Fines
Companies fined for using your data.
Real fines, settlements and bans, each with its authority, its date and the link to the decision or the news. Next to it, a copy saved on archive.org, so it can always be checked.
49 cases
Meta
7 cases€251MDPC (Ireland)2024 · Meta
The 2018 session keys: 29 million accounts exposed
A fine for the breach Meta reported in September 2018: a flaw exposed the session keys of about 29 million accounts worldwide, along with name, email, phone, sex, workplace and each account's posts and groups. The Irish authority closed two inquiries with 251 million in total.
DPC (IRELAND) · 17 DEC 2024
$1.4bnTexas Attorney General (USA)2024 · Meta PlatformsSettlement
Facial recognition on photos without consent
Texas sued Meta in 2022 for applying facial recognition to photos uploaded to Facebook (the 'Tag Suggestions' feature, on by default) without Texans' consent, in violation of the state's 2009 biometric law. Meta will pay $500 million in the first year and $225 million a year from 2025 to 2028. Meta denies any wrongdoing.
Texas Attorney General (USA) · 30 JUL 2024
€1.2bnDPC (Ireland)2023 · Meta
The largest fine imposed under the GDPR
One point two billion euros against Meta, the owner of Facebook, Instagram and WhatsApp, for continuing to send European users' data to the United States without protection equivalent to Europe's. It is the largest penalty in the history of the European data protection regulation.
DPC (IRELAND) · 22 MAY 2023
€390MDPC (Ireland)2023 · Meta Platforms Ireland (Facebook 210 M€ + Instagram 180 M€)Appealed
Personalised ads without a valid legal basis
The DPC and the EDPB concluded that Meta could not rely on 'contract' as the legal basis for behavioural advertising on Facebook and Instagram. It also breached transparency rules by not clearly explaining which legal basis it was using. It was given three months to bring its processing into compliance.
DPC (Ireland) · 4 JAN 2023
€405MDPC (Ireland)2022 · Meta Platforms Ireland (Instagram)
Children's data processed without required safeguards
The DPC found that Instagram breached the GDPR in processing children's data, with failures in transparency, data minimisation, privacy by design and by default, and impact assessment (Arts. 5, 6, 12, 24, 25 and 35). In addition to the fine, it issued a reprimand and ordered the processing to be brought into compliance.
DPC (Ireland) · 15 SEP 2022
€265MDPC (Ireland)2022 · Meta Platforms Ireland (Facebook)
Design failures that let user data be scraped
In its inquiry into Facebook 'data scraping', the DPC found breaches of GDPR Articles 25(1) and 25(2) (data protection by design and by default). It imposed fines totalling €265 million, a reprimand and an order to bring processing into compliance.
DPC (Ireland) · 28 NOV 2022
$5bnFTC (USA)2019 · Facebook (Meta)Settlement
Friends' data shared with apps despite privacy settings
According to the FTC, Facebook violated its 2012 order by deceiving users about their control over their privacy: it shared friends' data with app developers despite their settings and used phone numbers provided for two-factor verification for advertising. It is the largest privacy penalty in FTC history. It also imposed new governance restrictions.
FTC (USA) · 24 JUL 2019
€403MDPC (Ireland)2026 · Google Ireland
Location data kept too long and used for ads
The DPC found that between May 2018 and February 2020 Google kept location data longer than necessary and used it to target ads: processing was unlawful in 'Location Accuracy' and retention was improper in 'Web & App Activity' and 'Location History'. It also found a lack of transparency in all three features. The own-initiative inquiry was opened on 4 February 2020.
DPC (Ireland) · 21 SEP 2026
€325MCNIL (France)2025 · Google
Cookies when you create the account, and ads between your emails
Two things in one penalty. When creating a Google account it was harder to refuse advertising cookies than to accept them, and it was not made clear that accepting was a condition of using the service: 74 million accounts. And anyone with Gmail's “smart features” turned on had advertising messages shaped like emails slipped in between their private ones, without being asked: 53 million people.
CNIL (FRANCE) · 1 SEP 2025
$1.375bnTexas Attorney General (USA)2025 · GoogleSettlement
Location tracked even when you turned it off
Texas accused Google of secretly tracking location (even with the feature turned off), private searches, voice and facial geometry, and of misleading users about Incognito mode, in two lawsuits covering three products. Google admitted no wrongdoing and said the policies involved had already been changed.
