GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
227 results · Showing 201–225
Facebook Ireland
Pago PA S.p.A
Third-Party Cookies Without Consent · Cookies Placed Before Consent +1
Uitvoeringsinstituut Werknemersverzekeringen (UWV)
TikTok
Proximus N.V.
Corina A***
Defendant : Westtoer APB a public entity giving autonomous services in the area of tourism in the province of West -Flanders.
Telenet
Cookies Placed Before Consent · Pre-ticked Consent Boxes
Barclays Bank Plc
The Washpoint SL
No Reject Button
FPS Finance
Cookies Placed Before Consent · Misleading Banner Messaging
Google Ireland Ltd
Cookies Placed Before Consent · Cookies Persist After Rejection +1
Amazon Europe Core
Cookies Placed Before Consent · Unclear Cookie Information
The Royal Clinic by Doctor Marin
Unclear Cookie Information
Asociación de Víctimas por Arbitrariedades Judiciales (JAVA)
No Reject Button · Third-Party Cookies Without Consent +1
SERGIC SAS
Gaypa s.r.l.
Claimant: Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv)
Pre-ticked Consent Boxes · Reject Harder Than Accept +2
DPA case 07121-1/2020/1570
OpenX Software Ltd., OpenX Ltd. og OpenX Technologies, Inc.
Comune di Manduria
XX
Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e. V.
Pre-ticked Consent Boxes
Udine City Council
Solo Embrague
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (227 total)
- Facebook Ireland (Austria) – court ruling – Jun 2021
- Pago PA S.p.A (Italy) – violation found – Jun 2021 | Third-Party Cookies Without Consent, Cookies Placed Before Consent, Unclear Cookie Information
- Uitvoeringsinstituut Werknemersverzekeringen (UWV) (Netherlands) – complaint upheld – May 2021
- TikTok (Italy) – violation found – Mar 2021
- Proximus N.V. (Belgium) – court ruling – Feb 2021
- Corina A*** (Austria) – complaint upheld – Feb 2021
- Defendant : Westtoer APB a public entity giving autonomous services in the area of tourism in the province of West -Flanders. (Belgium) – violation found – Feb 2021
- Telenet (Belgium) – complaint upheld – Feb 2021 | Cookies Placed Before Consent, Pre-ticked Consent Boxes
- Barclays Bank Plc (Italy) – complaint upheld – Jan 2021
- The Washpoint SL (Spain) – €2K – Jan 2021 | No Reject Button
- FPS Finance (Belgium) – complaint upheld – Dec 2020 | Cookies Placed Before Consent, Misleading Banner Messaging
- Google Ireland Ltd (France) – €100.0M – Dec 2020 | Cookies Placed Before Consent, Cookies Persist After Rejection, Unclear Cookie Information
- Amazon Europe Core (France) – €35.0M – Dec 2020 | Cookies Placed Before Consent, Unclear Cookie Information
- The Royal Clinic by Doctor Marin (Spain) – €2K – Nov 2020 | Unclear Cookie Information
- Asociación de Víctimas por Arbitrariedades Judiciales (JAVA) (Spain) – €8K – Nov 2020 | No Reject Button, Third-Party Cookies Without Consent, Unclear Cookie Information
- SERGIC SAS (France) – court ruling – Nov 2020
- Gaypa s.r.l. (Italy) – €20K – Oct 2020
- Claimant: Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv) (Germany) – court ruling – Sept 2020 | Pre-ticked Consent Boxes, Reject Harder Than Accept, Third-Party Cookies Without Consent, Unclear Cookie Information
- DPA case 07121-1/2020/1570 (Slovenia) – violation found – Sept 2020
- OpenX Software Ltd., OpenX Ltd. og OpenX Technologies, Inc. (Norway) – dismissed – Sept 2020
- Comune di Manduria (Italy) – €0 – Jul 2020
- XX (Italy) – €5K – Jul 2020
- Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e. V. (Germany) – court ruling – May 2020 | Pre-ticked Consent Boxes
- Udine City Council (Italy) – violation found – Mar 2020
- Solo Embrague (Spain) – €2K – Mar 2020