GDPR Fines Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: October 15, 2026 | License: CC BY 4.0
Axis Intelligence Research tracked all 20 GDPR enforcement actions of €40 million or more and traced each to its regulator or court record: together they total €6.63 billion, yet only €90 million — 1.36% — has reached legal finality. That is the Axis Fine Finality Ratio (FFR). In Ireland, which imposed most of that value, €20.08 million of €4.44 billion has been collected.
Quick Answer
The largest GDPR fine remains Meta’s €1.2 billion (Irish DPC, May 2023), followed by Uber’s €824.99 million (Dutch AP, August 2026) and Google’s €403 million (Irish DPC, September 2026). Axis Intelligence Research finds that 87.39% of the value of every €40M+ GDPR fine is still under appeal, unconfirmed or otherwise open; 11.25% was annulled (Amazon’s €746 million, March 2026); and 1.36% is final.
Key Findings
- Axis Intelligence Research finds a Fine Finality Ratio (FFR) of 1.36%: of €6.63 billion in GDPR fines of €40 million or more, only €90 million (Google LLC 2019, Criteo 2023) is final after court review, as of October 15, 2026.
- Ireland’s Data Protection Commission has imposed €4,441,832,000 in fines and collected about €20 million, according to its fines register last updated September 21, 2026 — an Axis Collection Realization Rate (CRR) of 0.45%.
- Axis Intelligence Research measured a median 43-month Inquiry-to-Fine Lag (IFL) across 11 Irish DPC decisions of €40 million or more; Google’s €403 million location-data fine took 79 months from inquiry launch.
- Meta’s group companies (Meta Platforms Ireland and WhatsApp) account for €2.83 billion, or 42.63%, of all GDPR fines of €40 million or more, per Axis Intelligence Research’s verified ledger.
- Four GDPR actions of €40 million or more have been announced in 2026, totalling €1.37 billion — Uber, Google, Yango and Free/Free Mobile — according to Axis Intelligence Research’s ledger as of October 15, 2026.
What Are the Largest GDPR Fines of All Time?
Twenty enforcement actions have crossed €40 million since the GDPR became enforceable. The ledger below lists every one Axis Intelligence Research could trace to a regulator or court record, ranked by the amount originally imposed, with its legal status on October 15, 2026.
Every GDPR Fine of €40 Million or More (Status as of October 15, 2026)
| # | Organisation | Authority | Decision date | Fine (€) | Status | Source |
|---|---|---|---|---|---|---|
| 1 | Meta Platforms Ireland — EU-US transfers | DPC (IE) | 2023-05-12 | 1,200,000,000 | Pending appeal | DPC register |
| 2 | Uber — automated driver deactivation | AP (NL) | 2026-08-21 | 824,990,000 | Appeal filed | EDPB |
| 3 | Amazon Europe Core — behavioural advertising | CNPD (LU) | 2021-07-15 | 746,000,000 | Annulled 2026-03-12, remitted | Luxembourg Administrative Court |
| 4 | TikTok — EEA-to-China transfers | DPC (IE) | 2025-04-30 | 530,000,000 | Pending appeal | DPC register |
| 5 | Meta — Instagram children’s data | DPC (IE) | 2022-09-02 | 405,000,000 | Pending appeal | DPC register |
| 6 | Google Ireland — location data | DPC (IE) | 2026-09-21 | 403,000,000 | Not confirmed | DPC |
| 7 | Meta — Facebook/Instagram legal basis | DPC (IE) | 2022-12-31 | 390,000,000 | Pending appeal | DPC register |
| 8 | TikTok — children’s data | DPC (IE) | 2023-09-01 | 345,000,000 | Pending appeal | DPC register |
| 9 | LinkedIn — behavioural advertising | DPC (IE) | 2024-10-22 | 310,000,000 | Pending appeal | DPC register |
| 10 | Uber — driver data transfers to the US | AP (NL) | 2024-07-22 | 290,000,000 | Contested | CNIL |
| 11 | Meta — dataset scraping | DPC (IE) | 2022-11-25 | 265,000,000 | Pending appeal | DPC register |
| 12 | Meta — token breach | DPC (IE) | 2024-12-17 | 251,000,000 | Pending appeal | DPC register |
| 13 | WhatsApp — transparency | DPC (IE) | 2021-08-20 | 225,000,000 | Pending appeal | DPC register |
| 14 | MLU B.V. (Yango) — transfers to Russia | AP (NL) | 2026-05-08 | 100,000,000 | Challenge announced | AP |
| 15 | Meta — plaintext passwords | DPC (IE) | 2024-09-26 | 91,000,000 | Pending appeal | DPC register |
| 16 | Enel Energia — telemarketing | Garante (IT) | 2024-02-08 | 79,107,101 | Upheld at first instance; appeal pending | Garante |
| 17 | Google LLC — Android consent | CNIL (FR) | 2019-01-21 | 50,000,000 | Final (Conseil d’État, 2020) | Conseil d’État |
| 18 | Vodafone GmbH — partner agencies, authentication | BfDI (DE) | 2025-06-03 | 45,000,000 | No appeal reported | BfDI |
| 19 | Free Mobile and Free — data breach | CNIL (FR) | 2026-01-13 | 42,000,000 | Not reported | CNIL |
| 20 | Criteo — adtech consent | CNIL (FR) | 2023-06-15 | 40,000,000 | Final (Conseil d’État, 2026-03-04) | noyb (complainant) |
Dates are decision dates where the regulator publishes them; Uber 2026, Yango and Vodafone use announcement dates. Free Mobile (€27M) and Free (€15M) are two decisions announced as one action. Full provenance per row in the CSV.