Texas Attorney General (USA) · 9 MAY 2025
$425.7MFederal jury2025 · Google (Rodriguez et al. v. Google LLC)Appealed
App activity kept after users turned tracking off
The jury found that Google invaded users' privacy by storing and using data on their activity in third-party apps after they had turned off tracking ('Web & App Activity'). It rejected Google's consent defence but did not award punitive damages. This is a private class action, not a regulator's fine, and Google has said it will appeal.
Federal jury, California (USA) · 3 SEP 2025
$391.5M40 state AGs (USA)2022 · GoogleSettlement
Location collected after you turned off history
The states accused Google of continuing to collect location data after users turned off Location History in their account, and of using it for advertising. In addition to the payment, Google committed to improving its location disclosures starting in 2023.
40 state AGs (USA) · 14 NOV 2022
€150MCNIL (France)2021 · Google LLC y Google Ireland
Rejecting cookies was harder than accepting them
On google.fr and youtube.com, all cookies could be accepted with one click, but rejecting them took several steps, contrary to French law, which requires refusing to be as easy as accepting. The CNIL considered the breach deliberate. It gave three months to fix it, with a penalty of €100,000 for each day of delay.
CNIL (France) · 31 DEC 2021
€50MCNIL (France)2019 · Google LLC
Scattered privacy information and pre-ticked consent boxes
The CNIL found a lack of transparency: essential information (purposes, retention periods, data categories) was scattered across several documents and was too vague. In addition, consent for personalised advertising was neither informed nor specific, and relied on pre-ticked boxes.
CNIL (France) · 21 JAN 2019
$170MFTC & New York AG (USA)2019 · Google y YouTubeSettlement
Children's data used for ads without parental consent
According to the FTC, YouTube collected persistent identifiers (cookies) from viewers of children's channels without notifying parents or obtaining their consent (COPPA), and used them to serve targeted ads. The complaint alleges YouTube knew many channels were aimed at children, yet told an advertiser it had no users under 13.
FTC & New York AG (USA) · 4 SEP 2019
Amazon
3 cases$25MFTC & DOJ (USA)2023 · Amazon (Alexa)Settlement
Children's voice recordings kept for years
According to the FTC, Amazon violated COPPA by keeping children's voice recordings and location data for years, and did not fully delete them when parents asked. It used that data to train its speech recognition.
FTC & DOJ (USA) · 31 MAY 2023
$5.8MFTC (USA)2023 · Ring (Amazon)Settlement
Staff could access customers' private videos
The FTC accused Ring of letting employees and contractors access customers' private videos, and of having security so weak that hackers took control of some accounts and cameras. Many of the violations predate Amazon's purchase of Ring in 2018. The amount goes to customer refunds.
FTC (USA) · 31 MAY 2023
€746MCNPD (Luxembourg)2021 · Amazon Europe CoreAppealed
Interest-based ads without legal basis or transparency
The CNPD found that Amazon processed personal data for interest-based advertising without a valid legal basis and without transparency, breaching GDPR Articles 6, 12-17 and 21. In 2025 the Luxembourg Administrative Court rejected Amazon's appeal, upheld those findings and reinstated the €746,000 daily penalty, which had been suspended during the appeal. Amazon was considering a further appeal.
CNPD (Luxembourg) · JUL 2021
Microsoft
2 cases€310MDPC (Ireland)2024 · Microsoft
LinkedIn · targeted ads without valid consent
Ireland's data protection authority fined LinkedIn, which belongs to Microsoft, for analysing the behaviour of people with a profile and using it for targeted advertising without a valid legal basis. Besides the fine, it ordered LinkedIn to bring the processing into compliance.
DPC (IRELAND) · 24 OCT 2024
$20MFTC & DOJ (USA)2023 · Microsoft (Xbox)Settlement
Children's data collected before parental consent
According to the complaint, Microsoft collected personal data, including phone numbers, from children signing up for Xbox Live before notifying parents and obtaining their consent, and gave them incomplete notices. It also kept data from children who did not finish creating an account for longer than COPPA allows.
