Last updated: 5 November 2026. We update this page whenever a fine changes the top of the table or a court changes an existing one.
The biggest GDPR fine ever is the €1.2 billion penalty Ireland's Data Protection Commission (DPC) imposed on Meta in May 2023 for transferring Facebook users' data to the United States. In August 2026, a €825 million fine on Uber from the Dutch Data Protection Authority became the second largest. A month later the DPC fined Google €403 million over location data.
Below are the 12 largest GDPR fines, what each company did wrong, and the patterns behind them that apply to much smaller businesses too.
The 12 biggest GDPR fines
| # | Company | Fine | Regulator | Date | What went wrong |
|---|---|---|---|---|---|
| 1 | Meta (Facebook) | €1.2 billion | Ireland (DPC) | May 2023 | EU user data transferred to the US without adequate protection |
| 2 | Uber | €825 million | Netherlands (AP) | Aug 2026 | Driver accounts deactivated by fully automated decisions |
| 3 | TikTok | €530 million | Ireland (DPC) | May 2025 | EEA user data accessed from China without adequate safeguards |
| 4 | €405 million | Ireland (DPC) | Sep 2022 | Children's contact details and accounts exposed publicly | |
| 5 | €403 million | Ireland (DPC) | Sep 2026 | Location data processed without a valid basis or clear information | |
| 6 | Meta (Facebook and Instagram) | €390 million | Ireland (DPC) | Jan 2023 | "Contract" used as the legal basis for personalised ads |
| 7 | TikTok | €345 million | Ireland (DPC) | Sep 2023 | Children's accounts set to public by default |
| 8 | €310 million | Ireland (DPC) | Oct 2024 | Behavioural analysis and targeted ads without a valid legal basis | |
| 9 | Uber | €290 million | Netherlands (AP) | Aug 2024 | Drivers' data transferred to the US without a transfer tool |
| 10 | Meta (Facebook) | €265 million | Ireland (DPC) | Nov 2022 | Data scraped from 533 million users through contact-import tools |
| 11 | Meta (Facebook) | €251 million | Ireland (DPC) | Dec 2024 | 2018 security breach affecting 29 million accounts |
| 12 | €225 million | Ireland (DPC) | Sep 2021 | Not telling users and non-users how their data was used |
Not in the table: Amazon's €746 million fine from Luxembourg's regulator (CNPD), issued in July 2021 and long listed as the second largest. A Luxembourg court annulled it in March 2026 and sent the case back to the CNPD to reassess. France's €325 million fine on Google in September 2025 is also left out, because the CNIL issued it under French cookie and electronic marketing rules rather than the GDPR.
All amounts are the fines as originally imposed. Most were appealed, and in Ireland a fine is not payable until a court confirms it, so very little of this money has actually been collected.
GDPR fines in numbers
- About €7.1 billion in fines had been issued across Europe by January 2026, according to DLA Piper's annual GDPR survey.
- About €1.2 billion of that was issued in 2025, roughly the same as in 2024.
- €4.04 billion, more than half the total at January 2026, came from Ireland's DPC. It is the lead regulator for Meta, TikTok, Google, LinkedIn and most other big tech companies with EU headquarters in Dublin.
- 10 of the 12 largest fines in the table above were issued by the DPC.
- The legal maximum is €20 million or 4% of a company's total worldwide annual turnover, whichever is higher.
The latest big GDPR fines (2025 to 2026)
- Google, €403 million (September 2026). The DPC's first fine on Google, over location data. More below.
- Uber, €825 million (August 2026). The second-largest GDPR fine ever, over automated driver deactivations. More below.
- Yango, €100 million (May 2026). The Dutch regulator fined MLU B.V., the company behind the Yango taxi app in Europe, for sending Finnish and Norwegian users' data to Russia, and ordered the transfers to stop. It was the first time European regulators ruled formally on transfers to Russia.
- Free Mobile and Free, €42 million combined (January 2026). France's CNIL fined the two telecom brands €27 million and €15 million after a 2024 breach exposed data tied to 24 million subscriber contracts, including bank account numbers (IBANs).
- Reddit, £14.47 million (2026). The UK's ICO fined Reddit under the UK GDPR over children's privacy.
- TikTok, €530 million (May 2025). The largest fine of 2025, over data transfers to China. More below, and in our full breakdown of TikTok's €530 million fine.
1. Meta: €1.2 billion for US data transfers (2023)
The DPC fined Meta Platforms Ireland €1.2 billion in May 2023 for continuing to send Facebook users' personal data to the US after the EU's top court struck down the Privacy Shield framework in its 2020 Schrems II ruling. Meta relied on Standard Contractual Clauses (SCCs), but regulators found they did not protect the data from access by US intelligence agencies.
