Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe and North America: 756 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topicWho?
by company- TikTok Technology Limited €530m 44 % · 1 case
- Meta Platforms Ireland Limited €342m 28 % · 2 cases
- Google LLC und Google Ireland Limited €325m 27 % · 1 case
- Netflix International B.V. €4.75m 0 % · 1 case
- Vinted, UAB €2.39m 0 % · 1 case
- Disney DTC, LLC und ABC Enterprises, Inc. (The Walt Disney Company) €2.31m 0 % · 1 case
- Restaurant Partner Polska sp. z o.o. (Betreiberin der Plattform Glovo) €1.4m 0 % · 1 case
- Healthline Media LLC €1.31m 0 % · 1 case
- Les Publications Condé Nast €750,000 0 % · 1 case
- Mediaworks Hungary Zrt. €140,706 0 % · 1 case
- 5 more€13,604
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q3 2023 | 0 | — |
| Q4 2023 | 0 | — |
| Q1 2024 | 0 | — |
| Q2 2024 | 0 | — |
| Q3 2024 | 1 | €91m |
| Q4 2024 | 1 | €251m |
| Q1 2025 | 0 | — |
| Q2 2025 | 0 | — |
| Q3 2025 | 0 | — |
| Q4 2025 | 0 | — |
| Q1 2026 | 0 | — |
| Q2 2026 | 0 | — |
| Q3 2026 | 0 | — |
2 cases
17 Dec 2024 Meta Platforms Ireland LimitedIreland: 251 million EUR against Meta over data breach and deficient notification €251m
In 2018, attackers exploited a flaw in the ‘View As’ feature and gained access to around 29 million accounts, of which around 3 million were in the EEA. Ireland's Data Protection Commission (DPC) imposed 8 million EUR (Art. 33(3)) and 3 million EUR (Art. 33(5)) for incomplete notification and documentation, as well as 130 million EUR and 110 million EUR for infringements of data protection by design (Art. 25(1) and (2)).
Make data breach notifications complete, and document every breach internally in a traceable manner.
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- DSGVO Art. 33 Abs. 3 und 5, Art. 25 Abs. 1 und 2
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 17 Dec 2024
- Irish Data Protection Commission fines Meta €251 Million Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
26 Sep 2024 Meta Platforms Ireland LimitedIreland: 91 million EUR against Meta over plaintext passwords €91m
Meta stored users' passwords unencrypted in plaintext in internal systems and reported this to Ireland's Data Protection Commission (DPC) in March 2019. The DPC found infringements of the security obligations (Art. 5(1)(f), Art. 32(1)) and of the notification and documentation obligations (Art. 33(1) and (5)), and additionally issued a reprimand.
Never store or log passwords in plaintext – not even in internal systems.
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- DSGVO Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 und 5
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Mitigating circumstances
- According to the DPC, the passwords were not disclosed to external third parties.
- Published
- 27 Sep 2024
- Irish Data Protection Commission fines Meta Ireland €91 million Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link