Read the table from the right-hand column, not the left. Rank by amount and the story is Big Tech paying record penalties. Rank by status and the story inverts: two rows out of twenty say “final,” and both are French.
Marcus Chen’s read: The ranking every privacy deck reproduces measures what regulators announced. It says nothing about what a controller actually lost. A GDPR fine in Ireland is not payable until a court confirms it, and every Big Tech addressee on this list appealed. So the headline number is a claim on future cash, discounted by litigation risk — and the Amazon annulment shows that discount is not theoretical.
How Much of the GDPR Fine Total Has Actually Been Paid?
This is the question the fine rankings never answer, so Axis Intelligence Research built a metric for it.
The Axis Fine Finality Ratio (FFR)
FFR — Fine Finality Ratio: the share of the euro value of GDPR fines of €40 million or more that has reached legal finality (upheld by a court of last instance, or confirmed as collected), as of the snapshot date.
Formula: FFR = (value of ledger fines with status “final”) ÷ (total ledger value) × 100
Inputs (October 15, 2026): €90,000,000 final (Google LLC €50,000,000 + Criteo €40,000,000) ÷ €6,632,097,101 total = 1.36%
| Status bucket | Value (€) | Share of €40M+ fine value |
|---|---|---|
| Final | 90,000,000 | 1.36% |
| Annulled (Amazon, remitted to CNPD) | 746,000,000 | 11.25% |
| Open — pending appeal, appeal filed, not confirmed, first-instance only, or status not public | 5,796,097,101 | 87.39% |
| Total | 6,632,097,101 | 100% |
Source: Axis Intelligence Research ledger, built from DPC, AP, CNIL, CNPD, Garante, BfDI and court records. Formula and row-level statuses in the CSV (records L01–L20, AX05–AX08).
The FFR is deliberately conservative. Vodafone’s €45 million carries no reported appeal, and Free’s €42 million may never be challenged, but “nothing reported” is not finality, so neither counts until a regulator or court says so. If both were treated as settled, the ratio would still sit in the low single digits. The conclusion does not depend on the edge cases.
Ireland’s Collection Realization Rate (CRR)
Ireland is the cleanest test case because the DPC publishes a status for every fine. Axis Intelligence Research re-summed all 38 rows of the DPC fines register and matched the regulator’s stated total to the euro: €4,441,832,000.
| DPC register status | Value (€) | Share |
|---|---|---|
| Pending appeal | 4,018,050,000 | 90.46% |
| Not confirmed | 403,705,000 | 9.09% |
| Collected | 20,077,000 | 0.45% |
Source: Data Protection Commission fines register (total last updated 21/09/2026); shares calculated by Axis Intelligence Research.
CRR — Collection Realization Rate: collected value ÷ imposed value. For the DPC: €20,077,000 ÷ €4,441,832,000 = 0.45%.
The DPC explains why on the same page: under Ireland’s Data Protection Act 2018 a fine only becomes payable once a court confirms it, and an appeal freezes collection until it is resolved. The collected column is mostly Irish public bodies and banks; the only platform companies in it are Meta, with €17 million for twelve Facebook breaches in 2022, and Twitter, with €450,000 in 2020.