FTC & DOJ (USA) · 12 JUN 2023
Apple
3 cases$95MUS District Court N.D. CAL.2025 · Apple
Siri · recordings without “Hey Siri”
Court-approved settlement in Lopez v. Apple: the plaintiffs alleged that Siri recorded conversations without intentional activation and that human contractors reviewed them. Apple paid without admitting wrongdoing.
US DISTRICT COURT N.D. CAL. · 2025
€98.6MAGCM (Italy)2025 · Apple
The same privacy prompt, fined in Italy too
Italy's competition authority fined Apple for abuse of a dominant position over the same prompt: whoever builds an app has to ask for permission twice for the same thing, once in Apple's window and once in their own. Apple, in its own apps, does not go through that. The investigation was run in coordination with the European Commission and the Italian data protection authority.
AGCM (ITALY) · DEC 2025
€150MAutorité DE LA Concurrence (France)2025 · Apple
Fined over how it applied its own privacy prompt
This one has to be read carefully, because it is the opposite of what it looks like: Apple was not fined for tracking, but for how it imposed its “Ask App Not to Track” window on everyone else. The French competition authority said the goal is not the problem; the problem is that refusing takes one click and accepting takes two, that the rule was not applied evenly, and that Apple did not apply it to itself. A fine for abuse of a dominant position between April 2021 and July 2023.
AUTORITÉ DE LA CONCURRENCE (FRANCE) · 31 MAR 2025
TikTok
3 casesR$153.7MANPD (Brazil)2026 · TikTok
ByteDance · children's and teenagers' data with no legal basis
Brazil's data protection authority fined ByteDance for processing children's and teenagers' personal data without an adequate legal basis, in both ways of entering TikTok: with an account and without one. The decision also orders the deletion of what was collected improperly and the most restrictive privacy settings by default for under-16s.
ANPD (BRAZIL) · 25 AUG 2026
€530MDPC (Ireland)2025 · TikTok Technology LimitedAppealed
European user data accessible from China without equivalent protection
The DPC found that TikTok allowed remote access from China to European users' data without ensuring equivalent protection, and that its 2021 privacy policy did not mention China or that access. It also noted that TikTok gave inaccurate information during the inquiry about where the data was stored. It ordered TikTok to suspend transfers to China if it did not comply within six months.
DPC (Ireland) · 2 MAY 2025
€345MDPC (Ireland)2023 · TikTok Technology Limited
Teen accounts set to public by default
Between July and December 2020, accounts of users aged 13 to 17 were public by default, the 'Family Pairing' feature did not verify that the linked adult was a parent or guardian, and privacy information was vague. The DPC also found dark patterns that nudged minors towards more invasive settings.
DPC (Ireland) · SEP 2023
AI and facial recognition
6 cases€15MGarante (Italy)2026 · OpenAIAnnulled
ChatGPT · the Italian fine, annulled by a court
Italy's Garante fined OpenAI in December 2024 for processing data without a clear legal basis, not reporting the March 2023 leak and not checking the age of whoever signs in. On 18 March 2026 the Court of Rome annulled it. It is worth reading why: the court did not say ChatGPT was fine, it said the case belonged to the Irish authority and not the Italian one, because OpenAI had placed its European seat there. It fell on who was judging, not on what was being judged.
GARANTE (ITALY), ANNULLED BY THE COURT OF ROME · 18 MAR 2026
€158,000Garante (Italy)2026 · Character.AI
Virtual characters, minors among the users and no age check
Italy's Garante fined Character Technologies, the company behind Character.AI, a service where anyone — a child included — creates virtual characters and chats with them. It found insufficient information for users, an impact assessment done late and an EU representative appointed late, on top of failings in protecting minors and in age verification. The fine is small; the orders are not: it has to make age verification work, stop a blocked minor from signing up again, and set minors' profiles to private by default.
GARANTE (ITALY) · 9 JUL 2026
€5MGarante (Italy)2025 · Replika
A companion AI, with no legal basis and no age check
Replika is a chatbot that plays the friend or the partner. Italy's Garante fined its company, Luka Inc., for processing data without a valid legal basis, not explaining what it did with it, and having no way to check age: a name, an email and a gender were enough to get in. The authority pointed to the risk to minors.
GARANTE (ITALY) · 19 MAY 2025
€30.5MDutch DPA2024 · Clearview AI
Thirty billion faces collected from the internet
The Dutch authority fined Clearview AI for building a database of more than 30 billion photos of faces scraped from the internet and turned into one biometric code per person, without anyone's permission and without telling anyone. On top of the fine, up to five million more in penalty payments. And an unusual warning: the authority said using Clearview is illegal and that companies doing so can expect fines of their own.
