Who was sanctioned, and for what?

TikTok allowed employees in China to access European users' data remotely without assessing and demonstrating that standard contractual clauses and supplementary measures ensured an equivalent level of protection against access by Chinese authorities; it also informed users inadequately. Ireland's Data Protection Commission (DPC) imposed 530 million EUR and ordered that the transfers be brought into compliance or suspended within six months.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · International data transfers

Legal basis

Art. 46 Abs. 1, Art. 13 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

2 May 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2022–2024, the delivery service used a standard clause to prohibit restaurants from being cheaper on their own channels than on Wolt, while at the same time being able to grant discounts without consultation and to compensate customers up to 400 DKK at the restaurants’ expense. The Konkurrencerådet (Danish Competition Council) ordered the practice to cease, required Wolt to inform all restaurants and intends to enforce a fine through the courts.

Authority / court

Konkurrencerådet (Danish Competition Council)

Area of law

Competition law · Abuse of market power

Legal basis

Konkurrenceloven; AEUV Art. 102

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Published

26 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On 29 May 2024, the Vienna broadcaster W24 aired advertising in split screen within the programme ‘24 Stunden Wien’, did not adequately separate advertising from programming and, at around 50 minutes, significantly exceeded the permitted 12 minutes of advertising per hour. The Austrian Communications Authority (Kommunikationsbehörde Austria, KommAustria) imposed fines totalling 500 EUR (plus 50 EUR in costs) on the body authorised to represent the company externally; the GmbH is jointly and severally liable under § 9 (7) VStG (Austrian Administrative Penal Act).

Authority / court

Kommunikationsbehörde Austria (KommAustria)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 64 Abs. 2 Z 9 i. V. m. §§ 43 Abs. 2, 44 Abs. 1, 45 Abs. 1 AMD-G; § 9 VStG

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Culpability

negligent

Mitigating circumstances

No previous record, duration of proceedings, remorseful confession and remedial measures initiated.

Liability of senior managers

Fine imposed on the body responsible externally (§ 9 (1) VStG); the company is jointly and severally liable.

Published

19 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In the programme ‘Sport aktuell’ on ORF 1 on 29 July 2025, a logo wall was visible as product placement without being labelled. The Austrian Communications Authority (Kommunikationsbehörde Austria, KommAustria) found, with final effect, a violation of the ORF Act (ORF-Gesetz).

Authority / court

Kommunikationsbehörde Austria (KommAustria)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 16 Abs. 5 Z 4 ORF-G

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Published

29 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

After the Facebook page of the Danish fashion retailer Clothing By Ros ApS was hacked in 2023, Meta failed to respond appropriately for almost two years, gave no reasons for the de facto suspension and offered no effective complaint-handling procedure. The Konkurrencerådet (Danish Competition Council) found infringements of the P2B Regulation and ordered Meta to comply with the rules on statements of reasons and complaint handling in future.

Authority / court

Konkurrencerådet (Danish Competition Council)

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2019/1150 (P2B) Art. 4, Art. 11

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

24 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The ticket exchange did not include mandatory fees in the total price at the start of the purchasing process. By way of a final infringement notice, the CMA imposed a penalty of 889,200 GBP (including a 40 % settlement discount) and required the company to refund the mandatory fees.

Authority / court

Competition and Markets Authority (CMA)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Digital Markets, Competition and Consumers Act 2024

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Settlement with a 40 % discount and waiver of appeal.

Published

23 Jun 2026

Original amount 889,200 GBP, converted at the ECB reference rate of 23 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On 7 November 2025, the publisher's news portals Origo and Magyar Nemzet linked to a map, created by unknown persons, containing the names, addresses, telephone numbers, email addresses, geo-coordinates and political preferences of Tisza sympathisers; Ripost showed an image with the name of the map. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found intentional infringements of Art. 6 and 9 GDPR, prohibited further dissemination and imposed 50 million HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection

Legal basis

DSGVO Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 58 Abs. 2 lit. b und f (NAIH/962-10/2026)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Culpability

intentional

Published

26 May 2026

Original amount 50,000,000 HUF, converted at the ECB reference rate of 26 May 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The publisher kept data of around 685,000 former book club members in a ‘passive database’, in around 395,000 cases more than ten years after they had left, without any deletion rules. The Danish Data Protection Agency (Datatilsynet) had recommended a fine of 1 million DKK in 2022; the case was closed on 14 April 2026 with a fine notice whose amount is not stated in the source.

Authority / court

Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet

Area of law

Data protection

Legal basis

DSGVO Art. 5 Abs. 1 lit. e, Art. 5 Abs. 2

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Cooperative conduct; only two employees had access to the passive database; deletion after the supervisory visit.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

According to the AGCM, the review platform did not adequately check whether reviews – including those labelled as "verified" – were genuine, and allowed companies to invite specifically selected customers to leave reviews via paid services, which undermined the representativeness of the star ratings. In addition, information on how the platform works and on paid services was lacking; the authority also saw dark pattern elements in this.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Artt. 20, 21, 22 e 23, comma 1, lett. bb-ter Codice del Consumo

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

23 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From March 2020 to May 2021, the operator of ss.lv/ss.com (market share over 60%) deleted advertisements and blocked accounts of users – mainly car dealers and estate agents – who also advertised on the competing platform pp.lv; anyone wishing to register with an inbox.lv address additionally had to provide a different e-mail address. The Konkurences padome (Latvian Competition Council) considered this an abuse of a dominant position (Art. 102 TFEU), imposed 186,780.65 EUR and required objective criteria for dealing with customers.

