Big Tech companies have paid roughly EUR 4.06 billion in confirmed GDPR fines since the regulation took effect in May 2018, based on PrivacyTerms.io's compilation of finalized regulator decisions against Meta, TikTok, LinkedIn/Microsoft, and Google through August 2026. Meta accounts for more than two-thirds of that figure by itself, and a fifth company, Amazon, saw its EUR 746 million fine annulled on appeal in 2026, so it is tracked separately rather than folded into the confirmed total.
Figure 1: Big Tech's confirmed cumulative GDPR fine total since 2018. Source: PrivacyTerms.io compilation of Irish Data Protection Commission and CNIL decisions, verified through August 2026.
Below is the company-by-company breakdown, how the total has grown year by year, and why Amazon's fine no longer counts toward it.
Which Big Tech company has paid the most in GDPR fines?
Meta has paid far more than any other Big Tech company: roughly EUR 2.83 billion across seven finalized decisions from Ireland's Data Protection Commission between September 2021 and December 2024. TikTok is a distant second at EUR 875 million, followed by LinkedIn/Microsoft at EUR 310 million and Google at EUR 50 million.
Figure 2: Confirmed cumulative GDPR fines by Big Tech company, excluding Amazon's annulled fine. Source: Irish Data Protection Commission and CNIL decisions, 2019 to 2025.
Meta's single largest fine, EUR 1.2 billion for unlawful EU-to-US data transfers in May 2023, is bigger than TikTok, LinkedIn, and Google's entire combined totals put together. Meta's dominance is not just about one record fine either: five of its seven decisions individually exceed Google and LinkedIn's whole running totals. See our full breakdown of Meta's seven GDPR fines for the case-by-case detail behind that EUR 2.83 billion figure.
What happened to Amazon's EUR 746 million GDPR fine?
Amazon's EUR 746 million fine, issued by Luxembourg's CNPD in July 2021 over ad-personalization consent practices, was for years cited as the second-largest GDPR fine on record. That status changed twice. Luxembourg's first-instance tribunal upheld the fine in March 2025, but the country's higher Cour administrative annulled it in 2026 on procedural grounds, ruling that the CNPD had failed to properly assess whether Amazon's violations were intentional or negligent before setting the penalty amount.
Crucially, the appeals court did not clear Amazon of wrongdoing. It confirmed that most of the underlying GDPR violations the CNPD identified were real, and sent the case back to the regulator to reassess the fine amount rather than dismissing the matter outright. Because the euro figure itself is no longer a settled penalty, this post excludes it from Big Tech's EUR 4.06 billion confirmed total and tracks it separately: treat EUR 746 million as a historical reference point under active reconsideration, not a fixed fine.
If the CNPD reinstates a fine anywhere near the original amount, Big Tech's confirmed total would jump to roughly EUR 4.81 billion. As of August 2026, no reassessed figure has been published.
How has enforcement against Big Tech grown since 2018?
Big Tech's confirmed GDPR total went from EUR 50 million at the end of 2019, Google's lone fine, to EUR 4.06 billion by the end of 2025. Growth was not steady: the total barely moved for two years, then nearly tripled in 2023 alone once Meta's record transfer fine and TikTok's first fine both landed.
Figure 3: Big Tech's cumulative confirmed GDPR fine total by year end, 2019 to 2025. Source: PrivacyTerms.io compilation of Irish Data Protection Commission and CNIL decisions.
Nearly three-quarters of the entire 2019-2025 total landed in just two years, 2023 and 2024, when six of the eleven confirmed fines were issued. None of that enforcement activity is exclusive to platforms the size of Meta or TikTok: the same legal-basis, transparency, and international transfer failures that triggered these fines are exactly what a privacy policy generator built for GDPR is meant to catch before a regulator does, regardless of how large or small the business behind the policy is.
How does each company's total compare, then and now?
At the end of 2022, before Meta's record transfer fine and before TikTok or LinkedIn had received any GDPR penalty at all, Amazon's EUR 746 million fine was still the largest confirmed total among this group. Three years later, Meta and TikTok had both overtaken it by wide margins.
Figure 4: Cumulative GDPR fine totals per company, end of 2022 versus end of 2025. Source: Irish Data Protection Commission and CNPD Luxembourg decisions.
Google and LinkedIn's totals barely moved in that window by comparison: Google has not received a new GDPR fine since its original 2019 case, and LinkedIn's only fine to date landed in October 2024. Amazon's line stays flat too, but for a different reason: its total has not grown because the underlying fine has been in legal limbo since being upheld and then annulled in successive court rulings.
What share of all GDPR fines does Big Tech account for?
Big Tech's EUR 4.06 billion confirmed total equals roughly 66.5% of the EUR 6.11 billion the CMS Enforcement Tracker Report counts in confirmed, publicly documented GDPR cases through its 1 March 2026 cutoff. That means four companies, out of the thousands of organizations that have received a GDPR fine since 2018, account for two out of every three confirmed euros.
Figure 5: Big Tech's share of the CMS Enforcement Tracker Report's EUR 6.11 billion confirmed cumulative GDPR total. Source: CMS Enforcement Tracker Report 2026, cutoff 1 March 2026.