DUTCH DPA · SEP 2024
€20MCNIL (France)2022 · Clearview AI
Faces collected and used without a legal basis
The CNIL found that Clearview collected and used biometric data (faces) of people in France without a legal basis, without honouring access and erasure rights, and without responding to its November 2021 formal notice. It imposed the maximum fine, plus €100,000 per day of delay, and ordered it to stop collecting that data and delete existing data within two months.
CNIL (France) · 17 OCT 2022
€20MGarante (Italy)2022 · Clearview AI
Biometric data processed without legal basis or notice
The Garante found that Clearview processed biometric and geolocation data of people in Italy without an adequate legal basis, without informing them, without a retention limit and for purposes other than those for which the data had been published. It ordered Clearview to delete that data, banned further collection and required it to appoint an EU representative.
Garante (Italy) · 9 MAR 2022
Antivirus
3 cases$16.5MFTC2024 · Antivirus
Avast · sold its users’ browsing history
The FTC found that Avast, while promising to block tracking, sold detailed, re-identifiable browsing data to more than 100 third parties through its subsidiary Jumpshot between 2014 and 2020. It is banned from selling browsing data for advertising. Avast disagrees with the characterisation of the facts.
FTC · 22 FEB 2024
CZK 351MÚOOÚ (Czechia)2024 · Avast Software s.r.o.Annulled
Antivirus users' browsing history passed to a subsidiary
The ÚOOÚ found that in 2019 Avast passed the pseudonymised browsing history of about 100 million users of its antivirus and extensions to its subsidiary Jumpshot without a legal basis, while telling them it only shared anonymous data for trend analysis. On 30-09-2025 the Prague Municipal Court upheld the violations but annulled the fine amount and the figure of about 100 million affected users. It sent the case back to the ÚOOÚ to recalculate the fine.
ÚOOÚ (Czechia) · 16 APR 2024
BanCommerce Dept. – BIS (USA)2024 · Kaspersky Lab, Inc.Ban
Banned in the US over national security risk
This is not a privacy fine but a national-security ban: the BIS barred Kaspersky from selling and updating antivirus and cybersecurity software in the US (updates were allowed until 29-09-2024). According to the BIS, the company is subject to Russian jurisdiction, its administrative access to customer data could allow that data to reach Russia, and it could install malicious software or withhold updates. In addition, three Kaspersky entities were added to the Entity List for cooperating with Russian military intelligence.
Commerce Dept. – BIS (USA) · 20 JUN 2024
Data for sale
6 casesBanFTC (USA)2026 · Data for saleBan
Kochava · sold the precise location of hundreds of millions of phones
The FTC bans Kochava and its subsidiary Collective Data Solutions from selling, licensing or sharing sensitive location data without affirmative express consent. According to the complaint, the precise location they sold could be used to trace a person's movements, including visits to health facilities and places of worship. No fine: a ban, plus the duty to tell anyone who asks which businesses their location was sold to.
FTC (USA) · 4 MAY 2026
BanFTC (USA)2024 · X-Mode Social / OutlogicBan
Sold location data exposed clinic and worship visits
The FTC accused X-Mode of selling, without informed consent, precise location data linked to advertising IDs that made it possible to track visits to clinics, reproductive health centres, places of worship and shelters for victims of violence. It is the first FTC order banning a data broker from selling sensitive location data and requiring it to delete data already collected.
FTC (USA) · 9 JAN 2024
BanFTC (USA)2024 · InMarket MediaBan
App location data used for ads without consent
According to the FTC, InMarket used location data from its own apps (CheckPoints, ListEase) and from third-party apps with its SDK for advertising, without informing users or obtaining consent, and created nearly 2,000 audience segments. It kept geolocation data for five years. The order bans it from selling or licensing precise location data.
FTC (USA) · 18 JAN 2024
BanFTC (USA)2024 · Gravy Analytics y VenntelBan
Location data bought without confirming user consent
The FTC alleged that Gravy bought location data from suppliers that did not confirm users' consent, and that Venntel relied entirely on Gravy for that verification. They used the data to categorise people by sensitive traits such as political affiliation, religion or medical conditions.
