Data protection authorities (DPAs) in at least nine of the 19 European countries surveyed have fined large digital platforms for breaches of the General Data Protection Regulation (GDPR) and/or the e-Privacy Directive. Since May 2018, Ireland, the Netherlands and France have imposed the highest total fines.

Key findings

• At least nine of the 19 surveyed countries have imposed fines on large digital platforms for GDPR and/or e-Privacy Directive infringements.
• Ireland has imposed around €4.4bn in fines since May 2018, followed by the Netherlands with around €1.1bn and France with around €985m.
• The totals are much lower in other countries, including Spain (€12m), Sweden (€9.6m) and Italy (€7.5m).

Why it matters

The level and distribution of fines show how enforcement against large digital platforms differs across European countries. For cross-border GDPR cases, enforcement can also involve the European Data Protection Board (EDPB) where national DPAs disagree.

Background

The GDPR has applied since 25 May 2018. Depending on the infringement, it allows fines of up to €10m or 2% of worldwide annual turnover, or up to €20m or 4% of worldwide annual turnover, whichever amount is higher.

For cross-border cases, the GDPR consistency mechanism allows the EDPB to adopt a binding decision where national DPAs cannot agree on the handling of a case.

The benchmark also covers fines for infringements of the e-Privacy Directive. In the United Kingdom, the relevant fines covered by the benchmark were issued under the UK GDPR.

What the content covers

Cullen International’s Benchmark tracks fines imposed on large digital platforms by data protection and other supervisory authorities in 19 European countries since May 2018. It covers GDPR and e-Privacy Directive infringements and identifies whether the GDPR consistency mechanism was used in cross-border cases.

Scope

Region: Europe
Countries or jurisdictions covered: 19 European countries
Policy area: Data protection, privacy and regulatory enforcement
Source type: Benchmark
Relevant legislation or policy initiative: General Data Protection Regulation (GDPR), e-Privacy Directive and UK GDPR
Last updated: September 2026

For more information and access to the benchmark, including a ranking of which platforms got the highest fines, please click on “Access the full content” - or on “Request Access”, in case you are not subscribed to our European Digital Economy service.