Measured against DLA Piper's broader EUR 7.1 billion estimate, which also folds in fines reported through the firm's own network of European data protection lawyers, Big Tech's share is closer to 57%. Either denominator tells the same story: a small number of large platforms account for most of the money regulators have actually collected under GDPR, even though they represent a tiny fraction of the organizations fined.
How does each Big Tech company's GDPR total break down?
| Company | Confirmed total | Fines | Status |
|---|---|---|---|
| Meta (incl. WhatsApp, Instagram, Facebook) | EUR 2,827M | 7 | All finalized |
| TikTok | EUR 875M | 2 | Both finalized |
| LinkedIn / Microsoft | EUR 310M | 1 | Finalized |
| EUR 50M | 1 | Finalized | |
| Total (4 companies) | EUR 4,062M | 11 | -- |
| Amazon (not in total) | EUR 746M | 1 | Annulled, remanded 2026 |
Source: Irish Data Protection Commission, CNIL, and CNPD Luxembourg decisions, compiled by PrivacyTerms.io. Amazon's row is excluded from the EUR 4,062 million total because its fine is no longer a settled penalty as of this post's last data check.
Eleven confirmed, finalized fines across just four companies add up to roughly EUR 4.06 billion, which is the clearest evidence that GDPR enforcement against the largest technology platforms is concentrated in a handful of decisions rather than spread evenly across the industry.
The Bottom Line
EUR 4.06 billion is the correct confirmed total for GDPR fines against Big Tech since 2018, built from eleven finalized decisions against Meta, TikTok, LinkedIn/Microsoft, and Google. Meta's EUR 2.83 billion share dwarfs the other three companies combined, and Amazon's EUR 746 million fine, once the second-largest on record, no longer belongs in a "confirmed" total after its 2026 annulment. The underlying pattern regulators keep finding, unclear legal basis for advertising, weak transfer safeguards, and thin transparency disclosures, is the same pattern any company's privacy policy needs to address, whatever the company's size.
Frequently Asked Questions
How much have Big Tech companies paid in GDPR fines since 2018? Roughly EUR 4.06 billion combined across Meta, TikTok, LinkedIn/Microsoft, and Google, based on PrivacyTerms.io's compilation of confirmed regulator decisions from 2018 through August 2026. That figure excludes Amazon's EUR 746 million fine, which a Luxembourg appeals court annulled in 2026.
Which Big Tech company has paid the most in GDPR fines? Meta, at roughly EUR 2.83 billion across seven finalized decisions from Ireland's Data Protection Commission between September 2021 and December 2024, more than triple the combined total of every other Big Tech company on this list.
What happened to Amazon's EUR 746 million GDPR fine? Luxembourg's first-instance tribunal upheld it in March 2025, but the country's higher Cour administrative annulled the fine in 2026 on procedural grounds and sent the case back to the CNPD to reconsider, while confirming that most of the underlying GDPR violations were real.
What share of all GDPR fines does Big Tech account for? About 66.5 percent of the CMS Enforcement Tracker Report's EUR 6.11 billion confirmed cumulative total as of its March 2026 cutoff, concentrated in just four companies out of thousands of fined organizations.
Where the Numbers Come From
- DLA Piper. (2026). "GDPR Fines and Data Breach Survey: January 2026." Cumulative global total EUR 7.1 billion since 25 May 2018, data through 10 January 2026, used as the broader denominator for Big Tech's share.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Numbers and Figures." 2,685 fines, EUR 6.11 billion cumulative confirmed total, cutoff 1 March 2026, used as the primary denominator for Big Tech's 66.5% share.
- Data Protection Commission Ireland. (2023). "Data Protection Commission Announces Conclusion of Inquiry into Meta Ireland." EUR 1.2 billion fine over EU-US data transfers, decision 12 May 2023.
- Data Protection Commission Ireland. (2021). "Data Protection Commission Announces Decision in WhatsApp Inquiry." EUR 225 million fine, 2 September 2021.
- Data Protection Commission Ireland. (2022). "Data Protection Commission Announces Decision in Instagram Inquiry." EUR 405 million fine, 15 September 2022.
- Data Protection Commission Ireland. (2024). "Irish Data Protection Commission Fines LinkedIn Ireland EUR310 Million." 24 October 2024.
- Data Protection Commission Ireland. (2023). "DPC Announces EUR345 Million Fine of TikTok." 15 September 2023.
- Data Protection Commission Ireland. (2025). "Irish Data Protection Commission Fines TikTok EUR530 Million." 2 May 2025.
- European Data Protection Board. (2019). "The CNIL's Restricted Committee Imposes a Financial Penalty of 50 Million Euros Against Google LLC." Decision SAN-2019-001, 21 January 2019.
- MLex. (2026). "Amazon Sees Luxembourg Appeals Court Annul EUR746 Million GDPR Fine." Fine annulled and remanded for reconsideration, March 2026.
Note: All figures verified as of August 2026. Big Tech's EUR 4.06 billion confirmed total is PrivacyTerms.io's own compilation of eleven finalized regulator decisions and excludes Amazon's EUR 746 million fine, which remains under active reconsideration following the 2026 Luxembourg appeals court ruling. This total is refreshed at least twice a year to track new Irish Data Protection Commission decisions and CMS Enforcement Tracker Report editions.