FTC (USA) · 3 DEC 2024
BanFTC (USA)2024 · MobilewallaBan
Ad auction data kept and location data sold
According to the FTC, Mobilewalla kept data from real-time bidding (RTB) ad auctions it did not win, which ad exchanges prohibit, and sold non-anonymised location data that made it possible to follow people to medical centres or shelters. It also created geofences to track union members and people attending political rallies.
FTC (USA) · 3 DEC 2024
$575–700MFTC2019 · EquifaxSettlement
Unpatched flaw exposed data of 147 million people
Equifax did not patch a critical vulnerability it was warned about in March 2017, and attackers found administrator credentials stored in plain text, exposing data of about 147 million people. The settlement includes a $300 million fund for consumers (expandable by $125M), $175 million for the states and a $100 million CFPB penalty.
FTC, CFPB & states (USA) · 22 JUL 2019
Phone companies
2 cases€42MCNIL (France)2026 · Free
Free and Free Mobile · 24 million contracts exposed, IBANs included
27 million against Free Mobile and 15 against Free. An attacker got in during October 2024 and reached data from 24 million subscriber contracts; for people who were customers of both companies, the IBAN as well. The CNIL pointed to weak authentication on remote access, insufficient detection, data kept from contracts long since terminated, and a notice to those affected that did not explain the consequences. More than 2,500 complaints.
CNIL (FRANCE) · 13 JAN 2026
~$200MFCC (USA)2024 · AT&T, Verizon, T-Mobile y Sprint
Customer location data sold to resellers
The four carriers sold access to their customers' location to aggregators that resold it, shifting to third parties the duty to obtain consent, which often was not obtained. They kept selling it after learning their safeguards were failing; the data reached, for example, a Missouri sheriff through Securus. The total is split between AT&T (over $57M), Verizon (about $47M), T-Mobile (over $80M) and Sprint (over $12M).
FCC (USA) · 29 APR 2024
Shops
1 case€150MCNIL (France)2025 · SHEIN
Trackers before any choice, and a “refuse” button that did not work
The CNIL fined SHEIN's Irish subsidiary because the site dropped trackers, several of them for advertising, the moment someone arrived: before they had touched the cookie banner at all. And when they pressed “Refuse all” or withdrew consent, new trackers were dropped anyway and the ones already there kept on being read. Around 12 million visits a month from France.
CNIL (FRANCE) · 1 SEP 2025
Other companies
5 cases€825MAP (Netherlands)2026 · UberAppealed
Driver accounts deactivated with no human involvement
According to the AP, between 2018 and 2022 Uber's software automatically deactivated drivers' accounts, temporarily on suspicion of fraud or permanently for poor ratings, with no human involvement. This breaches the GDPR ban on fully automated decisions, and Uber also did not inform drivers sufficiently; it is the second-highest GDPR fine ever. Uber has said it will appeal.
AP (Netherlands) · 21 AUG 2026
€290MAP (Netherlands)2024 · Uber Technologies / Uber B.V.Appealed
Driver data sent to the US without safeguards
The AP found that Uber sent sensitive data of European drivers to the US between August 2021 and November 2023 without adequate safeguards, in breach of GDPR Article 44. Uber treated its US and Dutch entities as joint controllers, but the AP rejected that argument. Uber is still contesting the fine.
AP (Netherlands) · 22 JUL 2024
$150MFTC & DOJ (USA)2022 · Twitter (hoy X)Settlement
Security phone numbers and emails used for ads
Between 2013 and 2019 Twitter used for targeted advertising the emails and phone numbers that more than 140 million users had provided for two-factor verification and account recovery. The FTC found that this violated its 2011 order and the Privacy Shield frameworks with the EU and Switzerland.
FTC & DOJ (USA) · MAY 2022
£18.4MICO (UK)2020 · Marriott InternationalFinal
Guest data exposed in an undetected cyberattack
The ICO fined Marriott for failing to protect the data of millions of customers in a cyberattack on Starwood that began in 2014 and went undetected until September 2018. About 339 million guest records were exposed, 7 million of them belonging to people in the UK. Marriott did not appeal, without admitting liability.
