GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
53 results · Showing 1–25
KFC Restaurants Spain, S.L.U.
Court case 4 U 353/24
Court case W171 2305420-1
No Reject Button · Misleading Banner Messaging +1
Österreichischer Rundfunk - ORF
Reject Harder Than Accept
Criteo
ANSPDCP
Cookies Placed Before Consent · Unclear Cookie Information
Court case 6 U 81/23
Third-Party Cookies Without Consent
Meta Platforms Ireland Limited
Court case C/10/677340 / HA ZA 24-317
Third-Party Cookies Without Consent
Der Standard
No Granular Cookie Choice
Meta Platforms Inc.
Data Subject versus Social Media Platform Operator
Third-Party Cookies Without Consent
IAB Europe
Unclear Cookie Information
Court case 490202
Cookies Placed Before Consent
Court case 10 A 5385/22
Reject Harder Than Accept · Third-Party Cookies Without Consent
Cookies Placed Before Consent
Court case 6 C 3.23
Court case Ra 2024/04/0424
Reject Harder Than Accept · Pre-ticked Consent Boxes
Court case W252 2282050-1/12E
Reject Harder Than Accept · Cannot Withdraw Cookie Consent
Court case W298 2274626-1/8E
Cookies Persist After Rejection · Third-Party Cookies Without Consent
Court case W 108 2284491-1
No Reject Button · Reject Harder Than Accept +2
Court case W108 2280724-1
Court case 9 O 173/24
Cookies Persist After Rejection · Third-Party Cookies Without Consent
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (53 total)
- KFC Restaurants Spain, S.L.U. (Spain) – court ruling – Jul 2026
- Court case 4 U 353/24 (Germany) – court ruling – Apr 2026
- Court case W171 2305420-1 (Austria) – court ruling – Apr 2026 | No Reject Button, Misleading Banner Messaging, Cookies Placed Before Consent
- Österreichischer Rundfunk - ORF (Austria) – court ruling – Apr 2026 | Reject Harder Than Accept
- Criteo (France) – court ruling – Mar 2026
- ANSPDCP (Romania) – court ruling – Jan 2026 | Cookies Placed Before Consent, Unclear Cookie Information
- Court case 6 U 81/23 (Germany) – court ruling – Dec 2025 | Third-Party Cookies Without Consent
- Meta Platforms Ireland Limited (Spain) – court ruling – Nov 2025
- Court case C/10/677340 / HA ZA 24-317 (Netherlands) – court ruling – Nov 2025 | Third-Party Cookies Without Consent
- Der Standard (Austria) – court ruling – Aug 2025 | No Granular Cookie Choice
- Meta Platforms Inc. (Germany) – court ruling – Jul 2025
- Data Subject versus Social Media Platform Operator (Germany) – court ruling – Jul 2025 | Third-Party Cookies Without Consent
- IAB Europe (Belgium) – court ruling – May 2025 | Unclear Cookie Information
- Court case 490202 (France) – court ruling – May 2025
- LinkedIn (Netherlands) – court ruling – Apr 2025 | Cookies Placed Before Consent
- Court case 10 A 5385/22 (Germany) – court ruling – Mar 2025 | Reject Harder Than Accept, Third-Party Cookies Without Consent
- LinkedIn (Netherlands) – court ruling – Feb 2025 | Cookies Placed Before Consent
- Court case 6 C 3.23 (Germany) – court ruling – Jan 2025
- Court case Ra 2024/04/0424 (Austria) – court ruling – Jan 2025 | Reject Harder Than Accept, Pre-ticked Consent Boxes
- Court case W252 2282050-1/12E (Austria) – court ruling – Nov 2024 | Reject Harder Than Accept, Cannot Withdraw Cookie Consent
- Court case W298 2274626-1/8E (Austria) – court ruling – Sept 2024 | Cookies Persist After Rejection, Third-Party Cookies Without Consent
- Court case W 108 2284491-1 (Austria) – court ruling – Jul 2024 | No Reject Button, Reject Harder Than Accept, Pre-ticked Consent Boxes, Cookies Placed Before Consent
- Court case W108 2280724-1 (Austria) – court ruling – Jul 2024
- Court case 9 O 173/24 (Germany) – court ruling – Jul 2024
- Linkedin (Netherlands) – court ruling – Jun 2024 | Cookies Persist After Rejection, Third-Party Cookies Without Consent