GDPR is not a toothless regulation. Since it came into force on 25 May 2018, data protection authorities across Europe have imposed fines totalling well over EUR 5 billion. For any business that collects personal data: which, in practice, includes virtually every website: understanding how and why these penalties are handed down is essential. In this comprehensive overview we examine the largest cases, identify the most common violations, break down how fines are calculated and provide practical steps you can take to stay on the right side of the law.

How GDPR enforcement works

Each EU member state has a national data protection authority (DPA) tasked with investigating complaints, conducting audits and, where necessary, imposing sanctions. In Ireland it is the Data Protection Commission (DPC), in France the Commission nationale de l'informatique et des libertes (CNIL), in Germany a patchwork of federal and state authorities, and so on. The regulation also established the European Data Protection Board (EDPB), which coordinates cross-border cases and ensures consistent application of the rules.

Any individual can lodge a complaint with their national DPA, and advocacy groups such as noyb (led by privacy activist Max Schrems) have filed hundreds of strategic complaints that have triggered some of the most significant enforcement actions to date. DPAs can also open investigations on their own initiative: for instance after a data breach notification or following media reports about a company's data practices.

The two-tier penalty structure

GDPR Article 83 establishes two tiers of administrative fines:

  • Lower tier: up to EUR 10 million or 2% of worldwide annual turnover (whichever is greater). This applies to violations of obligations placed on controllers and processors, certification bodies and monitoring bodies.
  • Upper tier: up to EUR 20 million or 4% of worldwide annual turnover (whichever is greater). This applies to violations of the basic principles of processing, conditions for consent, data subjects' rights and rules on international data transfers.

It is important to note that these are maximum amounts. In practice, DPAs consider a range of factors when calculating the actual fine, including the nature, gravity and duration of the infringement, whether the violation was intentional or negligent, what steps the company took to mitigate damage, the company's degree of cooperation and its compliance history.

The largest fines in GDPR history

Several landmark decisions stand out for both the size of the penalty and the precedent they set:

Meta (Facebook): EUR 1.2 billion (May 2023)
The Irish DPC imposed this record-breaking fine for transferring EU users' personal data to the United States without adequate safeguards following the invalidation of the EU-US Privacy Shield by the Court of Justice of the EU in the Schrems II decision (July 2020). Meta was also ordered to suspend transatlantic data transfers: a ruling that sent shockwaves through the tech industry and ultimately accelerated negotiations on the EU-US Data Privacy Framework.

Amazon: EUR 746 million (July 2021)
The Luxembourg National Commission for Data Protection (CNPD) penalised Amazon for processing personal data for targeted advertising without obtaining valid consent. The case was triggered by a mass complaint coordinated by the French privacy group La Quadrature du Net. Amazon appealed, but the fine underscored that even the world's largest companies are not above GDPR.

WhatsApp: EUR 225 million (September 2021)
The Irish DPC fined WhatsApp for failing to provide transparent information to users and non-users about how their data was processed. The original proposed fine was significantly lower, but the EDPB's dispute resolution mechanism pushed Ireland to increase the amount: illustrating the Board's growing influence on enforcement.

Google: EUR 150 million (December 2021)
The French CNIL penalised Google for making it unreasonably difficult for users to refuse cookies on google.fr and youtube.com. Whilst accepting cookies required a single click, rejecting them involved navigating multiple screens: a textbook "dark pattern." Facebook (now Meta) received a EUR 60 million fine in the same decision for an identical practice.

H&M: EUR 35.3 million (October 2020)
The Hamburg Commissioner for Data Protection fined H&M's service centre in Nuremberg for extensive surveillance of employees. Managers had been recording information about employees' health, family problems and religious beliefs after "return-to-work" chats and storing this data in a shared drive accessible to dozens of managers.

Fines specifically related to cookies and consent

A growing proportion of enforcement actions focus squarely on how websites collect (or fail to collect) cookie consent. Some of the most notable cases include:

  • Google France: EUR 150 million (2021) for dark patterns in the cookie banner, as described above.
  • Meta/Facebook France: EUR 60 million (2021) for the same dark-pattern approach on facebook.com.
  • Microsoft Ireland: EUR 60 million (2022) for insufficient information about advertising cookies on bing.com and for depositing cookies without prior consent.
  • TikTok France: EUR 5 million (2023) for a misleading cookie banner that did not provide an easy way to refuse cookies and for failing to adequately inform users about the purposes of cookies.
  • Criteo: EUR 40 million (2023) for processing personal data for advertising purposes without demonstrating that valid consent had been obtained from partner websites.

The pattern is clear: regulators are paying close attention to the user experience of cookie banners. If your reject button is hidden, if you use confusing language, or if cookies fire before consent is given, you are at risk.

According to enforcement data, the average fine for a GDPR violation in 2024 exceeded EUR 2.5 million: and the trend is upward. Regulators are becoming more assertive, not less.