ICO (UK) · 30 OCT 2020
£20MICO (UK)2020 · British Airways
Data breach affecting over 400,000 customers
The ICO fined British Airways over a June 2018 data breach that affected more than 400,000 customers. The fine initially proposed was £183.39 million (around 1.5% of its global turnover).
ICO (UK) · 16 OCT 2020
The amounts are not added up: they come from different countries, currencies and times.
Amounts in the currency of the original ruling. A settlement does not imply admission of guilt: Apple and Avast denied the allegations. We include them because the pattern — privacy promised, something else delivered — is exactly what GUARDIANA wants to avoid: each service explains which data it sees and which it does not. Case files are summarised in English; every link goes to the original document.
Sources
Every figure on this site that is not a reading from your own browser or a labelled mock-up comes from one of these sources. Consulted in September 2026.
- The Verge — National Public Data confirms the 2.9 billion-record breach (16 Aug 2024)
- Citizen Lab — CatalanGate: Pegasus and Candiru against 65 people in Spain (18 Apr 2022)
- FBI + CISA — Joint statement on the Chinese intrusion into US carriers (13 Nov 2024)
- Reuters — Google to destroy Incognito browsing data to settle the lawsuit (1 Apr 2024)
- GeekWire — T-Mobile: $350m settlement over the breach of 76m people (22 Jul 2022)
- Journal of IT Teaching Cases — The Vastaamo case (2024)
- OAIC — Enforcement action against Medibank over 9.7m Australians (5 Jun 2024)
- elDiario.es — Spain's AEPD fines LaLiga €250,000 over its app's microphone (11 Jun 2019)
- INCIBE — The AEPD fines Vodafone €8.15m (Mar 2021)
- The New York Times — ToTok, the messaging app used as a spying tool (22 Dec 2019)
- Google Security Blog — Unauthorised CNNIC/MCS Holdings certificates (23 Mar 2015)
- Apple Newsroom — Apple sues NSO Group (23 Nov 2021)
- FTC — Google and YouTube to pay $170m over children's privacy (4 Sep 2019)
- DPC Ireland — WhatsApp decision: €225m (2 Sep 2021)
- Autoriteit Persoonsgegevens — €290m to Uber over driver data transfers (26 Aug 2024)
- OCC — $80m to Capital One over the 2019 breach (6 Aug 2020)
- FTC — Avast: ban on selling browsing data and $16.5m (22 Feb 2024)
- TechRadar — 8 PB of data amassed by Jumpshot (2024)
- US Dept. of Commerce — Final determination against Kaspersky (20 Jun 2024), via National Law Review
- Microsoft — CrowdStrike incident: 8.5m devices (20 Jul 2024)
- US Dept. of Commerce — NSO Group added to the Entity List (3 Nov 2021)
- The Guardian — PRISM (6 Jun 2013)
- DPC Ireland — €1.2bn to Meta (22 May 2023), via Hunton
- DPC Ireland — €390m to Meta over personalised advertising (4 Jan 2023)
- FTC — $5bn to Facebook (24 Jul 2019)
- New Jersey Attorney General — $391.5m from Google over location tracking (14 Nov 2022)
- CNIL — €50m to Google (21 Jan 2019)
- European Commission — €4.34bn to Google over Android (18 Jul 2018)
- Courthouse News — Approval of the $95m settlement in Lopez v. Apple (2025)
- European Commission — €1.8bn to Apple over music streaming (4 Mar 2024)
- FTC — Ring $5.8m and Alexa $25m (31 May 2023)
- BDO — Context: €746m to Amazon (2021)
- DPC Ireland — €310m to LinkedIn (24 Oct 2024)
- DPC Ireland — €345m to TikTok (15 Sep 2023)
- FTC — $150m to X, then Twitter (25 May 2022)
- FTC — $520m to Epic Games (19 Dec 2022)
- Autoriteit Persoonsgegevens — €30.5m to Clearview AI (3 Sep 2024)
- FTC — Equifax settlement (22 Jul 2019)
- FTC — Expanded settlement with Uber (12 Apr 2018)
- SEC — $35m to Altaba/Yahoo (24 Apr 2018)
- Hunton — ICO fines Marriott International £18.4m (30 Oct 2020)
- CNBC — ICO fines British Airways £20m (16 Oct 2020)
- IBM — Cost of a Data Breach Report 2025
- Help Net Security — Summary of the IBM 2025 report