2026

• SonyCaccuri v. Sony: PlayStation Store digital game codes$7.85 millionSony settled class-action claims that, after it stopped retailers such as Amazon and Best Buy from selling digital game download codes in 2019, it held a monopoly on PlayStation Store sales that inflated prices.settlementantitrustUS

2025

• TikTokEuropean users' data accessed from China€530 millionTikTok let staff in China remotely access European users' data without proving it was protected to EU standards, and didn't tell users. During the inquiry it said EU data wasn't stored in China, then admitted some had been. Ordered to comply within six months or suspend transfers.fineprivacyEU
• GoogleGmail ads and cookie consent€325 millionGoogle inserted ads between emails in Gmail inboxes without consent (about 53 million French users) and nudged people creating Google accounts toward personalised-ad cookies. Google's third CNIL cookie fine, after €100 million (2020) and €150 million (2021).fineprivacyEU
• SheinCookies placed even after users refused€150 millionAdvertising cookies were placed the moment users landed on shein.com; banners lacked key information, and when users clicked refuse, cookies kept being set or read anyway. Affected about 12 million monthly French users.fineprivacyEU
• GoogleAbuse of dominance in ad technology€2.95 billionGoogle abused its dominance in ad technology since at least 2014 by favouring its own ad exchange, raising costs likely passed on to consumers.fineantitrustEU
• AppleDigital Markets Act: anti-steering rules€500 millionApple blocked developers from telling users about cheaper deals outside the App Store, in breach of the Digital Markets Act.fineantitrustEU
• MetaDigital Markets Act: pay or consent€200 millionThe EU ruled that forcing users to pay or accept tracking breached Meta's duty to offer a less data-hungry option.fineconsumerEU
• MetaFlo period-tracking app: reproductive-health dataDamages pendingA federal jury found Meta illegally collected reproductive-health data from the Flo app via embedded tracking code, violating California's wiretap law. Flo, Google and Flurry settled for $59.5M combined; Meta alone went to trial and lost.verdictprivacyUS
• GoogleRodriguez v. Google: tracking after opt-out$425.7 millionGoogle kept collecting app-activity data from about 98 million users who had turned Web & App Activity off. The judge later rejected both Google's bid to overturn the verdict and the plaintiffs' $2.36B disgorgement request; with interest the award is about $440M.verdictprivacyUS
• GoogleCalifornia Android data verdict$314.6 millionA California jury found Google liable over data collected from Android users' phones.verdictprivacyUS
• GoogleTexas: location, Incognito and biometric data$1.375 billionGoogle settled Texas's claims that it collected location data, Incognito searches, voiceprints and face geometry without consent. Earlier, in 2022, it paid $391.5M to 40 states over location tracking.settlementprivacyUS
• AmazonFTC: Prime sign-up and cancellation dark patterns$2.5 billionThe FTC alleged Amazon tricked people into Prime and made cancelling deliberately hard (the flow was internally nicknamed The Iliad). $1B civil penalty, an FTC record, plus $1.5B in refunds to about 35 million customers.settlementconsumerUS
• AppleSiri eavesdropping class action$95 millionAlleged accidental Siri activations recorded private conversations for over a decade. Up to $20 per device.settlementprivacyUS
• AppleContempt of court for defying the Epic injunctionContempt finding and criminal referralJudge Yvonne Gonzalez Rogers found Apple willfully violated her 2021 injunction by adding a 27% fee and scare screens on outside payment links. She referred Apple and finance VP Alex Roman to prosecutors for possible criminal contempt; records showed Tim Cook overrode internal advice to comply.rulingantitrustUS
• Samsung, LG, SonyTexas: smart TVs tracking viewing via ACRUp to $10,000 per violation soughtTexas sued Samsung, LG, Sony, Hisense and TCL, alleging their smart TVs use Automated Content Recognition to screenshot what's on screen as often as every half-second, track viewing habits and sell the data to advertisers without meaningful consent. A court granted a temporary restraining order against Hisense.pendingprivacyUS
• NvidiaChina SAMR: Mellanox merger conditionsPenalties not setChina's market regulator said a preliminary probe found Nvidia breached its anti-monopoly law and the conditions attached to its 2020 approval of the $6.9 billion Mellanox acquisition. The announcement came during tense US–China trade talks.pendingantitrustCN
• OpenAIGEMA v. OpenAI: song lyrics copyrightDamages and injunctionA Munich court ruled that GPT-4 and GPT-4o had memorised lyrics from nine German songs and reproduced them almost verbatim, and that both the memorisation and the output infringed copyright. OpenAI was ordered to stop, disclose usage and pay damages.rulingcopyrightEU
• AnthropicBartz v. Anthropic: pirated books used for AI training$1.5 billionIn June 2025 Judge William Alsup ruled that training on lawfully obtained books was fair use, but that Anthropic had wrongfully downloaded more than 7 million books it knew were pirated, from sites such as Library Genesis and Books3. Facing trial, Anthropic settled for about $3,000 per book for roughly 465,000–500,000 works and agreed to destroy the pirated files.settlementcopyrightUS
• FrankCharlie Javice: fake users in the sale to JPMorganMore than 7 years in prisonJavice claimed her student-aid startup had more than 4 million users when it had about 300,000, and backed the claim with a synthetic customer list. JPMorgan bought the startup for $175 million on that basis. She was convicted in March 2025 of bank, wire and securities fraud and conspiracy.convictionfraudUS

