GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
46 results · Showing 1–25
DPA case 84/2026
Microsoft Corporation
Third-Party Cookies Without Consent
DPA case 2026-0.043.390
Cookies Placed Before Consent
A student represented by noyb
Third-Party Cookies Without Consent · Unclear Cookie Information
Aller Media AB
Reject Harder Than Accept · Misleading Banner Messaging
Aktiebolaget Trav och Galopp
Reject Harder Than Accept · Misleading Banner Messaging
G.Glamour
Unclear Cookie Information
Österreichischer Rundfunk - ORF
No Reject Button · Reject Harder Than Accept +1
RTL Belgium SA
No Reject Button · Misleading Banner Messaging
Mapfre España Compañia de Seguros y Reaseguros SA
Cookies Placed Before Consent · Third-Party Cookies Without Consent
MediaHuis
No Reject Button · Misleading Banner Messaging +1
DPA case Takeaway B.V. - z2022-04011
Third-Party Cookies Without Consent
DPA case 74/2024
Google LLC
Third-Party Cookies Without Consent
C.B. Sistemi s.r.l.
Mediafin
No Reject Button · Reject Harder Than Accept +1
Editoriale Argo S.r.l.
Reti Televisive Italiane S.p.a.
Ministry of Economy, Finance and Industrial and Digital Sovereignty
DPA case 521.14877.15
No Reject Button · Misleading Banner Messaging +1
Briggs & Stratton LLC
No Reject Button · Reject Harder Than Accept
Hearst Magazine Media, Inc.
No Reject Button · Third-Party Cookies Without Consent
Associazione ContiamoCI! ETS
GLOBAL KAPITAL GROUP SPAIN, S.L
Dagens Industri Aktiebolag
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (46 total)
- DPA case 84/2026 (Belgium) – complaint upheld – Apr 2026
- Microsoft Corporation (Austria) – complaint upheld – Jan 2026 | Third-Party Cookies Without Consent
- DPA case 2026-0.043.390 (Austria) – complaint upheld – Jan 2026 | Cookies Placed Before Consent
- A student represented by noyb (Austria) – complaint upheld – Oct 2025 | Third-Party Cookies Without Consent, Unclear Cookie Information
- Aller Media AB (Sweden) – complaint upheld – Apr 2025 | Reject Harder Than Accept, Misleading Banner Messaging
- Aktiebolaget Trav och Galopp (Sweden) – complaint upheld – Dec 2024 | Reject Harder Than Accept, Misleading Banner Messaging
- G.Glamour (Italy) – complaint upheld – Nov 2024 | Unclear Cookie Information
- Österreichischer Rundfunk - ORF (Austria) – complaint upheld – Oct 2024 | No Reject Button, Reject Harder Than Accept, Cookies Placed Before Consent
- RTL Belgium SA (Belgium) – complaint upheld – Oct 2024 | No Reject Button, Misleading Banner Messaging
- Mapfre España Compañia de Seguros y Reaseguros SA (Spain) – complaint upheld – Oct 2024 | Cookies Placed Before Consent, Third-Party Cookies Without Consent
- MediaHuis (Belgium) – complaint upheld – Sept 2024 | No Reject Button, Misleading Banner Messaging, Cannot Withdraw Cookie Consent
- DPA case Takeaway B.V. - z2022-04011 (Netherlands) – complaint upheld – Aug 2024 | Third-Party Cookies Without Consent
- DPA case 74/2024 (Belgium) – complaint upheld – May 2024
- Google LLC (Cyprus) – complaint upheld – Feb 2024 | Third-Party Cookies Without Consent
- C.B. Sistemi s.r.l. (Italy) – complaint upheld – Nov 2023
- Mediafin (Belgium) – complaint upheld – Nov 2023 | No Reject Button, Reject Harder Than Accept, Cannot Withdraw Cookie Consent
- Editoriale Argo S.r.l. (Italy) – complaint upheld – Nov 2023
- Reti Televisive Italiane S.p.a. (Italy) – complaint upheld – Nov 2023
- Ministry of Economy, Finance and Industrial and Digital Sovereignty (France) – complaint upheld – Nov 2023
- DPA case 521.14877.15 (Germany) – complaint upheld – Sept 2023 | No Reject Button, Misleading Banner Messaging, Cannot Withdraw Cookie Consent
- Briggs & Stratton LLC (Austria) – complaint upheld – Sept 2023 | No Reject Button, Reject Harder Than Accept
- Hearst Magazine Media, Inc. (Austria) – complaint upheld – Sept 2023 | No Reject Button, Third-Party Cookies Without Consent
- Associazione ContiamoCI! ETS (Italy) – complaint upheld – Aug 2023
- GLOBAL KAPITAL GROUP SPAIN, S.L (Spain) – complaint upheld – Aug 2023
- Dagens Industri Aktiebolag (Sweden) – complaint upheld – Jun 2023