Marcus Chen’s read: The €20 million figure is not evidence that the DPC is soft. It is evidence of where the friction sits. Every large controller has priced in the appeal route, because the appeal route costs less than the fine. Until the appellate pipeline clears — and the CJEU’s February 2026 WhatsApp ruling opened a second front by letting companies attack EDPB binding decisions directly — the CRR is the number boards should model, not the headline.
Which Companies Have Paid the Most in GDPR Fines?
“Paid” is the wrong verb, as shown above, so the precise question is: which groups carry the most GDPR fine value?
GDPR Fine Value by Company Group (€40M+ actions)
| Group | Actions | Value imposed (€) | Share of ledger |
|---|---|---|---|
| Meta (Meta Platforms Ireland + WhatsApp) | 7 | 2,827,000,000 | 42.63% |
| Uber | 2 | 1,114,990,000 | 16.81% |
| TikTok | 2 | 875,000,000 | 13.19% |
| Amazon (annulled) | 1 | 746,000,000 | 11.25% |
| Google (Google Ireland 2026 + Google LLC 2019) | 2 | 453,000,000 | 6.83% |
| 1 | 310,000,000 | 4.67% | |
| All others (Yango, Enel, Vodafone, Free, Criteo) | 5 | 306,107,101 | 4.62% |
Source: Axis Intelligence Research ledger (CSV records L01–L20). Group totals and shares calculated from the ledger rows.
Meta’s seven actions alone outweigh the next three groups combined. Uber is the 2026 mover: two Dutch decisions now total €1.11 billion, making it the second-most-fined group in GDPR history by value — on decisions that are both still contested.
Which Regulator Imposes the Biggest GDPR Fines?
The Irish DPC issued €4.42 billion of the €6.63 billion ledger — 66.57% — because the one-stop-shop mechanism makes it lead authority for most US platforms with EU headquarters in Dublin. The Dutch AP is now the clear number two by value, with €1.21 billion across Uber and Yango. France’s CNIL issues large fines more steadily, and holds both of the ledger’s final rulings.
What Are the Biggest GDPR Fines of 2026?
Four actions above €40 million have been announced in 2026, totalling €1,369,990,000:
| Date | Organisation | Authority | Fine (€) | Infringement |
|---|---|---|---|---|
| 2026-01-13 | Free Mobile and Free | CNIL (FR) | 42,000,000 | Security after a subscriber-data breach |
| 2026-05-08 | MLU B.V. (Yango) | AP (NL) | 100,000,000 | Transfers of Norwegian and Finnish users’ data to Russia |
| 2026-08-21 | Uber | AP (NL) | 824,990,000 | Fully automated driver deactivation (Art. 22) and insufficient information |
| 2026-09-21 | Google Ireland | DPC (IE) | 403,000,000 | Lawfulness, transparency and retention of location data |
Sources: CNIL, Autoriteit Persoonsgegevens, EDPB, DPC — linked in the ledger above.
Below the €40 million line, the Italian Garante remained the most active large-fine issuer in autumn 2026: €7,000,000 against IQVIA for patients’ health data and €5,508,000 against BBVA for ignoring a customer’s objection to direct marketing, both published by the EDPB on October 9, 2026.
How Close Did Uber’s Fine Get to the 4% Maximum?
The AP stated that Uber’s 2025 global turnover was around €44.5 billion. Under Article 83(5) GDPR the ceiling is 4% of that: €1.78 billion. Axis Intelligence Research calculates that the €824.99 million fine used 46.3% of the available cap, using the regulator’s own turnover figure.
Marcus Chen’s read: The Uber decision is the one compliance teams should study, and it is not about transfers or cookies. It is the only fine in the €40M+ ledger built on Article 22 — a system that suspended accounts on fraud flags and rating thresholds with no human in the loop. Any organisation running automated account suspension, credit decisions or HR screening now has a priced precedent. With the AI Act’s obligations phasing in, expect DPAs to reach for Article 22 before AI Act penalties are even testable; our EU AI Act Compliance Tracker follows that overlap.
Why Do GDPR Fines Take So Long?
Axis Inquiry-to-Fine Lag (IFL)
IFL — Inquiry-to-Fine Lag: the number of months between the month an inquiry opened and the date of the final decision.
