GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
227 results · Showing 151–175
Cityscoot
No Reject Button
Data Privacy Stichting
Third-Party Cookies Without Consent
Meta Platforms Inc.
SA Rossel et Cie
DPA case 2021-31-4871
Misleading Banner Messaging
DPA case 2021-31-5553
Misleading Banner Messaging
Maggioli S.p.A.
No Reject Button · Pre-ticked Consent Boxes
TV2 Média Csoport Zrt.
Reject Harder Than Accept · Misleading Banner Messaging +1
Il Sole 24 Ore S.p.a.
Court case 10 O 14/21
Microsoft Ireland Operations Limited
Cookies Placed Before Consent · Reject Harder Than Accept
City of Helsinki
Cookies Placed Before Consent · Third-Party Cookies Without Consent +1
Amazon Italia Logistica
Toerisme Vlaanderen
No Reject Button · Unclear Cookie Information
Conservatorio Santa Cecilia di Roma
an unnamed data subject
Cookies Placed Before Consent
JP/Politikens Hus A/S
Misleading Banner Messaging · Unclear Cookie Information
Istituto di Istruzione Superiore “G. Renda” di Polistena, Reggio Calabria
XX (the data subject)
Policlinico Casilino di Roma (the controller)
Douglas Italia S.p.a.
Regione di Veneto (the Controller)
Municipality of Thiene
Court case Tussenarrest 2022/AR/292
Individuals
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (227 total)
- Cityscoot (France) – €125K – Mar 2023 | No Reject Button
- Data Privacy Stichting (Netherlands) – court ruling – Mar 2023 | Third-Party Cookies Without Consent
- Meta Platforms Inc. (Austria) – complaint upheld – Mar 2023
- SA Rossel et Cie (Belgium) – court ruling – Feb 2023
- DPA case 2021-31-4871 (Denmark) – complaint upheld – Feb 2023 | Misleading Banner Messaging
- DPA case 2021-31-5553 (Denmark) – complaint upheld – Feb 2023 | Misleading Banner Messaging
- Maggioli S.p.A. (Italy) – complaint upheld – Feb 2023 | No Reject Button, Pre-ticked Consent Boxes
- TV2 Média Csoport Zrt. (Hungary) – €25K – Jan 2023 | Reject Harder Than Accept, Misleading Banner Messaging, Cannot Withdraw Cookie Consent
- Il Sole 24 Ore S.p.a. (Italy) – complaint upheld – Jan 2023
- Court case 10 O 14/21 (Germany) – court ruling – Jan 2023
- Microsoft Ireland Operations Limited (France) – €60.0M – Dec 2022 | Cookies Placed Before Consent, Reject Harder Than Accept
- City of Helsinki (Finland) – violation found – Dec 2022 | Cookies Placed Before Consent, Third-Party Cookies Without Consent, Unclear Cookie Information
- Amazon Italia Logistica (Italy) – €20K – Dec 2022
- Toerisme Vlaanderen (Belgium) – violation found – Nov 2022 | No Reject Button, Unclear Cookie Information
- Conservatorio Santa Cecilia di Roma (Italy) – €6K – Nov 2022
- an unnamed data subject (Italy) – €500K – Nov 2022 | Cookies Placed Before Consent
- JP/Politikens Hus A/S (Denmark) – violation found – Oct 2022 | Misleading Banner Messaging, Unclear Cookie Information
- Istituto di Istruzione Superiore “G. Renda” di Polistena, Reggio Calabria (Italy) – €900 – Oct 2022
- XX (the data subject) (Italy) – €5K – Oct 2022
- Policlinico Casilino di Roma (the controller) (Italy) – €30K – Oct 2022
- Douglas Italia S.p.a. (Italy) – €1.4M – Oct 2022
- Regione di Veneto (the Controller) (Italy) – €100K – Oct 2022
- Municipality of Thiene (Italy) – €3K – Sept 2022
- Court case Tussenarrest 2022/AR/292 (Belgium) – court ruling – Sept 2022
- Individuals (Greece) – €150K – Jul 2022