GDPR Fines by Country
5,958 enforcement actions totaling €8.3B across 33 European countries. Select a country to explore its data protection authorities, enforcement trends, and notable cases.
Ireland leads European cookie enforcement with €4.4B across 81 actions, followed by Netherlands (€1.4B) and France (€1.2B). The Cookie Fines tracks enforcement across 33 European countries, updated daily.
Data current as of 13 October 2026 · Updated daily
33 countries
Ireland
€4.4B
Netherlands
€1.4B
France
€1.2B
Italy
€457.7M
Spain
€195.8M
United Kingdom
€154.6M
Germany
€123.0M
Greece
€41.4M
Austria
€39.5M
Sweden
€38.3M
Norway
€33.1M
Poland
€29.2M
Czech Republic
€28.5M
Croatia
€23.9M
Finland
€15.3M
Portugal
€6.8M
Lithuania
€5.5M
Hungary
€4.6M
Denmark
€4.1M
Bulgaria
€3.8M
Estonia
€3.3M
Belgium
€2.9M
Romania
€2.4M
Cyprus
€1.5M
Iceland
€1.2M
Latvia
€945K
Luxembourg
€502K
Malta
€447K
Slovenia
€270K
Slovakia
€50K
Switzerland
€7K
Liechtenstein
€4K
European Union
€0
Frequently Asked Questions About GDPR Enforcement by Country
Q:Which European country issues the most GDPR fines?
Spain (AEPD) consistently issues the highest volume of GDPR fines, while Ireland (DPC) and Luxembourg (CNPD) issue the largest individual penalties due to hosting major tech company headquarters. France (CNIL) leads in cookie-specific enforcement. Italy (Garante) is also among the top enforcers by both volume and total amount.
Q:How do GDPR enforcement approaches differ across European countries?
Enforcement approaches vary significantly. France's CNIL focuses heavily on cookie consent and Big Tech. Spain's AEPD issues many smaller fines across diverse sectors. Ireland's DPC handles cross-border cases for US tech giants. Germany has a federal structure with 16 state-level DPAs plus the BfDI. Nordic countries tend to favour corrective measures over large fines.
Q:Do non-EU countries enforce GDPR fines?
Yes. EEA countries (Norway, Iceland, Liechtenstein) enforce GDPR through the EEA Agreement. The UK enforces its own UK GDPR post-Brexit through the ICO. Switzerland has separate data protection laws (nDSG/FADP) enforced by the FDPIC. These non-EU enforcers are included in the Cookie Fines database.