GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
14 results · Showing 1–14
KFC Restaurants Spain, S.L.U.
Meta Platforms Ireland Limited
Tiger Media Inc.
Cookies Placed Before Consent
Mapfre España Compañia de Seguros y Reaseguros SA
Cookies Placed Before Consent · Third-Party Cookies Without Consent
Turner Broadcasting System España, S.L.
No Reject Button · Misleading Banner Messaging +1
CaixaBank S.A.
Reject Harder Than Accept · Cannot Withdraw Cookie Consent
GLOBAL KAPITAL GROUP SPAIN, S.L
Rights International Spain (RIS)
Lia's Clothes
Cookies Placed Before Consent · No Reject Button +1
Ramona Films, S.L.
No Reject Button · Cookies Placed Before Consent +2
The Washpoint SL
No Reject Button
The Royal Clinic by Doctor Marin
Unclear Cookie Information
Asociación de Víctimas por Arbitrariedades Judiciales (JAVA)
No Reject Button · Third-Party Cookies Without Consent +1
Solo Embrague
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (14 total)
- KFC Restaurants Spain, S.L.U. (Spain) – court ruling – Jul 2026
- Meta Platforms Ireland Limited (Spain) – court ruling – Nov 2025
- Tiger Media Inc. (Spain) – €72K – Nov 2025 | Cookies Placed Before Consent
- Mapfre España Compañia de Seguros y Reaseguros SA (Spain) – complaint upheld – Oct 2024 | Cookies Placed Before Consent, Third-Party Cookies Without Consent
- Turner Broadcasting System España, S.L. (Spain) – dismissed – Mar 2024 | No Reject Button, Misleading Banner Messaging, Cannot Withdraw Cookie Consent
- CaixaBank S.A. (Spain) – dismissed – Oct 2023 | Reject Harder Than Accept, Cannot Withdraw Cookie Consent
- GLOBAL KAPITAL GROUP SPAIN, S.L (Spain) – complaint upheld – Aug 2023
- Rights International Spain (RIS) (Spain) – no violation – Jan 2022
- Lia's Clothes (Spain) – €2K – Jan 2022 | Cookies Placed Before Consent, No Reject Button, No Granular Cookie Choice
- Ramona Films, S.L. (Spain) – €8K – Jan 2022 | No Reject Button, Cookies Placed Before Consent, Unclear Cookie Information, No Granular Cookie Choice
- The Washpoint SL (Spain) – €2K – Jan 2021 | No Reject Button
- The Royal Clinic by Doctor Marin (Spain) – €2K – Nov 2020 | Unclear Cookie Information
- Asociación de Víctimas por Arbitrariedades Judiciales (JAVA) (Spain) – €8K – Nov 2020 | No Reject Button, Third-Party Cookies Without Consent, Unclear Cookie Information
- Solo Embrague (Spain) – €2K – Mar 2020