Fines and enforcement
Largest GDPR fines and their appeal status
Short answer
- Largest in records read
- €1.2 billion, Meta Ireland, 2023 1
- Most recent large fine
- €403 million, Google, 21 September 2026 5
- DPC fines in 2025
- Just over €530.77 million 3
- Key court ruling
- CJEU, 10 February 2026, WhatsApp v EDPB 4
How this list was built
The table lists fines whose official decision notice or regulator report was opened for this page 1,2 3. Amounts are as announced. The list is not a complete ranking. A fine missing here may exist but was not confirmed from a regulator record during this research.
Appeal status is shown only where the record says something. Most press notices do not report later court steps 5,6.
Large GDPR fines in official records
The DPC prints the TikTok outcome in two ways. Its annual report notice says it adopted a final decision and imposed two administrative fines totalling €530 million 3. Its annual report lists one Final Decision of 30 April 2025 with fines of €530,000,000 10.
| Amount | Authority and date | Company | Subject | Status in the record |
|---|---|---|---|---|
| €1.2 billion 1 | Irish DPC, 22 May 2023 1 | Meta Platforms Ireland 1 | US transfers, Article 46(1) 1 | Based on EDPB binding decision of 13 April 2023 1 |
| €824,990,000 2 | Dutch AP, decision date not given, announced by the CNIL on 24 August 2026 2 | Uber B.V. and Uber Technologies Inc. 2 | Automated driver deactivations, Article 22 2 | Appeal status not stated 2 |
| €530 million, two fines 3 | Irish DPC, final decision of 30 April 2025 10 | TikTok Technology Limited 3 | Transfers to China, Articles 46(1) and 13(1)(f) 10 | Appealed by TikTok, according to the DPC Annual Report 2025 10 |
| €403 million 5 | Irish DPC, 21 September 2026 5 | Google Ireland Limited 5 | Location data, lawfulness, transparency and retention 5 | Full decision to be issued 5 |
| €310 million 6 | Irish DPC, 24 October 2024 6 | LinkedIn Ireland 6 | Behavioural analysis and targeted ads 6 | No objections from other authorities 6 |
| €290 million 7 | Dutch AP, 22 July 2024 according to the CNIL 2 | Uber 7 | Driver data sent to the US 7 | Uber indicated it would object 7 |
| €251 million 8 | Irish DPC, 17 December 2024 8 | Meta Platforms Ireland 8 | 2018 Facebook breach 8 | No objections from other authorities 8 |
| €225 million 4 | Irish DPC, after EDPB Binding Decision 1/2021 4 | WhatsApp Ireland 4 | Merits not yet ruled on by the General Court 4 | Challenge to EDPB decision admissible, 10 February 2026 4 |
How appeals work in cross-border cases
When EU authorities disagree, the EDPB can adopt a binding decision that the lead authority must follow 1. In WhatsApp's case, the EU General Court dismissed the company's action against EDPB Binding Decision 1/2021 as inadmissible on 7 December 2022 4.
On 10 February 2026 the Court of Justice set that order aside 4. It held that the EDPB decision can be challenged and is of direct concern to WhatsApp 4. It sent the case back to the General Court, which has not yet ruled on whether WhatsApp infringed the GDPR 4. The Court did not rule on the €225 million fine 4.
Repeat fines and a fine outside the GDPR
The CNIL lists three Dutch fines on Uber in this case, €10 million on 11 December 2023, €290 million on 22 July 2024 and about €825 million announced in 2026, with the dates as given by the CNIL 2. The Dutch authority's own release on the €290 million fine mentions a €600,000 fine on Uber in 2018 7. The complaint behind the cases came from the Ligue des droits de l'Homme on behalf of more than 170 drivers 2.
Not every large privacy fine in Europe is a GDPR fine. The CNIL's €325 million fine against Google of 1 September 2025 was based on French law on cookies and email advertising, and the CNIL said the GDPR cooperation mechanism did not apply 9.
Common questions
What is the biggest GDPR fine ever?
In the regulator records read for this page, it is the €1.2 billion fine on Meta Ireland announced by the Irish DPC on 22 May 2023 1.
Has the WhatsApp €225 million fine been overturned?
No ruling on the fine appears in the record. On 10 February 2026 the Court of Justice found WhatsApp's challenge to the EDPB decision admissible and returned the case to the General Court 4.
Did Uber appeal the €290 million fine?
The Dutch authority said Uber indicated its intent to object to the fine 7.
Is the CNIL's €325 million Google fine a GDPR fine?
No. The CNIL based it on French rules that transpose the ePrivacy Directive 9.
Has TikTok appealed its €530 million fine?
Yes. The DPC's 2025 annual report says its decision of 30 April 2025 has been appealed by TikTok 10.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.
Sources
- Data Protection Commission: Data Protection Commission announces conclusion of inquiry into Meta Ireland (22 May 2023)
- CNIL: Décisions automatisées : sanction de près de 825 millions d'euros à l'encontre d'UBER (24 August 2026)
- Data Protection Commission: Data Protection Commission Publishes Annual Report for 2025 and Results of "Sharenting" Survey (30 June 2026)
- Court of Justice of the European Union: Press release No 11/26, GDPR: the action brought by WhatsApp Ireland against Binding Decision 1/2021 of the European Data Protection Board is admissible (10 February 2026)
- Data Protection Commission: Data Protection Commission fines Google €403 million following Inquiry into Google's processing of location data (21 September 2026)
- Data Protection Commission: Irish Data Protection Commission fines LinkedIn Ireland €310 million (24 October 2024)
- Autoriteit Persoonsgegevens: Dutch DPA imposes a fine of 290 million euro on Uber
- Data Protection Commission: Irish Data Protection Commission fines Meta €251 Million (17 December 2024)
- CNIL: Cookies and advertisements inserted between emails: GOOGLE fined 325 million euros by the CNIL (3 September 2025)
- Data Protection Commission: Annual Report 2025 (undated)
Related
- Data protection fines reduced or cancelled on appeal
Court rulings that cut, cancelled or upheld privacy fines in Germany, France, Luxembourg, Italy, Ireland, the UK and South Korea, with dates.
- How GDPR fines are calculated
The GDPR fine ceilings, the Article 83 factors and the EDPB five-step method, with seriousness levels, turnover bands and real decisions.
- EU data protection authorities compared
Complaints, fines, breach notices, staff growth and handling times at EU data protection authorities, from the Commission and national annual reports.
- How long data protection investigations take
Legal deadlines and recorded timelines for data protection complaints, inquiries and court cases in the EU, Ireland, Norway, Australia and Canada.
- How Ireland's Data Protection Commission enforces the GDPR
The DPC's role as EU lead authority, its 2025 fines including the 530 million euro TikTok decision, and how the EDPB can require a higher fine.
- How the GDPR one-stop-shop works
How a single lead supervisory authority handles cross-border GDPR cases, how authorities cooperate and how the EDPB resolves disputes.