2024

• Meta2018 breach of about 29 million accounts€251 millionA 2018 breach exposed names, emails, phone numbers, locations and children's data across about 29 million accounts (3 million in Europe). The fine covered missing data-protection safeguards and inadequate breach notification.fineprivacyEU
• MetaPasswords stored in plaintext€91 millionMeta stored users' passwords without encryption on internal systems; reports at the time said around 600 million passwords were accessible to employees. It also failed to properly notify and document the breach.fineprivacyEU
• MicrosoftLinkedIn: behavioural analysis and targeted ads without a valid legal basis€310 millionLinkedIn profiled its members and targeted ads without a valid legal basis: consent for third-party data wasn't properly informed, and its reliance on legitimate interests and contractual necessity was rejected. The case started from a complaint filed in France. LinkedIn said it believed it was compliant but would adjust its ad systems.fineprivacyEU
• UberDrivers' data sent to the US without safeguards€290 millionFor over two years Uber sent European drivers' account details, taxi licences, locations, photos, payment details, ID documents and in some cases criminal and medical records to US servers without proper transfer safeguards. Uber's third Dutch fine, after €600,000 in 2018 and €10 million in 2023.fineprivacyEU
• Clearview AIIllegal facial recognition database€30.5 millionClearview scraped more than 30 billion photos of people from the internet, turned them into biometric codes and sold searches to law enforcement, without any legal basis. The Dutch regulator warned that organisations using Clearview could themselves be fined. Italy (€20M), Greece and France have also fined it.fineprivacyEU
• AppleMusic streaming: App Store anti-steering rules€1.84 billionThe European Commission fined Apple for abusing its dominant position in the distribution of music streaming apps: it prohibited developers from informing iOS users about cheaper subscription offers available outside the App Store.fineantitrustEU
• MetaTexas facial recognition settlement$1.4 billionMeta settled Texas's claims over its use of facial recognition on users' photos.settlementprivacyUS
• GoogleUnited States v. Google: illegal search monopolyRemedies orderedJudge Amit Mehta ruled that Google violated Section 2 of the Sherman Act by illegally maintaining its monopoly in general search, partly by paying billions to be the default search engine, and overcharged for search ads.rulingantitrustUS
• GoogleBrown v. Google: tracking in Chrome Incognito modeValued at $5 billion; data destruction orderUsers sued Google for continuing to track and collect web browsing activity while Incognito private browsing was enabled. Google agreed to delete or remediate billions of collected data records.settlementprivacyUS
• Clearview AIIllinois biometric privacy class actionAbout $50 million or moreClearview settled an Illinois biometric privacy class action over its facial recognition database, potentially worth over $50 million.settlementprivacyUS
• OpenAIItaly Garante: ChatGPT GDPR breaches€15 millionItaly's privacy regulator found OpenAI trained ChatGPT on personal data without a proper legal basis, wasn't transparent with users, failed to report a March 2023 data breach, and lacked age checks for under-13s. It also ordered a six-month public-awareness campaign. Italy had temporarily blocked ChatGPT in 2023.fineprivacyEU
• NetflixUnclear privacy information and incomplete data-access replies€4.75 millionBetween 2018 and 2020, Netflix's privacy statement didn't clearly explain why it collected data, its legal basis, who data was shared with, or how long it was kept. Customers who asked what data Netflix held on them got incomplete answers. The complaint came from noyb via Austria; Netflix has since updated its policy.fineprivacyEU
• MicrosoftCISPE complaint: cloud software licensing terms€20 millionTo resolve an antitrust complaint filed with the European Commission by the Cloud Infrastructure Services Providers in Europe (CISPE), Microsoft paid €20 million and agreed to change licensing terms that penalised customers for running its software on competing European cloud providers.settlementantitrustEU
• FTXSam Bankman-Fried: customer funds stolen25 years in prisonConvicted on seven counts of fraud and conspiracy after FTX customers lost about $8 billion that was diverted to his trading firm, Alameda Research. The judge also found he had attempted witness tampering and lied on the stand.convictionfraudUS