The DPC’s inquiry references encode the opening year and month (IN-YY–M–n). Axis Intelligence Research validated that reading against the three decisions where the DPC states the commencement date outright — LinkedIn (IN-18-08-3, opened August 20, 2018), Meta passwords (IN-19-4-1, April 24, 2019) and Meta EU-US transfers (IN-20-8-1, commenced August 2020) — and the code matched the stated month in each. Google’s 2026 decision has no published IN code; its start month comes from the DPC press release (inquiry launched February 2020).
| Decision | Inquiry opened | Decision | IFL (months) |
|---|---|---|---|
| Google Ireland — location data | 2020-02 | 2026-09 | 79 |
| LinkedIn — behavioural ads | 2018-08 | 2024-10 | 74 |
| Meta — token breach | 2018-10 | 2024-12 | 74 |
| Meta — plaintext passwords | 2019-04 | 2024-09 | 65 |
| Meta — Facebook/Instagram legal basis | 2018-05 | 2022-12 | 55 |
| TikTok — EEA-to-China transfers | 2021-09 | 2025-04 | 43 |
| Meta — EU-US transfers | 2020-08 | 2023-05 | 33 |
| WhatsApp — transparency | 2018-12 | 2021-08 | 32 |
| Meta — Instagram children | 2020-07 | 2022-09 | 26 |
| TikTok — children | 2021-09 | 2023-09 | 24 |
| Meta — dataset scraping | 2021-04 | 2022-11 | 19 |
Source: DPC decision pages and fines register; IFL calculated by Axis Intelligence Research. Median: 43 months.
Stack the two clocks. A median 43 months to reach a decision, then an appeal that — for the 2021 WhatsApp fine — has now run more than five years without collection. A controller fined today is often being sanctioned for a system it retired years earlier — Uber’s public response to its 2026 fine leaned on exactly that point.
The newest decision is also the slowest: Google’s IFL of 79 months is the longest in the ledger.
What Changed in How GDPR Fines Are Calculated in 2026?
Three legal shifts now shape every fine, and all three showed up in 2026 outcomes:
- Fault is a precondition. The CJEU ruled in Deutsche Wohnen (C-807/21) on December 5, 2023 that only an intentional or negligent infringement can be fined, and that turnover is measured at group level. Luxembourg’s Administrative Court annulled Amazon’s €746 million on March 12, 2026 largely because the CNPD’s 2021 decision never analysed fault — it predated the ruling.
- EDPB binding decisions are now directly challengeable. The CJEU’s February 10, 2026 judgment in WhatsApp v EDPB (C-97/23 P) sent WhatsApp’s challenge back to the General Court on the merits.
- A five-step test for whether to fine at all. On September 21, 2026 the EDPB adopted guidelines on the power to impose fines: legal basis, liable party, intent or negligence, aggravating/mitigating factors, and whether a fine is effective, proportionate and dissuasive. Consultation runs until November 13, 2026.
Marcus Chen’s read: Read together, these make the next generation of fines slower to issue and harder to overturn. The Amazon annulment did not touch the underlying finding — the court kept the conclusion that legitimate interest could not support the advertising processing. It struck the penalty because the reasoning skipped a step that only became mandatory later. Regulators have now written that step into their methodology.
What Kind of GDPR Violation Gets the Biggest Fine?
Axis Intelligence Research classified each €40M+ action by its core infringement:
| Infringement theme | Value (€) | Share | Examples |
|---|---|---|---|
| International transfers | 2,120,000,000 | 31.97% | Meta EU-US, TikTok China, Uber US, Yango Russia |
| Legal basis for advertising/profiling | 1,939,000,000 | 29.24% | Amazon, Meta, Google location, LinkedIn, Google LLC, Criteo |
| Automated decision-making (Art. 22) | 824,990,000 | 12.44% | Uber 2026 |
| Children’s data | 750,000,000 | 11.31% | Instagram, TikTok |
| Security and breaches | 694,000,000 | 10.46% | Meta scraping/tokens/passwords, Vodafone, Free |
| Transparency | 225,000,000 | 3.39% | |
| Telemarketing | 79,107,101 | 1.19% | Enel Energia |
Source: Axis Intelligence Research classification of ledger rows L01–L20; shares calculated from the CSV.
Transfers lead, and the 2026 Yango case extends the pattern beyond the US: standard contractual clauses were in place, and the AP still found the transfers to Russia unlawful. A signed SCC module is paperwork; the regulator tests whether the protection is essentially equivalent in practice.
