The morning read on Europe's digital policy Friday 16 October 2026
Search

Biggest GDPR fines ever: the ranked list, updated October 2026

The biggest GDPR fine ever is the €1.2 billion penalty Ireland's Data Protection Commission (DPC) imposed on Meta in May 2023 for transferring Facebook users' data to the United States. As of October 2026, the next largest are TikTok's €530 million (2025), Instagram's €405 million (2022) and Google's €403 million (September 2026). Amazon's €746 million fine from 2021, long listed in second place, was annulled by a Luxembourg court in March 2026 and is no longer in force.

The ranking below counts final decisions by EU data protection authorities under the General Data Protection Regulation, using the amounts each regulator announced. Penalties under national cookie or e-privacy laws are kept separate, because they are not GDPR fines even when the same regulator issues them.

The largest GDPR fines, ranked (as of October 2026)

  1. Meta Platforms Ireland – €1.2 billion (DPC, Ireland, May 2023). Facebook kept sending EU/EEA personal data to the US after the Schrems II judgment, relying on standard contractual clauses that the DPC found did not address the risks identified by the EU Court of Justice. The DPC announced the decision on 22 May 2023, after a binding decision by the European Data Protection Board (EDPB). Meta said it would appeal.
  2. TikTok Technology – €530 million (DPC, May 2025). TikTok could not show that EEA user data accessed remotely by staff in China received protection essentially equivalent to EU standards, and its privacy policy did not name China as a destination. The DPC decision of 2 May 2025 also ordered transfers to China to be suspended if processing was not brought into compliance within six months.
  3. Meta (Instagram) – €405 million (DPC, September 2022). Teenage users' business accounts exposed their phone numbers and email addresses, and child accounts could be public by default. The decision, adopted on 2 September 2022, followed an EDPB binding decision.
  4. Google Ireland – €403 million (DPC, September 2026). The DPC found that location data in Web & App Activity and Location History was not processed lawfully, fairly or transparently, and was kept longer than necessary, between May 2018 and February 2020. Announced on 21 September 2026, it is the newest entry in the top ten.
  5. Meta (Facebook and Instagram) – €390 million (DPC, January 2023). Two decisions, €210 million for Facebook and €180 million for Instagram, found that Meta could not rely on "contract" as the legal basis for behavioural advertising. Announced on 4 January 2023.
  6. TikTok Technology – €345 million (DPC, September 2023). Public-by-default settings for child users, the "Family Pairing" feature and transparency towards children in the second half of 2020. See the DPC release of 15 September 2023.
  7. LinkedIn Ireland – €310 million (DPC, October 2024). Members' data was used for behavioural analysis and targeted advertising without a valid legal basis; the DPC said consent was not freely given. Announced 24 October 2024.
  8. Uber – €290 million (Autoriteit Persoonsgegevens, Netherlands, August 2024). For more than two years Uber moved European drivers' data, including identity documents and in some cases criminal and medical data, to its US headquarters without a valid transfer tool. It is the Dutch authority's largest fine; Uber said it would contest it (summary).
  9. Meta Platforms Ireland – €265 million (DPC, November 2022). The "data scraping" case: Facebook Search and contact-importer tools let third parties collect user data, a breach of data protection by design and default under Article 25. Announced 28 November 2022.
  10. Meta Platforms Ireland – €251 million (DPC, December 2024). Penalties over a 2018 breach that affected about 29 million Facebook accounts, around 3 million of them in the EU/EEA. Announced 17 December 2024.
  11. WhatsApp Ireland – €225 million (DPC, September 2021). Transparency failures under Articles 12–14, including how WhatsApp explained data sharing with other Meta companies. The EDPB required the DPC to raise its proposed fine, and WhatsApp said it would appeal (summary).

Meta also received a €91 million fine in September 2024 for storing some user passwords in plaintext, which sits just outside this list.

What happened to Amazon's €746 million fine

Luxembourg's data protection authority, the CNPD, fined Amazon Europe Core €746 million in July 2021 over targeted advertising. A lower administrative tribunal rejected Amazon's appeal in March 2025, but on 12 March 2026 the higher Administrative Court annulled the decision. The court agreed that Amazon had breached the GDPR, but said the CNPD had not examined whether the breaches were intentional or negligent, and had not weighed lighter measures before choosing a fine. The case went back to the CNPD, which may adopt a new decision and a new penalty.