2023

• MetaUnlawful EU to US data transfers€1.2 billionLargest GDPR fine ever, for systematically moving European users' data to the US without adequate protection from American surveillance. Meta was also ordered to suspend the transfers.fineprivacyEU
• MetaFacebook and Instagram: forced consent to targeted ads€390 millionMeta moved ad consent into its terms of service, so users had to accept tracking to use Facebook and Instagram. Regulators ruled it could not justify behavioural ads as part of the contract with users. Split as €210M (Facebook) and €180M (Instagram); the Irish DPC had proposed €28–36 million before the EDPB forced it higher.fineprivacyEU
• TikTokChildren's profiles public by default€345 millionChildren's profiles were automatically set to public, exposing minors' content, and account creation used dark patterns.fineprivacyEU
• CriteoAd tracking without verified consent€40 millionCriteo, which tracks about 370 million identifiers across Europe for retargeted ads, failed to check that people had consented, gave incomplete answers to data-access requests, and kept tracking users after they withdrew consent. Originally proposed at €60M; the complaint came from Privacy International and noyb.fineprivacyEU
• AppleiOS ad identifiers used without consent€8 millionApple used identifiers on iPhones (iOS 14.6) to serve targeted ads without first obtaining users' consent.fineprivacyEU
• AmazonFTC / DOJ: Ring video access and children's Alexa recordings$30.8 millionAmazon agreed to pay over $25 million to settle FTC charges that it kept children's Alexa voice recordings and failed to delete them on parental request. Separately, Ring paid $5.8 million after employees and contractors accessed customers' private video feeds.settlementprivacyUS
• MicrosoftFTC: Xbox children's data (COPPA)$20 millionThe FTC said Microsoft collected personal data from under-13s signing up for Xbox without notifying parents or getting their consent, and kept some of it for years even when sign-up wasn't completed. Microsoft blamed a technical glitch and said the data was never used or monetised.settlementprivacyUS
• AmazonAmazon France Logistique: intrusive warehouse-worker monitoring€15 million (reduced from €32 million)Workers' handheld scanners fed indicators that tracked idle time down to the second, flagged anyone inactive for more than 10 minutes, and logged items scanned too fast. The data was kept for 31 days. CNIL called the system excessively intrusive, found staff weren't properly told about video surveillance, and said the video software was poorly secured.fineprivacyEU

