Search Privacy Fines

Deceived users about ability to control privacy of personal information. Cambridge Analytica data sharing. Largest FTC fine ever.

Articles: Art. 32 (1) b) GDPR

Unlawful data transfers to the US in violation of Schrems II. Largest GDPR fine ever.

Articles: Art. 46(1)

Targeted advertising system processed personal data without valid consent.

Articles: Art. 6

Articles: Several

2017 data breach exposed personal information of 147 million people due to failure to patch known vulnerability.

Illegal data transfers to China and failure to be transparent about data processing.

Articles: Art. 46(1), Art. 5(1)(a)

Illegal data transfers to China and failure to be transparent about data processing.

Articles: Art. 46(1), Art. 5(1)(a)

Failed to notify parents and obtain consent before collecting personal information from children under 13 playing Fortnite. Also charged with using dark patterns.

Articles: Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 24 GDPR, Art. 25 (1), (2) GDPR, Art. 35 GDPR

Published children contact details and allowed children aged 13-17 to operate business accounts.

Articles: Art. 5(1)(c), Art. 6(1), Art. 12, Art. 24

Instagram published children contact details and allowed children aged 13-17 to operate business accounts.

Articles: Art. 5(1)(c), Art. 6(1), Art. 12, Art. 24

Forced users to consent to targeted advertising as condition of using Facebook and Instagram.

Articles: Art. 6(1), Art. 7

Articles: Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 (1) c) GDPR

Failed to protect children users privacy. Profiles set to public by default for minors.

Articles: Art. 5(1)(c), Art. 5(1)(f), Art. 12, Art. 13, Art. 24, Art. 25

Failed to protect children users. Profiles set to public by default for minors.

Articles: Art. 5(1)(c), Art. 5(1)(f), Art. 12, Art. 13, Art. 24, Art. 25

Gmail ads without consent and cookie manipulation.

Articles: Art. 5, Art. 6

Gmail ads without consent and cookie manipulation.

Articles: Art. 5, Art. 6

Used wrong legal basis for behavioral advertising and ad targeting.

Articles: Art. 6

Used wrong legal basis for behavioral advertising and ad targeting.

Articles: Art. 6

Transferred European driver data to US without adequate safeguards.

Articles: Art. 44

Transferred European driver data to US without adequate safeguards.

Articles: Art. 44

Scraped personal data of 533 million Facebook users made available online. Data protection by design failure.

Articles: Art. 25

Articles: Art. 25 (1), (2) GDPR

Used dark patterns to trick players into making unwanted purchases. Separate from COPPA penalty.