Security failures are the theme that reaches beyond Big Tech: Vodafone and Free sit in the ledger next to Meta, and each case began as an incident that a security team, not a privacy team, handled first. Our data breach statistics and cybersecurity statistics by industry cover the incident side of that equation.
Are Google’s €325 Million and Shein’s €150 Million GDPR Fines?
No — and most fine rankings get this wrong. The CNIL fined Google €325 million and Shein €150 million in September 2025 primarily under French cookie (ePrivacy) rules transposed in the French Data Protection Act, not under the GDPR’s Article 83. Axis Intelligence Research excludes them from the GDPR ledger and records them separately in the CSV (records C11–C12). Counting them would inflate GDPR totals by €475 million and misstate which law creates the exposure: cookie enforcement under French law runs outside the GDPR one-stop-shop, which is why the CNIL — not the Irish DPC — could sanction Shein’s Irish subsidiary.
How Ireland’s GDPR Fines Have Moved Year by Year
| Decision year | DPC fines imposed (€) | Largest decision |
|---|---|---|
| 2020 | 785,000 | Twitter International (€450,000) |
| 2021 | 225,261,500 | WhatsApp (€225M) |
| 2022 | 1,077,583,000 | Instagram (€405M) |
| 2023 | 1,551,782,500 | Meta EU-US transfers (€1.2bn) |
| 2024 | 652,069,500 | LinkedIn (€310M) |
| 2025 | 530,773,000 | TikTok (€530M) |
| 2026 (to Oct 15) | 403,577,500 | Google (€403M) |
Source: DPC fines register; annual totals summed by Axis Intelligence Research. The 2025 sum matches the €530,773,000 in the DPC Annual Report 2025 exactly.
The DPC’s caseload is moving the other way. It received 16,160 new cases in 2025, a 45% rise on 2024, and concluded 208 cross-border complaints. Breach notifications fell to 6,521 — half of them mail sent to the wrong recipient. Fine value is concentrated in four large-scale inquiries a year; the volume is everywhere else.
Methodology
Scope. The ledger covers every GDPR enforcement action with an imposed fine of €40 million or more that Axis Intelligence Research could trace to a regulator press release, regulator register, or court record. One row equals one enforcement action as presented by the regulator (Meta’s €390 million comprises two decisions listed by the DPC as one row; Free and Free Mobile were announced as one €42 million action).
Sources. DPC fines register and decision pages; DPC Annual Report 2025; EDPB national-news register; Autoriteit Persoonsgegevens; CNIL; Garante; BfDI; Conseil d’État; CJEU press releases; EUR-Lex. Where a court document could not be fetched directly (Luxembourg Administrative Court, Irish High Court PDFs, Conseil d’État Criteo decision), the status is sourced to a named press or policy report and flagged is_primary = no in the CSV. No figure in this report comes from third-party fine trackers or law-firm surveys.
Status rules. Final = upheld by the court of last instance. Annulled = set aside by a court. Everything else is open: pending appeal or not confirmed (DPC register wording), appeal filed or challenge announced, upheld at first instance with appeal pending, or status not publicly reported.
Formulas.
- FFR = final value ÷ ledger value × 100 = 90,000,000 ÷ 6,632,097,101 × 100 = 1.36%
- CRR (DPC) = collected ÷ imposed × 100 = 20,077,000 ÷ 4,441,832,000 × 100 = 0.45%
- IFL = months(decision date − inquiry opening month); median across 11 DPC ledger decisions = 43
- Cap utilisation (Uber 2026) = 824,990,000 ÷ (0.04 × 44,500,000,000) × 100 = 46.3%
Exclusions. ePrivacy/cookie fines (Google €325M, Shein €150M); UK GDPR fines issued by the ICO; fines below €40 million (selected 2026 examples appear in context rows). Italy’s €15 million OpenAI fine was annulled by the Tribunale di Roma on March 18, 2026 on one-stop-shop competence grounds and is recorded as context (C13).
Known gaps. Non-Irish regulators do not publish collection status, so the CRR is computed for Ireland only. The DPC register lists the Permanent TSB decision as 30/04/2025 while its decision page path indicates April 2026; Axis recorded April 2026 because the 2025 annual total (€530,773,000) only reconciles without it.
