Free reference

Published privacy penalty maximums

These are the published legal maximums. They are not an estimate of what you would pay, and they do not mean either law applies to your site.

These figures do not mean either law applies to your site. A scan result, a form, or monthly visitors cannot tell you that.

This is an educational reference based on published legal maximums. It is not a predicted fine, and it is not legal advice.

Published maximums

What the statutes publish

Which regions do you serve?
Do your forms collect personal data?
Do your forms collect personal data?
Did a recent Leak Finder scan find tracking leaks?
Did a recent Leak Finder scan find tracking leaks?

California

Civil Code § 1798.155

$2,663/$7,988

  • Up to $2,663 for each violation.
  • Up to $7,988 for each intentional violation or violation involving personal information of a consumer known to be under 16.

These are the CPI-adjusted per-violation maximums effective January 1, 2025. They are not multiplied by monthly visitors. Scope uses the definitions in Civil Code § 1798.140.

GDPR

Article 83

  • Infringements listed in Article 83(4): up to €10 million, or 2% of total worldwide annual turnover from the preceding financial year, whichever is higher.
  • Infringements listed in Article 83(5): up to €20 million, or 4% of total worldwide annual turnover from the preceding financial year, whichever is higher.

These are two maximum tiers. They are not a 10 million to 20 million euro exposure range.

Privacy · Disclaimer

Put this on a compliance page

Copy a snippet. It cites published California and GDPR maximums and links here. It is not a finding about the site that shows it.

Also free: run a leak check. See what still loads on this site. A scan does not tell you which privacy law applies. Run the free leak check →