Privacy enforcement stopped being symbolic years ago. Cumulative GDPR fines reached EUR 7.1B by January 2026, according to DLA Piper's annual survey, and 2026 has added Google's EUR 403M location-data fine in Ireland and Coupang's record KRW 624.7B penalty in Korea. Almost every headline fine lands on advertising, location data, transfers or children, the places where data makes money, moves across borders or touches minors.
The biggest fines on record
| Company | Fine | Year | Authority | What it was for |
|---|---|---|---|---|
| Meta (Facebook) | EUR 1.2B | 2023 | Irish DPC / EDPB | Transfers of EU user data to the US without valid safeguards after Schrems II. |
| DiDi Global | RMB 8.026B | 2022 | Cyberspace Administration of China | Sweeping PIPL, DSL and CSL violations, including unlawful collection and data handling with national-security implications. |
| Amazon | EUR 746M | 2021 | Luxembourg CNPD | Advertising-related processing without a valid legal basis. |
| TikTok | EUR 530M | 2025 | Irish DPC | Transfers of European user data to China and transparency failures. |
| Meta (Instagram) | EUR 405M | 2022 | Irish DPC | Children's data, with minors' business accounts public by default. |
| EUR 403M | 2026 | Irish DPC | Location data from Location History and Web & App Activity processed unlawfully, transparency failures across its location features, and excessive retention (2018-2020). | |
| Meta (Facebook & Instagram) | EUR 390M | 2023 | Irish DPC | Behavioral ads run on a 'contract' legal basis, ruled unlawful. |
| Coupang | KRW 624.7B | 2026 | Korea PIPC | A breach affecting 37.5M people, plus KRW 201.1B for tracking 11.17M members' activity on third-party sites through its affiliate program. |
| TikTok | EUR 345M | 2023 | Irish DPC | Children's default settings and age verification failures. |
| EUR 325M | 2025 | French CNIL | Ads inserted between Gmail users' emails without consent, and account-creation cookie choices that made accepting easier than refusing. | |
| EUR 310M | 2024 | Irish DPC | Behavioral advertising without a valid legal basis (consent, contract and legitimate interests all rejected). | |
| Uber | EUR 290M | 2024 | Dutch AP | Driver data transferred to the US without appropriate safeguards. |
| Meta (Facebook) | EUR 265M | 2022 | Irish DPC | Scraping that exposed phone numbers and profile data of 533M users. |
| Meta (Facebook) | EUR 251M | 2024 | Irish DPC | Notification and privacy-by-design failures around a 2018 breach of 29M accounts. |
| EUR 225M | 2021 | Irish DPC | Transparency failures in privacy notices, raised by EDPB intervention. | |
| EUR 150M | 2021 | French CNIL | Cookie banners that made rejecting harder than accepting (a national ePrivacy fine). | |
| Shein | EUR 150M | 2025 | French CNIL | Advertising cookies placed without valid consent. |
Fines in other currencies are placed at their approximate euro value.
Maximum penalties by regime
| Regime | Ceiling |
|---|---|
| EU (GDPR) | EUR 20M or 4% of global turnover |
| UK | GBP 17.5M or 4% of global turnover |
| Brazil | 2% of Brazil revenue, R$50M cap per violation |
| China | RMB 50M or 5% of turnover |
| South Korea | 3% of total revenue; up to 10% for repeat, large-scale or order-defying violations (from September 2026) |
| Australia | AUD 50M, 3x benefit, or 30% of adjusted turnover |
| India (from May 2027) | INR 250 crore per breach category, stackable |
| US states | Typically $2,500-$7,500 per violation via AG action |
| US TCPA | $500-$1,500 per call or text, uncapped |
| Canada (CASL) | CAD 10M per violation |
| Quebec (Law 25) | CAD 25M or 4% of turnover |
| Saudi Arabia | SAR 5M, doubled for repeats |
| Russia | Turnover-based leak fines to 3% (2025) |
Percentage-of-turnover ceilings (EU, UK, Brazil, China, Australia, Korea) scale to the defendant, which is why they produce nine- and ten-figure numbers against platforms. Per-violation regimes (US states, the TCPA, CASL) scale to volume instead, so an SMS campaign can out-price a GDPR case. A million badly consented texts at $500 each is $500M of theoretical exposure before a class action lawyer sharpens the number.