The biggest data protection fines: GDPR, South Korea and the US
From Meta (€1.2bn) to Coupang (KRW 625bn) and Equifax (up to $700m): a ranking of the largest privacy fines and settlements, and what triggered each one.
Privacy fines are no longer symbolic. In Europe, GDPR sanctions total billions of euros; South Korea broke its own record in 2026; and in the US, the largest sums come from post-breach settlements rather than fines.
Europe: the GDPR ranking
| # | Company | Authority | Amount | Year | Reason |
|---|---|---|---|---|---|
| 1 | Meta Platforms Ireland | DPC (Ireland) | €1.2bn | 2023 | Data transfers to the US |
| 2 | TikTok | DPC | €530m | 2025 | Transfers to China |
| 3 | Meta (Instagram) | DPC | €405m | 2022 | Teenagers' data |
| 4 | Meta | DPC | €390m | 2023 | Legal basis for ads |
| 5 | TikTok | DPC | €345m | 2023 | Children's accounts |
| 6 | LinkedIn Ireland | DPC | €310m | 2024 | Behavioral advertising |
| 7 | Uber | AP (Netherlands) | €290m | 2024 | Driver data transfers |
Sources: Enzuzo, GDPR Local, DeepStrike.
Amazon's €746 million Luxembourg fine was annulled by a court on March 12, 2026 (Chronicle.lu), while TikTok's €530 million fine was upheld by Ireland's High Court, with methodology questions referred to the EU Court of Justice (Digital Policy Alert).
Cumulative GDPR fines reached €7.1 billion by January 2026, about €1.2 billion in 2025 (DLA Piper); the CMS tracker counts 2,685 fines worth about €6.11 billion. Notable 2026 cases: CNIL's €42 million against Free and Free Mobile and the UK ICO's £14.47 million against Reddit (GDPR Local). The UK record remains British Airways' £20 million (Skillcast).
South Korea
- SK Telecom (Aug 2025): KRW 134.8 billion (about $97 million) for a USIM breach affecting about 23 million subscribers (Light Reading).
- Coupang (Jun 2026): about KRW 625 billion, a national record, over a leak affecting 37.56 million people and the destruction of logs after a preservation order (SBS Star).
United States settlements
Equifax ($575–700 million, 2019), T-Mobile ($500 million, 2022), Capital One ($190 million), Uber ($148 million) and Anthem ($115 million) top the list (Enzuzo).
Brazil and the lessons
Brazil's ANPD had issued a single R$14,400 monetary fine by early 2026, though it opened 19 proceedings in June 2026 (Turivius). The big cases share themes: international data transfers, children's data, delayed or hidden breach notices, and evidence destruction as an aggravating factor.
Source
- Enzuzo: biggest data breach fines and settlements
- GDPR Local: biggest GDPR fines
- DeepStrike: GDPR fines statistics
- Chronicle.lu: Luxembourg court annuls CNPD ruling in Amazon case
- Digital Policy Alert: High Court upholds TikTok fine
- DLA Piper: GDPR fines and data breach survey, January 2026
- CMS: GDPR Enforcement Tracker Report
- GDPR Local: top GDPR fines in 2026
- Light Reading: SKT fined over data breach
- SBS Star: PIPC record fine on Coupang
- Skillcast: biggest ICO fines
- Turivius: multas da LGPD em 2026