Top 10 Largest Data Protection Fines (2018–2025)

Compliance Hub

Compliance Hub

— 5 min read
Top 10 Largest Data Protection Fines (2018–2025)
Photo by Jason Leung / Unsplash
Global Data Protection Enforcement Beyond GDPR: Key Frameworks and Trends
The European Union’s General Data Protection Regulation (GDPR) has long been the gold standard for data privacy, but a wave of new regulations worldwide is reshaping the global compliance landscape. From California to Vietnam, governments are imposing stricter rules and heavier penalties to protect personal data, reflecting heightened public
Compliance Hub WikiCompliance Hub

1. Meta (Facebook) – €1.2 billion ($1.3 billion)

Year: 2023 | Authority: Irish Data Protection Commission (DPC)
Violation: Transferring EU user data to the U.S. without adequate safeguards, violating GDPR’s international data transfer rules post-Schrems II[1][4][5][8]. Meta was ordered to halt transfers and faces ongoing legal challenges.

2. Amazon – €746 million ($780.9 million)

Year: 2021 | Authority: Luxembourg National Commission for Data Protection
Violation: Tracking users without proper consent and opaque data practices[1][5].

3. LinkedIn – €310 million ($340 million)

Year: 2024 | Authority: Irish DPC
Violation: Unlawful processing of user data for behavioral advertising, relying on invalid legal bases (consent/legitimate interest) and failing transparency obligations[3].

4. Meta (Instagram) – €405 million ($442 million)

Year: 2022 | Authority: Irish DPC
Violation: Publicly exposing children’s contact details (email/phone numbers) and defaulting minor accounts to public[1][5][10].

5. Uber – €290 million ($318 million)

Year: 2024 | Authority: Dutch Data Protection Authority (DPA)
Violation: Transferring EU drivers’ sensitive data (medical/criminal records) to the U.S. without safeguards post-Privacy Shield invalidation[3].

Ten Major GDPR Fines: Lessons in Accountability, Transparency, and Compliance
As the General Data Protection Regulation (GDPR) matures, enforcement actions continue to underscore the regulation’s wide-ranging impact. The five cases below—spanning AI-driven chatbots to streaming services and real estate—demonstrate how regulators are intensifying scrutiny on key requirements such as timely breach reporting, valid legal bases for data
Compliance Hub WikiCompliance Hub

6. TikTok – €345 million ($377 million)

Year: 2023 | Authority: Irish DPC
Violation: Processing children’s data without parental consent and defaulting underage accounts to public[1][3].

7. WhatsApp – €225 million ($247 million)

Year: 2021 | Authority: Irish DPC
Violation: Unclear privacy policies and insufficient transparency about data sharing[1][6].

8. Google (France) – €150 million ($169 million)

Year: 2021 | Authority: French CNIL
Violation: Cookie consent mechanisms that made refusal harder than acceptance[2][6].

9. Meta (Facebook) – €265 million ($289 million)

Year: 2022 | Authority: Irish DPC
Violation: Exposing 533 million users’ data (phone numbers, emails) via scraping tools[6].

10. Clearview AI – €30.5 million ($33 million)

Year: 2024 | Authority: Dutch DPA
Violation: Scraping 30+ billion facial images without consent, violating GDPR transparency and data minimization rules[3].

Top GDPR Fines in December 2024: Key Lessons for Compliance
The General Data Protection Regulation (GDPR) has continued to enforce its strict standards on organizations across the EU, emphasizing the importance of data protection and privacy compliance. December 2024 saw significant fines imposed on companies that failed to meet GDPR requirements. Here’s a breakdown of the top five fines,
Compliance Hub WikiCompliance Hub
  1. Cross-Border Data Transfers: Meta’s $1.3B fine underscores strict GDPR enforcement of EU-U.S. data flows[1][8].
  2. Child Privacy: 40% of top fines relate to minors’ data mishandling (Instagram, TikTok)[1][5].
  3. Transparency Failures: Cookie consent (Google, Facebook) and privacy notices (WhatsApp) drive penalties[2][6].
  4. Sector Agnosticism: Fines span tech (Meta), retail (Amazon), transport (Uber), and cybersecurity (Avast)[3].
LinkedIn’s €310 Million GDPR Fine: What It Means for Data Privacy Compliance
In a landmark decision, Ireland’s Data Protection Commission (DPC) imposed a €310 million fine on LinkedIn Ireland for violating the General Data Protection Regulation (GDPR). The DPC’s investigation, initiated following a 2018 complaint, revealed that LinkedIn improperly processed personal data for behavioral analysis and targeted advertising without valid legal grounds.
Compliance Hub WikiCompliance Hub

Total GDPR Fines (2018–2025)

Over €4 billion in cumulative penalties, with Meta accounting for ~40% due to recurrent violations[4].

Understanding the French Supervisory Authority’s €240,000 Fine Against Kaspr for Data Scraping
On January 10, 2025, the French Supervisory Authority (CNIL) imposed a fine of €240,000 on Kaspr, a data enrichment and lead generation tool, for unlawful data scraping activities. This enforcement action, highlighted by the European Data Protection Board (EDPB), underscores regulators’ increasing attention on how companies harvest and reuse
Compliance Hub WikiCompliance Hub

Emerging Frameworks

While GDPR dominates enforcement, fines under other laws are rising:

  • CCPA: Criteo fined $44 million for ad-tech consent violations[3].
  • Australia’s Privacy Act: Penalties now up to 5% of global revenue for systemic breaches[3].

Regulators increasingly tie fines to revenue (e.g., 4% under GDPR) to deter non-compliance[6][13].

Global Data Protection Enforcement Beyond GDPR: Key Frameworks and Trends
The European Union’s General Data Protection Regulation (GDPR) has long been the gold standard for data privacy, but a wave of new regulations worldwide is reshaping the global compliance landscape. From California to Vietnam, governments are imposing stricter rules and heavier penalties to protect personal data, reflecting heightened public
Compliance Hub WikiCompliance Hub

Citations:
[1] https://termly.io/resources/articles/biggest-gdpr-fines/
[2] https://www.enzuzo.com/blog/biggest-gdpr-fines
[3] https://www.skillcast.com/blog/biggest-gdpr-fines-2024
[4] https://dataprivacymanager.net/5-biggest-gdpr-fines-so-far-2020/
[5] https://www.skillcast.com/blog/20-biggest-gdpr-fines
[6] https://www.cookieyes.com/blog/gdpr-fines/
[7] https://www.csoonline.com/article/567531/the-biggest-data-breach-fines-penalties-and-settlements-so-far.html
[8] https://www.eqs.com/compliance-blog/biggest-gdpr-fines/
[9] https://www.statista.com/statistics/1133337/largest-fines-issued-gdpr/
[10] https://www.iubenda.com/en/help/111204-the-biggest-gdpr-fines-to-date
[11] https://www.enforcementtracker.com
[12] https://www.statista.com
[13] https://gdpr-info.eu/issues/fines-penalties/

Read more