Digital fines actually imposed

Announcing a fine and collecting it are two different things. This tracker records only the first verifiable half of that story —the financial penalty actually imposed under the major digital rules: GDPR, DSA, DMA, AI Act, Brazil's LGPD and US state laws— and notes, case by case, what happened next. There are sixty sanctions between June 2017 and February 2026, and reading them together debunks the idea that the era of big digital fines is a linear, triumphant march.

The nominal total is striking: more than €18 billion adding up only the amounts stated in that currency (36 of the 60 cases; the rest are in dollars, pounds, reais or other currencies, and are not converted so as not to distort the figure). But that number must be read with three caveats attached.

First caveat: concentration

The highest sanction on record —€4.34 billion against Google in the Android case— has nothing to do with privacy or AI: it is classic competition law. In fact, the seven fines imposed by the European Commission (antitrust and DMA) provide most of the money, while the 34 sanctions issued under the GDPR, though the most numerous, generally involve far smaller sums. Anyone who reads '€18 billion in digital fines' and thinks of data protection has the wrong frame: the bulk of the money is competition, not privacy.

The concentration is also corporate. Google, Meta, Amazon and a handful of giants take most of the total. Clearview AI, by contrast, appears five times —sanctioned by regulators in several European countries over its facial-recognition database— but its fines combined are a fraction of a single one of Google's.

Second caveat: the outcome

This is where the tracker delivers what a headline cannot. Of the sixty sanctions, only twenty-nine are final and another ten were closed through a binding settlement. The rest —twenty-one— sit somewhere in the appeals maze: eight appealable, seven already appealed, five reduced on appeal and one outright annulled. In other words, about a third of the record is not yet certain money.

The 'outcome' field reveals a pattern the aggregate figures hide: the largest fines are also the most contested. The best-resourced tech firms do not pay and litigate, and higher courts reduce or annul with some frequency. That is why this tracker insists on separating the fine imposed from the fine confirmed: they are two different data points, and conflating them inflates the sense that regulation 'already works'.

Third caveat: who sanctions

The map of authorities traces a clearly European axis. France's CNIL and Ireland's Data Protection Commission top the number of cases —Ireland because it is the European headquarters of much of Big Tech, which makes its regulator the lead supervisor under the GDPR's one-stop-shop mechanism—, followed by the European Commission. The United States appears mainly through the California Attorney General and the FTC, with a handful of sanctions, while the hardest-hit sector by far is social media.

It is worth remembering what is left out. An announced fine that is not later documented with an amount and an outcome does not qualify; nor do sanctions from jurisdictions whose records are not public or verifiable. That skews the portrait toward Europe, where the sanctioning framework is more mature and transparency greater. It does not mean other places do not sanction: it means only what can be verified is recorded here.