Enforcement trends: what DPAs are focusing on

Beyond headline-grabbing mega-fines, several trends are shaping the enforcement landscape:

  • Cookie compliance sweeps: DPAs in France, Italy, Spain and the Nordics have conducted coordinated website audits, checking hundreds of sites for cookie banner compliance in a single operation.
  • Cross-border cooperation: The EDPB's "one-stop-shop" mechanism is maturing, with more binding decisions forcing lead supervisory authorities to increase proposed fines.
  • SME enforcement: While early enforcement focused on big tech, DPAs are increasingly targeting small and medium-sized businesses. In 2024, the Spanish AEPD issued hundreds of fines to SMEs, some as low as EUR 1,000: proof that no organisation is too small to be sanctioned.
  • Consent validity: Authorities are scrutinising whether consent is truly "freely given, specific, informed and unambiguous" as required by GDPR Article 7. Pre-ticked boxes, bundled consents and "take it or leave it" approaches are all being challenged.
  • International data transfers: Post-Schrems II, transfers to third countries remain under intense scrutiny despite the new EU-US Data Privacy Framework adopted in July 2023.

The situation in the Czech Republic

The Czech Office for Personal Data Protection (UOOU) has historically been less aggressive than its Western European counterparts, but enforcement is picking up:

  • The highest UOOU fine to date stands at CZK 6 million (approximately EUR 240,000).
  • Typical fines for cookie-related violations range from CZK 50,000 to CZK 500,000.
  • The UOOU has been increasing the frequency of inspections targeting e-commerce sites and web-based services, with a particular focus on cookie consent practices and privacy policy completeness.
  • In 2024, the UOOU published updated guidance on cookie walls and the "pay or consent" model, signalling a more nuanced approach to consent collection.

While Czech fines may seem modest compared to those issued in France or Ireland, they can still represent a significant burden for small businesses: and the reputational damage of a public enforcement action can be far costlier than the fine itself.

Real-world lessons: what goes wrong

Examining enforcement decisions reveals a set of recurring mistakes:

1. No cookie banner at all. Some websites, particularly older or neglected ones, simply have no consent mechanism. In the eyes of a regulator, this is the most basic and avoidable violation.

2. Pre-ticked consent boxes. The Court of Justice of the EU confirmed in the Planet49 case (C-673/17, October 2019) that pre-ticked checkboxes do not constitute valid consent. Despite this clear ruling, many websites still default to "all cookies accepted."

3. No genuine choice to refuse. If your cookie banner has a large, colourful "Accept all" button but the reject option is a small text link buried in a sub-menu, regulators will consider this a dark pattern.

4. Cookies firing before consent. Technical audits frequently reveal that tracking scripts load as soon as the page opens: before the user has had any chance to interact with the cookie banner. This is a clear violation of the consent requirement.

5. Vague or incomplete information. Users must be told what cookies are used, for what purposes, by whom and for how long. A cookie banner that simply says "We use cookies to improve your experience" is not sufficient.

6. No way to withdraw consent. GDPR Article 7(3) requires that withdrawing consent must be as easy as giving it. If users can accept cookies in one click but must navigate deep into your settings to change their mind, you have a problem.

How fines are calculated in practice

DPAs do not pick a number at random. GDPR Article 83(2) lists ten criteria that must be considered:

  • The nature, gravity and duration of the infringement
  • Whether the violation was intentional or negligent
  • Steps taken to mitigate damage to data subjects
  • The degree of responsibility, considering technical and organisational measures in place
  • Any previous infringements
  • The degree of cooperation with the supervisory authority
  • The categories of personal data affected
  • How the supervisory authority learned about the infringement (self-reported vs. complaint)
  • Compliance with previously ordered measures
  • Any other aggravating or mitigating factors, such as financial benefits gained from the violation

In 2023, the EDPB published binding guidelines on the calculation of fines (Guidelines 04/2022), establishing a five-step methodology. First, the DPA identifies the processing operations at issue and the applicable fine cap. Then it assesses the gravity of the violation, considers turnover as a starting point and evaluates aggravating and mitigating factors. Finally, it checks that the resulting fine is effective, proportionate and dissuasive: and that it does not exceed the legal maximum.

Beyond fines: other consequences

Financial penalties are only one part of the picture. DPAs can also:

  • Order you to stop processing data: effectively shutting down parts of your business.
  • Require changes to your practices: often with a tight deadline and follow-up audits.
  • Issue public reprimands: which are published on the DPA's website and picked up by the media.
  • Suspend data transfers: as happened with Meta's transatlantic data flows.

For many companies, the reputational impact of a public enforcement action is more damaging than the fine. Customers lose trust, partners reconsider relationships and prospective clients choose competitors who can demonstrate compliance.

How to avoid a fine: a practical checklist

The good news is that most GDPR fines result from avoidable mistakes. Here is what you should do:

  • Implement a proper cookie banner that provides clear information, an easy way to accept or refuse, and does not load any non-essential cookies before consent is given.
  • Audit your cookies regularly: new scripts and third-party integrations can introduce cookies you are not aware of.
  • Keep records of consent: GDPR requires you to be able to demonstrate that consent was obtained. A compliant CMP stores timestamped consent records.
  • Make withdrawal easy: users must be able to change their cookie preferences at any time with the same ease as giving consent.
  • Review your privacy policy: ensure it is up to date, written in plain language and covers all processing activities.
  • Train your team: GDPR compliance is not just a technical matter. Everyone who handles personal data should understand the basics.
  • Respond promptly to data subject requests: access, deletion and portability requests have strict deadlines (generally 30 days).

With Consentio you can be certain that your cookie banner meets all current requirements. Our platform automatically blocks non-essential cookies until consent is given, stores consent records, provides an easy way for users to change their preferences and keeps up with regulatory changes: so you do not have to.