AI companies have paid at least €95.5 million in confirmed privacy fines across 5 enforcement cases since 2022, according to PrivacyTerms.io's compilation of European Union regulators' published decisions against Clearview AI and Replika developer Luka Inc. That figure is a floor, not a ceiling: it excludes Italy's annulled €15 million fine against OpenAI and the UK's still-contested £7.5 million case against Clearview AI, both unresolved as of 2026.
How much have AI companies paid in privacy fines so far?
€95.5 million is the combined total of 5 confirmed, non-overturned enforcement fines that European Union data protection regulators have issued against AI companies since 2022, based on each regulator's own published decision. Every case in that total involves either facial recognition AI (Clearview AI) or a generative-AI chatbot (Replika), and every fine has either been paid, upheld on appeal, or never appealed at all.
Coverage of AI enforcement tends to lead with the biggest single headline number rather than what has actually survived legal review, which is why this tracker separates confirmed fines from the disputed ones further down. Overall AI adoption inside privacy and compliance programs has moved much faster than enforcement has; see our broader AI and privacy statistics for 2026 for adoption and governance figures across the same period.
Which AI privacy fines are confirmed versus still disputed?
Two of the highest-profile AI privacy cases did not survive legal challenge, and PrivacyTerms.io's €95.5 million confirmed total excludes both. Italy's Garante fined OpenAI €15 million in November 2024 for processing ChatGPT training data without a valid legal basis, alongside transparency and age-verification failures, but the Court of Rome annulled the entire decision on March 18, 2026. The court ruled that once OpenAI established an Irish subsidiary in 2024, the Irish Data Protection Commission became the lead supervisory authority under the GDPR's one-stop-shop mechanism, so the Garante no longer had jurisdiction to act alone.
Figure 1: Confirmed AI privacy fines by year. No new confirmed fines were issued in 2023 or 2026 through the third quarter. Source: PrivacyTerms.io compilation of Dutch, French, Greek, and Italian regulator decisions.
The UK case against Clearview AI followed a similarly rocky path. The Information Commissioner's Office fined Clearview AI £7.5 million in 2022, but a First-tier Tribunal reversed that decision in October 2023, ruling Clearview's processing fell outside UK GDPR's jurisdiction. An Upper Tribunal then ruled in the ICO's favor on October 7, 2025, finding the lower tribunal had erred in law, and sent the case back for reconsideration. As of 2026, the £7.5 million penalty is not yet a confirmed, collected fine.
Two of the largest headline numbers in AI privacy enforcement are currently worth zero dollars collected, which is the clearest sign that a running tracker needs to separate confirmed fines from contested ones.
Which company has been fined the most for AI privacy violations?
Clearview AI has paid or been ordered to pay €90.5 million across 4 confirmed fines from separate European regulators between February 2022 and September 2024, making it responsible for 94.8% of every confirmed AI privacy fine euro tracked here. Each case targeted the same underlying conduct: scraping billions of facial images from the public internet without a legal basis and selling access to the resulting biometric database.
Figure 2: Share of the €95.5 million confirmed total by company. Source: PrivacyTerms.io compilation of Autoriteit Persoonsgegevens, CNIL, Garante, and Hellenic DPA decisions.
Replika developer Luka Inc. is the only other company with a confirmed fine, at €5 million, and the only one whose case centers on a generative AI chatbot rather than facial recognition. Italy's Garante found in May 2025 that Luka had no valid legal basis for processing Replika users' data and no working age-verification system to keep minors off the platform.
How do individual AI privacy fines rank by size?
The Netherlands issued the single largest confirmed AI privacy fine on record: €30.5 million against Clearview AI in September 2024, with an additional penalty of up to €5.1 million still pending if the company does not comply. Italy, France, and Greece each fined Clearview AI exactly €20 million in separate 2022 decisions, an unusual pattern that reflects similar facts reaching similar conclusions in three different national proceedings.
Figure 3: All 5 confirmed AI privacy fines, ranked by amount. Source: PrivacyTerms.io compilation of the named regulators' published decisions.
None of these companies had a current privacy policy that disclosed the scale or legal basis of the data processing regulators eventually penalized. A privacy policy generator that covers AI training and profiling disclosures keeps that language current before a regulator has to ask for it, which is a far cheaper fix than an eight-figure fine.
Which regulators have issued the most AI privacy fines?
The Dutch data protection authority holds the record for a single AI privacy fine at €30.5 million, but Italy's Garante has issued the most total euros across two separate companies once its €20 million Clearview AI fine and €5 million Replika fine are combined, for €25 million cumulative. France's CNIL and Greece's Hellenic DPA each account for €20 million on their own.
Figure 4: Cumulative confirmed AI privacy fines by regulator. Source: PrivacyTerms.io compilation of each regulator's published decisions.
Regulatory enforcement has lagged well behind the pace of AI-specific lawmaking. US states alone enacted well over a hundred AI-related bills in 2025; see our count of how many AI-related bills passed in 2025 for how much legislative activity has outpaced confirmed enforcement dollars so far.
Has the United States fined an AI company for privacy violations?
Not with a direct AI-specific monetary fine, but the FTC has been active on the non-monetary side. In December 2023, the FTC banned Rite Aid from using facial recognition or analysis technology for security or surveillance purposes for 5 years, after finding the retailer's AI system disproportionately misidentified women and people of color as shoplifters, without imposing a monetary penalty. In November 2024, the FTC filed a similar no-fine settlement against Evolv Technologies over deceptive claims about its AI weapons-detection accuracy.