The DPC had not originally proposed a fine. Other European regulators objected, and the European Data Protection Board (EDPB) instructed it to impose one. Meta was also ordered to suspend the transfers. The arrival of the EU-US Data Privacy Framework in July 2023 eased the practical pressure, but Meta is still challenging the fine in the Irish courts.
Lesson: standard contract wording is not enough on its own. If you send personal data outside the EEA, you need a valid transfer mechanism and an assessment of whether the destination country's laws undermine it.
2. Uber: €825 million for automated driver deactivations (2026)
In August 2026, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) fined Uber €825 million (€824.99 million exactly) for using fully automated decisions to temporarily or permanently deactivate drivers' accounts. The deactivations were triggered by suspected fraud or low customer ratings, without meaningful human involvement, and drivers were not properly told how the decisions were made. The fine covers 2020 to 2022.
It is the largest fine yet under Article 22 of the GDPR, which gives people the right not to be subject to decisions with significant effects based solely on automated processing. Uber has said it disagrees and will appeal.
Lesson: if software makes decisions that affect someone's income, access or rights, a person needs to review those decisions in a real way, and the people affected need to be told how they work.
3. TikTok: €530 million for transfers to China (2025)
The DPC fined TikTok €530 million in May 2025: €485 million for transferring European users' data to China, where staff could access it remotely, without showing that it was protected to EU standards, and €45 million for not telling users which countries their data went to. TikTok was also ordered to bring its transfers into line within six months or suspend them.
TikTok challenged the decision in the Irish courts. In June 2026, the High Court upheld the DPC's decision.
Lesson: remote access from another country counts as a transfer. Your privacy policy also has to say where data goes.
4. Instagram: €405 million for exposing children's data (2022)
In September 2022, the DPC fined Instagram €405 million because teenagers who switched to business accounts had their phone numbers and email addresses published, and because accounts for users aged 13 to 17 were public by default.
Lesson: defaults matter. For children, the most private settings should be the starting point, not an option buried in a menu.
5. Google: €403 million for location data (2026)
On 21 September 2026, the DPC fined Google Ireland €403 million after a six-year inquiry into how it processed location data through three settings: Web & App Activity, Location History and Location Accuracy. The inquiry covered May 2018 to February 2020 and followed complaints from several European consumer organisations.
It is the first fine the DPC has imposed on Google. Google was ordered to bring its processing into compliance within six months and has said it will appeal, arguing the decision concerns settings it changed years ago.
Lesson: consent to collect location data has to be specific and informed. Spreading the controls across several settings with vague descriptions does not meet that standard.
6. Meta: €390 million for its legal basis for ads (2023)
In January 2023, the DPC fined Meta €210 million for Facebook and €180 million for Instagram. Meta had moved personalised advertising under "contract" as its legal basis, arguing that ads were part of the service users signed up for. The EDPB rejected that argument, and Meta has since moved its advertising in the EU to a consent-based model.
Lesson: you cannot choose whichever legal basis is most convenient. "Contract" only covers processing that is genuinely necessary to deliver the service the user asked for.
7. TikTok: €345 million for children's privacy (2023)
The DPC fined TikTok €345 million in September 2023. Accounts for users under 16 were public by default, the "Family Pairing" feature let unverified adults link to children's accounts, and the sign-up process nudged young users towards less private options.
Lesson: design choices that steer users towards sharing more data, often called dark patterns, are treated as GDPR violations, especially where children are involved.
8. LinkedIn: €310 million for behavioural advertising (2024)
In October 2024, the DPC fined LinkedIn €310 million for analysing members' behaviour and targeting ads without a valid legal basis. LinkedIn had relied on consent that was not freely given or properly informed, and on legitimate interests that did not outweigh users' rights.
Lesson: profiling for advertising almost always needs valid consent. A consent management platform helps record and prove it.
9. Uber: €290 million for transfers to the US (2024)
The Dutch AP fined Uber €290 million in August 2024 for storing European drivers' data on US servers for more than two years without a valid transfer tool. The data included taxi licences, location data, photos, payment details and, in some cases, criminal and medical records. Uber stopped using SCCs after Privacy Shield was struck down and did not replace them until the new framework arrived.
Lesson: keep your transfer mechanisms current. When a framework is invalidated, there is no grace period.
10. Meta: €265 million for data scraping (2022)
In November 2022, the DPC fined Meta €265 million after personal data from about 533 million Facebook users was scraped through the platform's contact-importer tools and published online. The fine was for failing to build data protection into the design of those features.
Lesson: data protection by design covers how your features can be misused, not just how they are meant to be used.
