Anika Begay
The state of enforcement of the European Union’s flagship privacy regime, the General Data Protection Regulation (GDPR), on the most powerful tech giants remains a topic of ongoing debate. Below, we’ve compiled a list of the 10 largest GDPR fines imposed on Big Tech since the regulation began to apply in May 2018.
Meta, the owner of Facebook, Instagram and WhatsApp, tops the list, both having received the highest fines to date (1.2 billion euros or about $1.31 billion at current exchange rates). AND because it accounts for most of the higher penalties (six or more, depending on whether you count per platform).
Please note that this list only includes the most significant fines issued to tech companies under the GDPR. There have also been some significant fines issued to Big Tech under the bloc’s old ePrivacy Directive in recent years, but you won’t find them listed here.
Fines issued to tech companies under GDPR
1. Half (Facebook): €1.2 billion (~$1.31 billion) fine imposed in May 2023 by the Irish Data Protection Commission (DPC) for violating rules on the transfer of Facebook users’ personal data outside the European Union.
2. Amazon: Luxembourg’s National Data Protection Commission (CNPD) fined €746 million (~$815 million) following complaints that the use of personal data for advertising targeting was not based on consent.
3. Goal (Instagram): €405 million (~$443 million) fine imposed in September 2021 by the Irish DPC for deficiencies in the handling of children’s data.
4. Goal (Instagram and Facebook): Total fine of €390 million (~$426 million) imposed in January 2023 by the Irish DPC for not having a valid legal basis to process user data for targeted advertising purposes.
5. ByteDance (TikTok): €345 million (~$377 million) fine imposed in September 2023 by the Irish DPC for deficiencies in the handling of children’s data.
6. Goal (Facebook and Instagram): €265 million (~$290 million) fined in November 2022 by the Irish DPC for data protection violations by default and by design after certain features of the platform, including contact import and search tools, made the personal data of hundreds of millions of users accessible to all other users.
7. Goal (WhatsApp): €225 million (~$246 million) fine received in September 2021 by the Irish DPC for violating GDPR transparency obligations and failing to clearly explain to users how their data is being processed.
8. Alphabet/Google (Android): Fined €50 million (~$55 million) in January 2019 by the French National Commission for Informatics and Civil Liberties (CNIL) for lack of transparency and consent in relation to its Android mobile platform.
9. Goal (Facebook): €17 million (~$18.5 million) fine imposed in March 2022 by the Irish DPC for a series of security breaches believed to have affected up to 30 million users.
10. ByteDance (TikTok): Fined approximately €14.8 million at current exchange rates (~$16 million) in April 2023 by the UK Information Commissioner’s Office (ICO) in another child protection case. (Note: Although the UK is no longer part of the EU, its data protection rules are still based on the GDPR.)
It’s not exactly Big Tech but it’s worth mentioning
Adtech giant Criteo was preliminarily fined €60 million (~$65 million) in August 2022 by the French CNIL for a series of GDPR violations. But in June 2023, the fine level was reduced to €40 million (~$44 million) after the adtech giant filed statements. The fine followed complaints that Criteo lacked user consent for tracking and profiling for ad targeting.
Another bonus mention: US-based AI startups Clearview Artificial Intelligence was fined the maximum possible (€20 million or about $22 million, based on its revenue) three times in 2022 by data protection authorities in Italy, Greece, and France. The fines were for unlawful data processing as a result of its tactic of scraping selfies from the internet to train an AI facial recognition and ID-matching tool. That same year, the UK’s ICO also hit it with a smaller fine for GDPR violations, so the controversial startup’s activities have attracted a lot of scrutiny.