2022

• MetaInstagram: children's contact details exposed€405 millionInstagram let children run business accounts that publicly exposed their email addresses and phone numbers, and set young users' accounts to public by default. First EU-wide decision on children's data rights.fineprivacyEU
• MetaCambridge Analytica privacy class action$725 millionMeta agreed to pay $725 million to resolve a class action alleging that Facebook improperly shared user data with Cambridge Analytica and other third parties without user consent.settlementprivacyUS
• Epic GamesFTC: Fortnite children's privacy and dark patterns$520 million$275M for collecting under-13s' data without parental consent (a COPPA record) plus $245M in refunds for dark patterns that tricked players into purchases; accounts were locked when users disputed unauthorised charges.settlementconsumerUS
• SamsungAustralia: misleading water-resistance adsA$14 millionBetween 2016 and 2018 Samsung Australia showed Galaxy phones being used in pools and the sea. In reality, charging them after exposure to pool or sea water could corrode the port and stop the phone working; the parent company knew about the issue before launch.fineconsumerAU
• SonyUK PlayStation Store overcharging class actionUp to £5 billion claimedConsumer advocate Alex Neill claims Sony abused its dominance by forcing digital games and add-ons to be sold only through the PlayStation Store, taking a 30% cut and overcharging UK gamers. Later reported at about £2bn for about 12.2 million gamers. Sony's attempt to have it thrown out failed.pendingantitrustUK
• NvidiaSEC: undisclosed crypto-mining impact on sales$5.5 millionThe SEC said Nvidia failed to tell investors in 2018 that crypto mining was a major driver of its gaming GPU sales growth, while its sales staff in China were reporting mining-driven demand.settlementsecuritiesUS
• NvidiaFTC lawsuit to block the Arm acquisition$40 billion acquisition abandonedThe FTC sued to block Nvidia's proposed $40 billion acquisition of chip designer Arm, arguing it would stifle innovation in data centres and autonomous vehicles. Facing opposition from UK and EU regulators as well, Nvidia terminated the deal.otherantitrustUS
• MetaFacebook: scraping leak of about 533 million users' data€265 millionData on up to 533 million Facebook users from 106 countries was posted free on a hacking forum in 2021. Attackers had scraped it through a contact-import feature that Meta fixed in 2019. The regulator found Meta failed to build in data protection by design and default, and said earlier scraping incidents should have been caught sooner.fineprivacyEU
• Capital One2019 cloud breach class action$190 millionClass settlement over the 2019 breach in which a hacker exploited a cloud misconfiguration and accessed data on about 106 million people in the US and Canada.settlementprivacyUS
• Twitter (now X)Security phone numbers and emails used for ads$150 millionFrom 2013 to 2019, Twitter asked more than 140 million users for phone numbers and emails for account security, then also used them to target ads, breaking a 2011 FTC order. Twitter had to tell users and offer two-factor login that doesn't need a phone number.settlementprivacyUS
• VonageFTC: dark patterns blocking cancellation$100 million in refundsSigning up was easy, but from 2017 customers could only cancel by phone with a retention agent. They were hit with undisclosed early-termination fees and sometimes kept being charged after cancelling. The FTC later sent refunds to about 389,000 people.settlementconsumerUS
• SnapSnapchat Lenses and Filters: Illinois biometric privacy$35 millionThe claim was that Snapchat's Lenses and Filters scanned face geometry without consent, breaking Illinois' biometric privacy law. Illinois users received about $58–$117 each. The same law produced Facebook's $650M and Google's $100M settlements.settlementprivacyUS
• VMwareSEC: order backlog used to mislead investors$8 millionThe SEC said VMware deliberately delayed delivering license keys until just after quarter-end, shifting tens of millions in revenue into later quarters and hiding how much its business was slowing.settlementsecuritiesUS
• TheranosElizabeth Holmes: investors defrauded11¼ years in prisonConvicted of defrauding investors about blood-testing machines that never worked as claimed; Theranos had quietly run patients' tests on third-party analysers instead. Former COO Ramesh "Sunny" Balwani was convicted separately on 12 counts.convictionfraudUS

2021

• MetaWhatsApp: hiding data sharing with Meta companies€225 millionWhatsApp failed to be transparent about how it shared users' data with other Meta companies. The Irish regulator initially proposed €30–50 million but was ordered by the EDPB to reassess.fineprivacyEU
• AmazonAd targeting without proper consent€746 millionFined for processing personal data for ads without proper consent; at the time the largest GDPR fine. A Luxembourg court annulled the decision in March 2026 after Amazon's appeal.fineprivacyEU
• MetaFacebook: cookies hard to refuse€60 millionOn facebook.com, accepting cookies took one click but refusing took several, and the refusal button was confusingly labelled. Meta was ordered to make refusing as easy as accepting, with a €100,000-per-day penalty for delay.fineprivacyEU
• GoogleCookies hard to refuse on google.fr and YouTube€150 millionRefusing cookies on google.fr and YouTube took about five clicks while accepting took one. One decision, split as €90M against Google LLC and €60M against Google Ireland; some lists show these as two separate fines.fineprivacyEU