About This Dataset
File: gdpr-fines-statistics.csv — 176 rows, 22 columns, UTF-8. Contents: the 20-row €40M+ ledger with legal status; all 38 rows of the Irish DPC fines register; DPC annual totals 2020–2026; Axis metrics (FFR, CRR, IFL, cap utilisation, group and theme shares); GDPR Article 83 ceilings; ePrivacy exclusions. Every row carries source_org, source_document, source_url, retrieved_date, is_primary, axis_calculated and method_note.
License: CC BY 4.0.
Citation line: Axis Intelligence Research, GDPR Fines Statistics 2026, 2026.
Cite This Report
- APA: Axis Intelligence Research, & Chen, M. (2026, October 15). GDPR fines statistics 2026: €6.63 billion in mega-fines — and only 1.36% of it is final. Axis Intelligence. https://axis-intelligence.com/gdpr-fines-statistics/
- MLA: Axis Intelligence Research, and Marcus Chen. “GDPR Fines Statistics 2026: €6.63 Billion in Mega-Fines — and Only 1.36% of It Is Final.” Axis Intelligence, 15 Oct. 2026, axis-intelligence.com/gdpr-fines-statistics/.
- Chicago: Axis Intelligence Research, and Marcus Chen. “GDPR Fines Statistics 2026: €6.63 Billion in Mega-Fines — and Only 1.36% of It Is Final.” Axis Intelligence, October 15, 2026. https://axis-intelligence.com/gdpr-fines-statistics/.
GDPR Fines: Questions Compliance Teams and Journalists Ask
Has Meta paid its €1.2 billion GDPR fine?
No. The Irish DPC’s fines register lists Meta’s €1.2 billion EU-US transfer fine (May 12, 2023) as “Pending Appeal” as of September 21, 2026. Under Irish law a DPC fine is not payable until a court confirms it, so no part of it has been collected.
How much money has Ireland actually collected from GDPR fines?
About €20 million. The DPC has imposed €4,441,832,000 in fines since 2018 but reports roughly €20 million collected; Axis Intelligence Research’s re-sum of the register’s “Collected” rows gives €20,077,000, a Collection Realization Rate of 0.45%.
Can a GDPR fine be cancelled after it is imposed?
Yes. Luxembourg’s Administrative Court annulled Amazon’s €746 million fine on March 12, 2026 and sent it back to the CNPD, because the 2021 decision had not assessed intent or negligence. A Rome court annulled the Garante’s €15 million OpenAI fine on March 18, 2026, ruling that Ireland was the competent lead authority.
Is Uber’s €825 million fine the second-largest GDPR fine ever?
By amount imposed, yes: €824,990,000 from the Dutch AP on August 21, 2026, behind Meta’s €1.2 billion. Uber has filed an appeal, and Axis Intelligence Research calculates the fine at 46.3% of the 4% turnover ceiling.
Do standard contractual clauses protect a company from a transfer fine?
Not on their own. Meta (€1.2 billion) and Yango (€100 million) both transferred data under standard contractual clauses and were fined because regulators found the protection in the destination country was not essentially equivalent. International transfers account for 31.97% of €40M+ GDPR fine value.
What is the maximum GDPR fine?
Up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher, for infringements under Article 83(5); €10 million or 2% under Article 83(4). The CJEU’s Deutsche Wohnen ruling confirmed the turnover is the group’s, not the subsidiary’s.
Why are most of the biggest GDPR fines issued in Ireland?
Because of the one-stop-shop: a company’s lead supervisory authority is the one where its main EU establishment sits, and Meta, TikTok, LinkedIn and Google run their EU operations from Dublin. The Irish DPC issued 66.57% of the value of all €40M+ GDPR fines.
How long does a GDPR investigation take before a fine?
For Ireland’s large cross-border cases, a median 43 months from inquiry opening to decision, according to Axis Intelligence Research’s Inquiry-to-Fine Lag. Google’s 2026 location-data fine took 79 months; Meta’s 2022 scraping fine took 19.
Are cookie fines GDPR fines?
Not in France. The CNIL’s €325 million Google and €150 million Shein penalties of September 2025 were imposed mainly under French ePrivacy/cookie rules. They are real privacy fines, but counting them as GDPR fines overstates GDPR totals and misreads which regulator can act.
Related Axis research: Data Breach Statistics 2026 · Data Breach Tracker · Cybersecurity Statistics by Industry · Cybercrime Cost by Country · Cyber Insurance Statistics · EU AI Act Compliance Tracker · Healthcare Cybersecurity Statistics