The closest US parallel to a monetary AI-related privacy fine is Amazon's $25 million civil penalty in May 2023, paid to resolve FTC and Department of Justice allegations that Alexa retained children's voice recordings and geolocation data indefinitely in violation of COPPA. That case involved an AI voice assistant's data retention practices rather than a generative-AI model directly, so it sits at the edge of, not inside, this tracker's core AI enforcement count.
How does each confirmed AI privacy fine compare to the total?
| Company | Regulator | Fine | Status |
|---|---|---|---|
| Clearview AI | Netherlands AP | €30.5M | Confirmed, Sep 2024 |
| Clearview AI | Italy Garante | €20M | Confirmed, Feb 2022 |
| Clearview AI | France CNIL | €20M | Confirmed, Oct 2022 |
| Clearview AI | Greece HDPA | €20M | Confirmed, Jul 2022 |
| Replika / Luka Inc | Italy Garante | €5M | Confirmed, May 2025 |
| OpenAI | Italy Garante | €15M | Annulled, Mar 2026 |
| Clearview AI | UK ICO | £7.5M | Contested since 2022 |
| Total confirmed (5 cases) | -- | €95.5M | -- |
Source: PrivacyTerms.io compilation of each named regulator's published enforcement decision, current through 2026.
Five confirmed cases in four years is a small dataset next to overall GDPR enforcement, but it is also an undercount waiting to grow: both the OpenAI and UK Clearview AI cases remain live, and either one could add €15 million to £7.5 million back onto this tracker depending on how their appeals resolve.
The Bottom Line
€95.5 million in confirmed AI privacy fines since 2022 is a modest number next to overall GDPR enforcement, which has topped €7 billion cumulative over the same period, and that gap is the real story here: regulators are still working out whether existing privacy law even reaches generative AI cleanly, and two of the largest attempted fines against AI companies have already been thrown out on jurisdictional grounds. Facial recognition enforcement against Clearview AI is the one settled exception, with €90.5 million collected or ordered across four countries. Companies building AI features into a product should read that split as a warning rather than reassurance: a fine that eventually gets thrown out on procedure still costs years of legal exposure, and a current privacy policy that discloses AI training and profiling in plain language remains the cheapest way to avoid becoming the next contested case.
Frequently Asked Questions
How much have AI companies paid in confirmed privacy fines? At least €95.5 million across 5 confirmed enforcement cases since 2022, per PrivacyTerms.io's compilation of European Union regulators' published decisions against Clearview AI and Replika developer Luka Inc., current through 2026.
Which company has paid the most in AI privacy fines? Clearview AI, with €90.5 million across 4 confirmed fines from regulators in Italy, France, Greece, and the Netherlands between 2022 and 2024, which is 94.8% of the €95.5 million confirmed total.
Was OpenAI fined for ChatGPT privacy violations? Yes, but the fine did not survive. Italy's Garante fined OpenAI €15 million in November 2024 over ChatGPT's training data practices, the largest single generative-AI privacy fine ever issued, but the Court of Rome annulled it on March 18, 2026, ruling the Garante lacked jurisdiction once OpenAI's Irish subsidiary became the lead authority.
Has the United States fined an AI company for privacy violations? Not yet with a direct AI-specific monetary fine. The FTC banned Rite Aid from using facial recognition for 5 years in December 2023 over algorithmic bias, and secured a $25 million penalty against Amazon in 2023 tied to Alexa's handling of children's voice data.
Where the Numbers Come From
- Autoriteit Persoonsgegevens (Dutch DPA). (2024). "Dutch DPA Imposes a Fine on Clearview Because of Illegal Data Collection for Facial Recognition." €30.5 million fine, September 2024, the largest single confirmed AI privacy fine in this tracker.
- CNIL (France). (2022). "Facial Recognition: 20 Million Euros Penalty Against Clearview AI." October 17, 2022 decision.
- European Data Protection Board. (2022). "Facial Recognition: Italian SA Fines Clearview AI EUR 20 Million." February 10, 2022 decision summary.
- Hellenic Data Protection Authority. (2022). "Imposition of Fine on Clearview AI, Inc." €20 million decision, July 13, 2022.
- Garante per la Protezione dei Dati Personali (Italy). (2025). "AI: Il Garante Sanziona la Societa Che Gestisce il Chatbot Replika." €5 million fine against Luka Inc., May 19, 2025.
- Wilson Sonsini. (2026). "OpenAI Prevails in Landmark Italian AI and GDPR Enforcement Case." Analysis of the Court of Rome's March 18, 2026 annulment of the €15 million Garante fine.
- Clifford Chance. (2025). "The Reach of GDPR and the Breadth of Behavioural Monitoring." Summary of the Upper Tribunal's October 7, 2025 ruling reviving the ICO's case against Clearview AI.
- Federal Trade Commission. (2023). "Rite Aid Banned From Using AI Facial Recognition." December 19, 2023 settlement, 5-year ban with no monetary penalty.
- US Department of Justice. (2023). "Amazon Agrees to Injunctive Relief and $25 Million Civil Penalty for Alleged Violations of Children's Privacy Law Relating to Alexa." May 31, 2023 settlement.
Note: All figures verified as of October 2026. The €95.5 million confirmed total is PrivacyTerms.io's own compilation of the 5 fines listed above that have neither been annulled nor remain under active appeal; the OpenAI and UK Clearview AI cases are tracked separately because their outcomes are not yet final. This tracker is refreshed at least twice a year as regulators issue new decisions or appeals resolve.