2020

• AmazonAmazon Europe: advertising cookies€35 millionFined over advertising cookies, alongside Google's €100 million cookie fine that same month.fineprivacyEU
• YahooData breach class action: all 3 billion accounts$117.5 millionThe 2013 and 2014 breaches eventually turned out to cover all 3 billion Yahoo accounts; the 2013 breach was first announced as 1 billion and revised in October 2017. Yahoo agreed to a settlement fund for users whose names, email addresses and security questions were compromised.settlementprivacyUS
• Capital OneOCC penalty over the 2019 cloud breach$80 millionIn 2019 a hacker exploited a cloud misconfiguration and accessed data on about 106 million people in the US and Canada, including roughly 140,000 Social Security numbers and 80,000 bank account numbers. Regulators fined Capital One for failing to assess risk properly before moving key IT to the public cloud.fineprivacyUS
• GoogleGoogle+ API leaks$7.5 millionBugs in Google+ APIs exposed private profile data. One affected up to 500,000 users and was found in early 2018 but disclosed only months later; a second potentially affected 52.5 million. Google shut Google+ down and paid $5–$12 per claimant.settlementprivacyUS

2019

• MetaFTC privacy order after Cambridge Analytica$5 billionRecord FTC penalty after data from about 87 million users reached Cambridge Analytica. The FTC also alleged Facebook used security phone numbers for ad targeting and misled users about facial recognition being off. Mark Zuckerberg must personally certify compliance.settlementprivacyUS
• AMDEight-core Bulldozer false advertising$12.1 millionAMD marketed its FX Bulldozer chips as the first native eight-core desktop processors. Buyers argued the cores shared key resources such as a single floating-point unit per module, so they weren't true independent cores. AMD settled for about $35 per chip.settlementconsumerUS
• GoogleAd personalisation without valid consent€50 millionCNIL found Google gave users too little information and control over ad personalisation, so their consent wasn't valid. One of the first large GDPR fines.fineprivacyEU
• Equifax2017 breach of about 147 million people$575 million to $700 millionThe 2017 breach exposed data on about 147 million people, including 145.5 million Social Security numbers. Equifax had been warned in March 2017 about a critical flaw but never made sure the patch was applied. The settlement included $300M for consumer credit monitoring (plus up to $125M more), $175M to the states and $100M to the CFPB.settlementprivacyUS

2018

• YahooSEC: 2014 breach hidden from investors$35 millionThe SEC found Yahoo's managers knew about the 2014 breach but kept investors in the dark for more than two years. It was the first SEC action over failing to disclose a cyber breach, brought against Altaba, the former Yahoo. The breaches also knocked $350 million off Verizon's purchase price.settlementsecuritiesUS
• UberWaymo v. Uber: self-driving trade secretsAbout $245 million in Uber equityWaymo said ex-Google engineer Anthony Levandowski took more than 14,000 confidential files, including lidar designs, before founding Otto, which Uber then bought. Uber settled four days into the jury trial, handing over 0.34% of its equity and promising not to use Waymo's technology.settlementtrade-secretsUS

2016

• Ashley MadisonBreach of 36 million users and fake profiles$1.6 millionThe 2015 hack exposed 36 million users, even though the site had advertised itself as 100% secure. The FTC also found the operator, Ruby Corp, created about 24,000 fake female profiles to push men into paid memberships, and sold a paid Full Delete option but kept the data anyway.settlementprivacyUS

2013

• MicrosoftEU antitrust: Media Player, interoperability and browser choiceAbout €2.2 billion in total (2004–2013)€497 million (2004) for bundling Windows Media Player with Windows; €280 million more for not disclosing interoperability information as ordered; and in 2013, €561 million for breaking a binding promise to show EU users a browser-choice screen, which about 15 million Windows 7 users didn't see for 14 months.fineantitrustEU
• SonyUK ICO: PlayStation Network hack£250,000The 2011 PSN breach exposed names, addresses, emails, birth dates and passwords of millions of users, and put payment cards at risk. The regulator found it preventable: software wasn't up to date and passwords weren't stored securely.fineprivacyUK