![Biggest GDPR Fines of All Time: Top 50 Ranked [2026]](/_astro/gdpr-compliance-badge.BVq2lnz4_19NLuJ.webp){kind=icon}
The biggest GDPR fine ever issued is EUR 1.2 billion, against Meta Platforms Ireland Limited in May 2023, according to Ireland's Data Protection Commission and confirmed by enforcementtracker.com and the CMS Enforcement Tracker Report 2026. That single fine over unlawful EU-to-US data transfers is more than double the next-largest confirmed penalty, and it anchors a top 50 list dominated almost entirely by large technology platforms.
Below is the ranked top 10, the full context on how far the top 50 extends, which regulator issues the biggest fines, and why one of the top figures on this list is now under active legal reconsideration rather than settled.
Figure 1: The 10 largest confirmed GDPR fines by amount. Source: DPC Ireland press releases, Luxembourg CNPD, Dutch Autoriteit Persoonsgegevens, compiled via the CMS Enforcement Tracker Report 2026.
What is the biggest GDPR fine ever?
The record fine is EUR 1.2 billion, issued by Ireland's Data Protection Commission against Meta Platforms Ireland Limited on 22 May 2023. The fine followed a binding decision from the European Data Protection Board and concerned Meta's transfer of EU user data to the United States without a valid legal transfer mechanism after the Court of Justice of the EU struck down the previous Privacy Shield framework.
The fine has stood unchallenged at the top of every major GDPR fine tracker since it was issued, and it remains the record as of July 2026. It is roughly 60% larger than the next-highest figure on the list, the disputed EUR 746 million Amazon fine, and more than double the third-place EUR 530 million fine against TikTok. No later fine, including TikTok's May 2025 penalty, has come close to displacing it.
One-line takeaway: the record fine has held for more than three years and is unlikely to be surpassed by any single decision currently under investigation.
Which companies have the most GDPR fines on this list?
Big Tech platforms occupy every position in the top 10. Meta alone appears three times, once each for Facebook, Instagram, and a separate 2022 data-scraping breach, and its three fines total roughly EUR 1.86 billion on their own. TikTok appears twice, with a EUR 530 million fine in 2025 over China data transfers and a EUR 345 million fine in 2023 over how it handled children's accounts.
Amazon, LinkedIn, Uber, and WhatsApp each hold one of the remaining top-10 spots. All 10 fines were issued against companies with hundreds of millions of active users, which reflects how GDPR's Article 83 caps work: the higher statutory ceiling is 4% of a company's global annual turnover, so only companies with very large revenue bases can generate a fine in the hundreds of millions or billions, regardless of how severe a smaller company's violation might be.
Below the top 10, the fines drop off quickly. The full top-50 list, per enforcementtracker.com's live database, runs from the EUR 1.2 billion record down to roughly EUR 3 million to 5 million by the 50th position, a range dominated by national telecom operators, banks, and mid-size adtech and retail companies rather than global platforms.
One-line takeaway: the biggest fines cluster almost entirely around a handful of platforms large enough to make the percentage-of-turnover cap meaningful.
Figure 2: Combined value of the top 10 fines grouped by company. Source: DPC Ireland, Luxembourg CNPD, Dutch AP, compiled July 2026.
How much are the top 10 GDPR fines worth in total?
The top 10 confirmed GDPR fines add up to roughly EUR 4.79 billion, based on DPC Ireland press releases, the Luxembourg CNPD's 2021 decision, the Dutch Autoriteit Persoonsgegevens, and the CMS Enforcement Tracker Report 2026. That figure represents close to 80% of the CMS Enforcement Tracker Report's entire EUR 6.11 billion cumulative total across more than 2,685 recorded cases, meaning 10 decisions account for the large majority of all GDPR fine value ever issued.
Ireland's Data Protection Commission issued 7 of these 10 fines, worth roughly EUR 3.75 billion combined, because Ireland is the lead regulator under GDPR's one-stop-shop mechanism for any company with its EU headquarters there, including Meta, TikTok, and LinkedIn. If your site handles EU user data and has not reviewed its legal basis for advertising or its cross-border transfer mechanism since before 2023, when the largest of these fines landed, you can generate a GDPR-ready privacy policy that documents legal basis, retention, and transfer safeguards in the format regulators check first.