11. Meta: €251 million for a security breach (2024)
In December 2024, the DPC fined Meta €251 million over a 2018 breach in which attackers exploited flaws in Facebook's code to steal users' access tokens. About 29 million accounts were affected, around 3 million of them in the EU and EEA. €240 million was for failing to build data protection into the design and €11 million was for an incomplete breach notification.
Three months earlier, the DPC had fined Meta €91 million for storing hundreds of millions of user passwords in plain text.
Lesson: security failures are fined on two fronts: the weakness itself and how the breach is reported afterwards.
12. WhatsApp: €225 million for transparency failures (2021)
In September 2021, the DPC fined WhatsApp €225 million for not explaining clearly how it processed users' data, including how data was shared with other Meta companies, and for not informing non-users whose phone numbers were uploaded through contact lists. The EDPB pushed the DPC to raise its original proposed fine of €30 to €50 million.
Lesson: a privacy notice that is technically complete but hard to understand does not meet the GDPR's transparency requirements.
What the biggest GDPR fines have in common
Nearly all of the largest fines come from five types of failure:
- International data transfers. Meta, TikTok, Uber's 2024 fine and Yango all involved sending data outside the EEA without adequate safeguards. This single issue accounts for more fine value than any other.
- The wrong legal basis. Meta's €390 million and LinkedIn's €310 million fines were about relying on "contract" or weak consent for advertising.
- Children's data. Both TikTok's 2023 fine and Instagram's fine involved public-by-default settings for minors.
- Security and breach handling. Meta's €251 million and €91 million fines, and the Free Mobile fine, followed security failures.
- Transparency and automated decisions. WhatsApp's and Google's fines were about unclear information. Uber's 2026 fine combined poor transparency with automated decisions about people's livelihoods.
Big tech dominates the top of the table because fines scale with turnover. Smaller companies are fined for the same issues every week, for amounts in the thousands or millions. Our breakdown of the Experian GDPR fine shows how this plays out outside social media.
How GDPR fines are calculated
Article 83 of the GDPR sets two tiers of maximum fines:
- Up to €10 million or 2% of worldwide annual turnover, whichever is higher, for breaches of obligations such as security, records of processing and data protection by design.
- Up to €20 million or 4% of worldwide annual turnover, whichever is higher, for breaches of the core principles, legal bases, individuals' rights and international transfer rules.
Turnover is measured at group level, which is why Yango's fine was calculated from the turnover of its parent company, Yandex. Within those limits, regulators follow the EDPB's guidelines on calculating fines. They weigh how serious the breach was, how many people were affected, how long it lasted, whether it was intentional or negligent, what the company did to limit the damage, and whether it cooperated.
How to avoid a GDPR fine
The lessons from these cases translate into a short list for any company that handles EU personal data:
- Map your transfers. Know which vendors and offices can access personal data from outside the EEA, and have SCCs or another valid mechanism in place, backed by a transfer impact assessment. Your data processing agreements should cover this.
- Check your legal basis for each purpose. Advertising and profiling usually need consent, and that consent must be freely given, specific and recorded.
- Collect only what you need. Data minimisation limits the damage of any breach.
- Make privacy the default, especially for any product children might use.
- Keep a human in the loop for automated decisions with real consequences for people.
- Write a privacy notice people can follow, including where data goes and why.
- Prepare for breaches, with a plan for reporting them to your regulator within 72 hours.
Our GDPR compliance checklist for B2B SaaS companies turns these into concrete steps. If you would rather not manage it by hand, ComplyDog brings together cookie consent, data subject requests, DPAs and your subprocessor list in one place.
Frequently asked questions
What is the largest GDPR fine ever?
The €1.2 billion fine Ireland's DPC imposed on Meta in May 2023 for transferring Facebook users' data to the US. Meta is appealing it.
What is the biggest GDPR fine of 2026?
Uber's €825 million fine from the Dutch Data Protection Authority in August 2026, for deactivating drivers' accounts through fully automated decisions. It is also the second-largest GDPR fine ever.
How much has been fined under the GDPR in total?
About €7.1 billion by January 2026, according to DLA Piper, with around €1.2 billion issued in 2025.
Was Amazon's €746 million fine cancelled?
Yes. In March 2026, a Luxembourg court annulled the fine and sent the case back to the CNPD to reassess. The regulator could still issue a new decision.
Do companies actually pay GDPR fines?
Eventually, if the fine survives appeal. Most large fines are challenged in court, and in Ireland a fine only becomes payable once a court confirms it. That is why only a small fraction of the billions in fines issued by the DPC has been collected so far.
Can small businesses be fined under the GDPR?
Yes. By number, most GDPR fines go to small and mid-sized organisations, usually for amounts in the thousands to low millions of euros. The rules are the same for every company. Only the turnover-based maximum changes.
