequate technical and organisational measures to secure these passwords, breaching GDPR principles of integrity and confidentiality. They rectified the issue and cooperated with the investigation.
17. Enel Energia SpA - €79.1m fine (2024)
GDPR breaches - Art. 5 (1) f), Art. 5 (2), Art. 24 (1), Art. 25, Art. 28, Art. 32
Garante, the Italian data protection authority, issued Enel Energia its largest GDPR fine to date – over €79 million – for telemarketing misconduct. This followed the cancellation of a previous €26.5 million fine due to procedural delays.
The Garante criticised ENEL Energia for not implementing adequate measures to prevent telemarketing abuses, but acknowledged efforts to improve security.
18. Google Inc - €50m fine (2019)
GDPR breaches - Articles 4, 5, 6, 13, 14
In one of 2019’s most high-profile cases, the , CNIL fined Google €50 million for a "lack of transparency, inadequate information and lack of valid consent regarding ads personalisation". Additionally, the choice to receive personalised ads was "pre-ticked" when opening a new account, directly defying the GDPR.
19. Vodafone - €45m fine (2025)
GDPR breaches - Art. 28(1)
Vodafone's German subsidiary was fined €45 million for past breaches of EU data protection laws.
Germany's data protection authority (BfDI) issued two penalties: €15 million for poor internal data protection controls and €30 million for security flaws in handling customer data via the "MeinVodafone" portal and hotline.
Vodafone Germany stated it fully cooperated with the investigation, accepted the penalties, and paid the fines. They expressed regret over the incident and noted that under new leadership, data protection was a top priority, with systems and processes comprehensively overhauled.
20. Criteo - €40m fine (2023)
GDPR breaches - Art. 7 (1), (3), Art. 12, Art. 13, Art. 15 (1), Art. 17 (1), Art. 26
The CNIL fined Criteo, an online advertising specialist, €40 million in response to complaints from non-profit organisations Privacy International and None of Your Business (NOYB) about its behavioural retargeting and tracking practices.
The €40 million penalty amounted to approximately 2% of the company's global revenue, reduced from an initial proposal of €60 million.
Top ICO fines issued
Before the UK GDPR, the ICO could issue fines capped at £500,000. This limitation meant large global organisations were unlikely to feel the impact of the penalty. Since the regulation came in, it has the power to fine companies up to 4% of their annual turnover.
Over the years, it’s handed out some of the biggest penalties for breaches where companies failed to protect customer data. From 2020 to 2021, the ICO issued a record £42 million in fines – a 1580% increase from the previous year.
Here are some of the biggest fines the ICO has issued:
- British Airways - £20m fine (2020)
- Marriott Hotels - £18.4m fine (2020)
- TikTok - £12.7m (2023)
- Clearview AI - £7.5m fine (2022)
- Ticketmaster - £1.25m fine (2018)
- Cabinet Office - £500k fine (2021)
- Doorstep Dispensaree Ltd. (Pharmacy) - £275k fine (2019)
Infamous pre-GDPR data breaches
Yahoo
Before the GDPR, Yahoo wore the crown for the biggest data breach of the 21st century. In September 2016, the internet giant revealed that its 2014 data breach had compromised the personal information of 500 million users. Later that year, another from 2013 came to light, that had impacted one billion accounts – one for every seven or eight people on the planet!
But the full extent of the breaches wasn’t uncovered until October 2017, when Yahoo's new owner, Verizon, discovered it wasn’t one but three billion – every single account under the company, including Flickr and Tumblr.
In October 2018, Yahoo agreed to pay $50 million in damages.
What would have happened if this breach had taken place post-GDPR?
Of course, the scope was significant. However, what would have been crucial today is that Yahoo didn’t disclose the extent of the breach within 72 hours, as the GDPR requires. And with revenue in excess of $4 billion for 2012/2013, they could have faced as much as a $160 million fine.
In 2018, just a couple of months before the GDPR came into effect, Facebook was slapped with a £500,000 fine for its role in the Cambridge Analytica scandal. The information of 87 million Facebook users was improperly shared with the political consultancy through a quiz that collected data from participants and their friends.
Facebook was found guilty of allowing application developers access to user information without sufficient consent, failing to make suitable checks to secure personal information, and not taking action once the data misuse was discovered.
Equifax
Equifax was fined £500,000 after failing to protect the personal information of up to 15 million UK customers during a cyber attack in 2017. Hackers stole data including names, dates of birth, addresses, passwords, driving licences and financial details. The company had retained data for longer than necessary, making it vulnerable to unauthorised access.
The compromised systems were based in the US, but because the UK branch failed to ensure its American parent protected UK customers, the ICO was forced to issue the fine.
GDPR fines: FAQs
What’s the maximum fine for a GDPR breach?
Organisations found in violation of the GDPR in the UK and the EU may face fines of up to £17.5 million (€20) or 4% of their global annual revenue, whichever is higher.
What’s the difference between UK and EU GDPRs?
They’re closely aligned, but separate legal frameworks. The United Kingdom GDPR is for organisations processing personal data in the UK, while the EU GDPR applies across the European Union. Some may need to comply with both. The UK also has the Data Protection Act (DPA) 2018 – domestic legislation to tailor, supplement and enforce the GDPR.
What’s a GDPR data breach?
A security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
Want to learn more about GDPR?
For focused training, our Data Protection and GDPR Compliance Training Hub offers a complete solution for your compliance programme. Courses include:
Our e-learning courses are designed to engage employees, including our microlearning, which supports knowledge retention.
Our Compliance Portal also features a range of tools to digitise and automate your compliance learning. These include our:
If you’d like to access leading insights and compliance tips, browse our free resources by topic to find guides, modules, compliance bites and more.
Written by: Emmeline de Chazal
Emmeline is an experienced digital editor and content marketing manager. She has a demonstrated history of working in both the education management and software industries. Emmeline has a degree in business science, and her skillset includes Search Engine Optimisation (SEO), Answer Engine Optimisation (AEO) and digital marketing analytics. She is passionate about education and utilising her skills to encourage greater access to e-learning.