One-line takeaway: 10 decisions, mostly from one regulator, account for roughly 4 out of every 5 euros ever collected in GDPR fines.
| Rank | Company | Fine (EUR) | Regulator | Year |
|---|---|---|---|---|
| 1 | Meta Platforms Ireland | 1.2 billion | Ireland DPC | 2023 |
| 2 | Amazon Europe Core (disputed) | 746 million | Luxembourg CNPD | 2021 |
| 3 | TikTok | 530 million | Ireland DPC | 2025 |
| 4 | Instagram (Meta) | 405 million | Ireland DPC | 2022 |
| 5 | Meta Platforms Ireland | 390 million | Ireland DPC | 2023 |
| 6 | TikTok | 345 million | Ireland DPC | 2023 |
| 7 | LinkedIn Ireland | 310 million | Ireland DPC | 2024 |
| 8 | Uber | 290 million | Netherlands AP | 2024 |
| 9 | Meta Platforms Ireland | 265 million | Ireland DPC | 2022 |
| 10 | WhatsApp Ireland | 225 million | Ireland DPC | 2021 |
Which regulator issued the biggest fines?
Ireland's Data Protection Commission issued 7 of the top 10 fines on this list and holds the highest cumulative GDPR fine value of any regulator worldwide, at roughly EUR 4.04 billion, per the CMS Enforcement Tracker Report 2026. That is close to 66% of the report's entire EUR 6.11 billion documented total, concentrated in a small number of decisions against companies headquartered in Ireland for EU purposes.
Luxembourg's CNPD and the Dutch Autoriteit Persoonsgegevens hold one top-10 fine each, against Amazon and Uber respectively, both concerning international data transfer violations rather than consent or advertising practices. No other national regulator, including France's CNIL, which issued the EUR 50 million Google fine in 2019 that was one of GDPR's earliest large penalties, has come close to a top-10 figure since enforcement against major platforms consolidated in Ireland from 2021 onward.
One-line takeaway: fine size correlates with which regulator has jurisdiction over the largest platforms, not with how strictly a country enforces GDPR overall.
Figure 3: Which regulator issued each of the top 10 fines, by combined value. Source: CMS Enforcement Tracker Report 2026, DPC Ireland, Luxembourg CNPD, Netherlands AP.
Are the biggest fines being upheld on appeal?
Mostly yes, but not universally, and the one exception involves the list's second-largest figure. The EUR 746 million fine against Amazon, issued by Luxembourg's CNPD in July 2021 over ad-personalization consent practices, was upheld by Luxembourg's Administrative Court in 2025, then annulled by the same court on 12 March 2026 on procedural grounds: the court found the CNPD had not properly assessed whether Amazon's violation was intentional or negligent, and had not sufficiently weighed a more lenient measure before setting the fine. The underlying GDPR violation was not overturned, only the fine amount and process, and the case now returns to the CNPD to reassess.
Every other fine in the top 10 has either been paid, is under an ordinary appeal that has not disturbed the amount, or remains within its standard appeal window as of July 2026. Meta's EUR 1.2 billion fine, TikTok's two fines, and LinkedIn's EUR 310 million fine have all been contested by the companies involved but none has been reduced or annulled. Treat the Amazon EUR 746 million figure as unsettled rather than a confirmed historical rank until the CNPD issues a new decision.
One-line takeaway: 9 of the top 10 fines stand as issued, and only the disputed Amazon case has actually been sent back for a new number.
Figure 4: How a contested GDPR fine, like Amazon's, can be annulled and remanded rather than simply upheld or struck down. Source: Luxembourg Administrative Court ruling, March 2026, as reported by MLex.
Figure 5: When each of the top 10 fines was issued. Source: DPC Ireland press releases, Luxembourg CNPD, Netherlands AP.
