BULLETIN №081Last updated · 27 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 11 Sept 2025 | ILVA A/SVestre Landsret upheld a DKK 1.5 million GDPR fine against ILVA A/S. The case concerned retention of data on about 385,000 customers without a deletion policy, and the fine was based on the group’s total turnover. | DK | Datatilsynet | GDPR | €200,000 | ↗ |
| 10 Sept 2025 | S-PankkiThe sanctions board of the Office of the Data Protection Ombudsman imposed a EUR 1.8 million fine on S-Pankki for failing to ensure information security in its online banking authentication service. The case concerned a software vulnerability in S-mobiili that allowed logins using another customer’s credentials and resulted in a personal data security breach. | FI | Office of the Data Protection Ombudsman | GDPR | €1,800,000 | ↗ |
| 09 Sept 2025 | EVELB TÉCNICAS Y SISTEMAS, S.LEVELB TÉCNICAS Y SISTEMAS, S.L was fined by the AEPD 5,000 EUR for breaching Article 5(1)(f) GDPR. The case concerned inadequate data security measures that caused a temporary loss of data availability. | ES | AEPD | GDPR | €5,000 | ↗ |
| 09 Sept 2025 | Unita Turism Holding S.A.In August 2025, the National Supervisory Authority for Personal Data Processing completed an investigation at Unita Turism Holding S.A. and found violations of GDPR provisions. As a result, the operator was fined EUR 5,000. | RO | ANSPDCP | GDPR | €5,000 | ↗ |
| 08 Sept 2025 | SIA "ZZ Dats"DVI imposed a fine of 300,000 EUR on SIA "ZZ Dats". The decision has been appealed. | LV | DVI | GDPR | €300,000 | ↗ |
| 05 Sept 2025 | AUDIO ÓPTICA EUROPA, S.L.AUDIO ÓPTICA EUROPA, S.L. was fined by the AEPD EUR 1,500 for using a minor’s image without valid consent. The authority found this conduct to be in breach of Article 6 of the GDPR. | ES | AEPD | GDPR | €1,500 | ↗ |
| 04 Sept 2025 | GoogleFrance's CNIL imposed a record 325 million euro fine on Google for cookie consent violations. The authority found that Google did not obtain free and informed consent before placing advertising cookies and used Gmail ad practices that required prior consent. | FR | CNIL | ePrivacy | €325,000,000 | ↗ |
| 04 Sept 2025 | Owner of the studentenkotenThe Belgian Data Protection Authority (GBA) imposed a total fine of EUR 9,700 on the owner of a student house. The case concerned the unlawful use of surveillance cameras inside and around the property to monitor students. | BE | Gegevensbeschermingsautoriteit (GBA) | GDPR | €9,700 | ↗ |
| 04 Sept 2025 | A*** GmbHA*** GmbH did not report a personal data breach to the Austrian Data Protection Authority within the 72-hour deadline required by Article 33 GDPR. As a result, a fine of EUR 870 was imposed. | AT | DSB | GDPR | €870 | ↗ |
| 04 Sept 2025 | GoogleThe French data protection authority CNIL fined Google for setting advertising cookies without valid user consent. Google was ordered to bring its practices into compliance within a set deadline, with daily penalties possible for non-compliance. | FR | CNIL | GDPR | €379,000,000 | ↗ |
| 04 Sept 2025 | SOCIETE EXERCANT UNE ACTIVITE DE GRANDE DISTRIBUTIONThe CNIL imposed an administrative fine of EUR 75,000 on SOCIETE EXERCANT UNE ACTIVITE DE GRANDE DISTRIBUTION and issued an injunction. The case concerns a breach of rules supervised by the CNIL. | FR | CNIL | GDPR | €75,000 | ↗ |
| 04 Sept 2025 | Követeléskezeléssel összefüggő jogalap nélküli adatkezelés, tiltakozási joggal kapcsolatos kérelem nem teljesítése és elszámoltathatóság elvének sérelmeThe supervisory authority fined the controller for unlawfully processing the complainant’s phone number in connection with debt collection. It found breaches of lawfulness, data minimization, accountability, and failure to properly handle the data subject’s objection. | HU | NAIH | GDPR | €2,540 | ↗ |
| 04 Sept 2025 | SOCIETE DEVELOPPANT ET COMMERCIALISANT UN LOGICIEL D'AIDE AU RECRUTEMENT (procédure simplifiée)CNIL imposed an administrative fine of EUR 7,000 on SOCIETE DEVELOPPANT ET COMMERCIALISANT UN LOGICIEL D'AIDE AU RECRUTEMENT. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €7,000 | ↗ |
| 04 Sept 2025 | SOCIETE COLLECTANT DES DONNEES DE PROSPECTS A PARTIR DE PLUSIEURS SOURCES, NOTAMMENT DES FORMULAIRES DE PARTICIPATION A DES JEUX CONCOURS EN LIGNE (procédure simplifiée)The CNIL imposed an administrative fine of EUR 17,000 on SOCIETE COLLECTANT DES DONNEES DE PROSPECTS A PARTIR DE PLUSIEURS SOURCES, NOTAMMENT DES FORMULAIRES DE PARTICIPATION A DES JEUX CONCOURS EN LIGNE under the simplified procedure. The case concerned the processing of prospect data collected from multiple sources, including online contest entry forms. | FR | CNIL | GDPR | €17,000 | ↗ |
| 03 Sept 2025 | SheinCNIL imposed a 176,000,000 USD fine on Shein for using cookies without valid user consent. The case concerns breaches of consent and transparency requirements for online tracking. | FR | CNIL | ePrivacy | €151,034,000 | ↗ |
| 03 Sept 2025 | AENA, S.M.E., S.A.The AEPD imposed a fine of EUR 10,043,002 on AENA, S.M.E., S.A. for processing passenger personal data in a manner deemed unnecessary and disproportionate. The authority found that the company’s practices breached data protection rules. | ES | AEPD | GDPR | €10,043,000 | ↗ |
| 03 Sept 2025 | SOCIETE AYANT POUR ACTIVITE LA PROMOTION IMMOBILIERE DE LOGEMENTS (procédure simplifiée)CNIL imposed an administrative fine of 20,000 EUR on SOCIETE AYANT POUR ACTIVITE LA PROMOTION IMMOBILIERE DE LOGEMENTS. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €20,000 | ↗ |
| 01 Sept 2025 | Osnovna škola XThe school unlawfully forwarded personal data of 18 employees to the City of Y, breaching GDPR Articles 5 and 6. AZOP imposed a fine of EUR 2,000. | HR | AZOP | GDPR | €2,000 | ↗ |
| 01 Sept 2025 | La Fântâna S.R.L.In July 2025, ANSPDCP completed an investigation into La Fântâna S.R.L. and found a breach of GDPR provisions. As a result, the operator was fined 10,000 EUR. | RO | ANSPDCP | GDPR | €10,000 | ↗ |
| 01 Sept 2025 | SOCIETE DEVELOPPANT PLUSIEURS SERVICES EN LIGNEThe CNIL imposed an administrative fine of EUR 325 million on SOCIETE DEVELOPPANT PLUSIEURS SERVICES EN LIGNE and issued an injunction. The case concerns identified regulatory breaches. | FR | CNIL | GDPR | €325,000,000 | ↗ |