That is why some older lists still show Amazon in second place, while current ones do not.

Large fines that are not GDPR fines

Some of the biggest privacy penalties in Europe come from cookie and e-privacy rules rather than the GDPR. The clearest example is France's CNIL, which fined Google €325 million in September 2025 over ads shown between Gmail messages without consent and advertising cookies set during account creation. The legal bases were the French electronic communications code and the French Data Protection Act's cookie article, not the GDPR, so this ranking leaves it out. EU competition fines and Digital Markets Act decisions are separate regimes too; see our Digital Markets coverage for those.

Why Ireland dominates the list

Ten of the eleven fines above came from the Irish DPC. Under the GDPR's one-stop-shop rule, a company processing data across several EU countries answers mainly to the authority where it has its main EU establishment. Meta, TikTok, Google, LinkedIn and WhatsApp all have their European headquarters in Dublin, so the DPC leads their cases, while authorities in other countries can object to its draft decisions.

According to DLA Piper's January 2026 survey, fines imposed by the DPC totalled about €4.04 billion between May 2018 and early January 2026, before the €403 million Google decision. The same survey put total GDPR fines across Europe at about €7.1 billion over that period, with roughly €1.2 billion issued in 2025. Trackers count differently: some include only fines published by regulators, so their totals are lower.

How cross-border GDPR cases produce big fines

Most of the fines in the top ten went through the cooperation procedure in Article 60 GDPR. The lead authority circulates a draft decision, and other concerned authorities may raise objections. If they cannot agree, the EDPB settles the dispute with a binding decision under Article 65. In the Meta €1.2 billion, Instagram and WhatsApp cases, that step led to new findings or a higher fine.

The ceiling is set by Article 83 GDPR: up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches such as unlawful processing or illegal international transfers.

New procedural rules from April 2027

Complaints that these cases took years led to Regulation (EU) 2025/2518 on GDPR enforcement procedures. It was published in the Official Journal in December 2025, entered into force on 1 January 2026 and applies from April 2027. Its main changes:

  • common rules on whether a cross-border complaint is admissible, wherever it is filed;
  • a 15-month deadline for the lead authority to finish its investigation and submit a draft decision, extendable by up to 12 months in complex cases;
  • a simplified cooperation procedure with a 12-month deadline for straightforward cases;
  • a right to be heard and to see preliminary findings, for both complainants and the companies under investigation.

The regulation changes procedure only; the GDPR's substantive rules and fine ceilings stay the same. More EU data rules are tracked in our Cloud & Data and Policy sections.

Are these fines final?

Not always. A GDPR decision can be challenged in national courts, and the EDPB's binding decisions can be contested before EU courts. Several companies on this list said publicly that they would appeal, and the Amazon case shows that a fine can be annulled years later on procedural grounds even when the breach itself is confirmed. When citing a figure, check the regulator's own release and any later court ruling.

Frequently asked questions

What is the highest GDPR fine ever?

The €1.2 billion fine imposed by Ireland's Data Protection Commission on Meta in May 2023 for unlawful EU-US transfers of Facebook users' data. As of October 2026, no GDPR fine has been larger.

Why was Meta fined €1.2 billion?

Meta kept transferring EU/EEA users' personal data to the US after the Schrems II judgment of 2020, using standard contractual clauses that the DPC found did not protect users against the risks identified by the EU Court of Justice. Meta was also ordered to suspend those transfers and stop unlawful storage of EU data in the US.

Is Amazon's €746 million GDPR fine still valid?

No. Luxembourg's Administrative Court annulled the CNPD decision on 12 March 2026 on procedural grounds while confirming the underlying breaches, and sent the case back to the CNPD, which may issue a new penalty.

What was the biggest GDPR fine of 2026?

Among the decisions published by EU regulators as of mid-October 2026, the largest is the €403 million fine the Irish DPC imposed on Google on 21 September 2026 over the processing of location data.

What is the maximum GDPR fine?

Under Article 83 GDPR, the most serious infringements can be fined up to €20 million or 4% of a company's total worldwide annual turnover for the preceding financial year, whichever is higher.