The Bottom Line
The EUR 1.2 billion Meta fine has held the top spot for more than three years, and the list around it has barely changed shape: 7 of the top 10 fines come from Ireland's DPC, all 10 target large technology platforms, and the combined EUR 4.79 billion these 10 decisions represent is close to 80% of every euro in GDPR fines ever recorded. The one real shake-up is procedural rather than substantive. Amazon's EUR 746 million fine, long treated as the number-two spot, is back with the regulator for a new decision after a 2026 appeals ruling, which means the current top 10 could look different by the time Luxembourg's CNPD issues a revised figure. For most sites, the more useful signal from this list is not the size of the record fine but the recurring violation categories behind it: unlawful data transfers, weak legal basis for advertising, and unclear consent, all of which a current privacy policy and consent flow can directly address. For the fuller enforcement picture beyond just the top 50, including averages and year-over-year totals, see our GDPR fines statistics breakdown.
Frequently Asked Questions
What is the biggest GDPR fine of all time? The EUR 1.2 billion fine against Meta Platforms Ireland Limited, issued by Ireland's Data Protection Commission in May 2023 over unlawful EU-to-US data transfers, is the largest GDPR fine on record as of July 2026, per enforcementtracker.com and the CMS Enforcement Tracker Report 2026.
How much are the top 10 GDPR fines worth combined? The top 10 confirmed GDPR fines total roughly EUR 4.79 billion, led by the EUR 1.2 billion Meta fine, per figures compiled from DPC Ireland press releases and the CMS Enforcement Tracker Report 2026.
Is the Amazon EUR 746 million GDPR fine still the second biggest? Not settled. Luxembourg's Administrative Court annulled the EUR 746 million fine against Amazon on procedural grounds in March 2026 and sent the case back to the CNPD, so the figure is under active reconsideration rather than confirmed at its original rank as of July 2026.
Which regulator has issued the most of the biggest GDPR fines? Ireland's Data Protection Commission issued 7 of the top 10 confirmed GDPR fines, worth roughly EUR 3.75 billion combined, because it is the lead regulator for Meta, TikTok, LinkedIn, and other companies with EU headquarters in Ireland under GDPR's one-stop-shop mechanism.
Where the Numbers Come From
- Data Protection Commission Ireland. (2023). "Data Protection Commission Announces Conclusion of Two Inquiries into Meta Ireland." EUR 1.2 billion fine over EU-US data transfers, 22 May 2023.
- enforcementtracker.com. Live GDPR fines database, 3,202 recorded actions, EUR 6.31 billion cumulative, checked July 2026.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Numbers and Figures." 2,685 fines, EUR 6.11 billion cumulative, Ireland's share roughly EUR 4.04 billion.
- MLex. (2026). "Amazon Sees Luxembourg Appeals Court Annul EUR746 Million GDPR Fine." Fine annulled and remanded for reconsideration, 12 March 2026.
- Data Protection Commission Ireland. (2025). "Irish Data Protection Commission Fines TikTok EUR530 Million." 2 May 2025.
- Data Protection Commission Ireland. (2022). "Data Protection Commission Announces Decision in Instagram Inquiry." EUR 405 million fine, 15 September 2022.
- Data Protection Commission Ireland. (2023). "Data Protection Commission Announces Conclusion of Two Inquiries into Meta Ireland." EUR 390 million fine over ad consent, 4 January 2023.
- Data Protection Commission Ireland. (2023). "DPC Announces EUR345 Million Fine of TikTok." 15 September 2023.
- Goodwin Law. (2024). "Irish DPC Fines LinkedIn EUR310M for GDPR Violations." Decision dated 24 October 2024.
- Autoriteit Persoonsgegevens. (2024). "Dutch DPA Imposes a Fine of 290 Million Euro on Uber." Decision over unlawful US data transfers, 22 August 2024.
- Data Protection Commission Ireland. (2021). "Data Protection Commission Announces Decision in WhatsApp Inquiry." EUR 225 million fine, 2 September 2021.
Note: All figures verified as of July 2026. The Amazon EUR 746 million fine is under active reconsideration following a March 2026 Luxembourg Administrative Court ruling and may change before this post's next refresh. Rankings below the top 10 are drawn from enforcementtracker.com's live database and are refreshed at least twice a year.
