Enforcement tracker

Selected privacy enforcement actions

Selected GDPR fines and CCPA enforcement settlements from public regulator announcements. Each entry links to its source. This is not a prediction of what you would pay or legal advice.

Educational reference only. Amounts and summaries come from the linked regulator announcements. Not legal advice, and not a finding that any law applies to your site.

Selected actions

1. Meta Platforms Ireland Limited

   €1.2 billion

   May 22, 2023 · GDPR · Data Protection Commission (Ireland)

   Unlawful transfers of personal data to the United States.

   Source: DPC press releasePublished maximums

2. LinkedIn Ireland Unlimited Company

   €310 million

   October 24, 2024 · GDPR · Data Protection Commission (Ireland)

   Lawfulness of processing personal data for behavioural advertising.

   Source: DPC press releasePublished maximums

3. TikTok Technology Limited

   €345 million

   September 15, 2023 · GDPR · Data Protection Commission (Ireland)

   Processing of children’s personal data on the platform.

   Source: DPC press releasePublished maximums

4. Meta Platforms Ireland Limited

   €251 million

   December 17, 2024 · GDPR · Data Protection Commission (Ireland)

   Personal data breach affecting Facebook users.

   Source: DPC press releasePublished maximums

5. Meta Platforms Ireland Limited (Instagram)

   €405 million

   September 15, 2022 · GDPR · Data Protection Commission (Ireland)

   Processing of children’s personal data on Instagram.

   Source: DPC press releasePublished maximums

6. WhatsApp Ireland Limited

   €225 million

   September 2, 2021 · GDPR · Data Protection Commission (Ireland)

   Transparency obligations about processing of personal data.

   Source: DPC press releasePublished maximums

7. Meta Platforms Ireland Limited

   €265 million

   November 28, 2022 · GDPR · Data Protection Commission (Ireland)

   Facebook data-scraping inquiry involving Articles 25(1) and 25(2) GDPR.

   Source: DPC press releasePublished maximums

8. British Airways

   £20 million

   October 16, 2020 · GDPR · ICO (United Kingdom)

   Failure to protect personal data in a 2018 cyber attack.

   Source: ICO penalty notice (PDF)Published maximums

9. Marriott International, Inc.

   £18.4 million

   October 30, 2020 · GDPR · ICO (United Kingdom)

   Failure to keep personal data secure in a systems compromise.

   Source: ICO penalty notice (PDF)Published maximums

10. Sephora USA, Inc.

    $1.2 million

    August 24, 2022 · CCPA · California Attorney General

    First public CCPA enforcement settlement for sale-of-data disclosures.

    Source: California AG press releasePublished maximums

11. H&M Hennes & Mauritz Online Shop A.B. & Co. KG

    €35.3 million

    October 1, 2020 · GDPR · Hamburg Commissioner for Data Protection

    Unlawful monitoring of several hundred employees.

    Source: Hamburg DPA press release (PDF)Published maximums