Authority / court

Konkurences padome (Lettischer Wettbewerbsrat)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

18 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Since 2019, the delivery platform had required scans or photos of its users’ identity cards and passports in cases of suspected fraud, relying on legitimate interests. The Prezes Urzędu Ochrony Danych Osobowych (President of Poland’s data protection authority, UODO) regarded this as processing without a legal basis and a breach of data minimisation, imposed 5,898,064 PLN and ordered the processing to stop and the data to be erased.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 5 Abs. 2, Art. 6 Abs. 1 DSGVO (DKN.5112.33.2022)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

16 Mar 2026

Original amount 5,898,064 PLN, converted at the ECB reference rate of 19 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

So that bpost would obtain the state concession for newspaper delivery for 2023–2027, its competitor PPP refrained from submitting a bid and in return received additional delivery volumes from DPG Media and Mediahuis (bid rigging). In a settlement procedure, the Autorité belge de la Concurrence / Belgische Mededingingsautoriteit (Belgian Competition Authority, BMA) imposed 3,786,574 EUR (DPG Media), 7,788,423 EUR (Mediahuis) and 323,486 EUR (PPP); bpost, as leniency applicant, received full immunity, and two bpost employees involved were fined a total of 6,300 EUR.

Authority / court

Autorité belge de la Concurrence / Belgische Mededingingsautoriteit (BMA)

Area of law

Competition law · Cartels and collusion

Legal basis

Code de droit économique Art. IV.1; AEUV Art. 101

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Leniency programme (immunity for bpost; reductions of 50% and 40% for DPG Media and Mediahuis respectively) and 10% settlement reduction.

Liability of senior managers

First-ever fines against two natural persons (employed by bpost), totalling 6,300 EUR.

Published

13 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Disney implemented objections to the sale and sharing of data only for individual services or devices rather than across the whole account, continued to disclose data via embedded ad-tech providers and offered no opt-out in connected TV apps. It was the largest CCPA settlement at the time of the agreement with the Attorney General of California.

Authority / court

Attorney General of California (California Department of Justice)

Area of law

Data protection · Cookies and tracking

Legal basis

California Consumer Privacy Act (CCPA)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Published

11 Feb 2026

Original amount 2,750,000 USD, converted at the ECB reference rate of 11 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The cinema company added a mandatory booking fee of 1.50 CAD to advertised ticket prices for online purchases. In September 2024, the Competition Tribunal classified this as drip pricing and imposed a penalty of 38.9 million CAD (the amount Cineplex had earned from it between June 2022 and December 2023) plus a ten-year prohibition; the Federal Court of Appeal dismissed the appeal in January 2026.

Authority / court

Federal Court of Appeal / Competition Tribunal (auf Antrag des Competition Bureau)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Competition Act, Deceptive Marketing Practices (Drip Pricing, seit 24.06.2022 ausdrücklich geregelt)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

23 Jan 2026

Original amount 38,900,000 CAD, converted at the ECB reference rate of 21 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

First non-compliance decision under the Digital Services Act (DSA): the European Commission imposed 120 million EUR on X because the purchasable ‘verified’ checkmark deceives users, the advertising repository lacks essential information (content, topic, advertiser) and researchers are denied access to public data. X must present remedies within 60 working days and an action plan within 90 working days respectively.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/2065 (DSA), Art. 25 Abs. 1, Art. 39, Art. 40 Abs. 12

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

5 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following preliminary findings in May 2025 that TikTok’s advertising repository did not meet the requirements of the Digital Services Act, the European Commission declared commitments binding: complete ad content including links, updates within 24 hours, disclosure of targeting criteria with aggregated reach data and improved search functions. Depending on the commitment, implementation must take place within 2 to 12 months; breaches of the commitments count as breaches of the DSA.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Digital Services Act (Verordnung (EU) 2022/2065): Pflicht zum Werbearchiv; verbindliche Zusagen nach Art. 71

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On the Romanian marketplace publi24.ro, a fake advert appeared with photos and the telephone number of a woman, claiming that she offered sexual services. The Court of Justice of the European Union (Grand Chamber, Case C-492/23) ruled that the operator is a controller within the meaning of the GDPR, must identify adverts containing sensitive data before publication and verify identity or consent, and cannot rely on the liability exemption of the E-Commerce Directive.

Authority / court

Gerichtshof der Europäischen Union (Große Kammer), Rs. C-492/23

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO (Verantwortlicher, Art. 9, Art. 32); Richtlinie 2000/31/EG

Status of proceedings

unknown

Sector

Media and online platforms

Published

2 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On vanityfair.fr, cookies requiring consent were set before any interaction with the banner, trackers were labelled as ‘strictly necessary’ and cookies continued to be placed even after ‘Reject all’. Following a complaint by noyb, the publisher had already received a formal notice in 2021; follow-up inspections in 2023 and 2025 by the French data protection authority (CNIL) showed continuing infringements.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 82 Loi Informatique et Libertés

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Published

27 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2021, the Estonian parent company of Apollo cinemas acquired control of Forum Cinemas Lithuania before the notified merger had been cleared and integrated the cinemas in Vilnius and Kaunas into its network, even though the Konkurencijos taryba (Lithuanian Competition Council) had provisionally expressed competition concerns. Fine of 7,507,930 EUR (0.8% of consolidated worldwide turnover) and obligation to end the infringement within six months. Source: archived copy of the press release.

Authority / court

Konkurencijos taryba (Litauischer Wettbewerbsrat)

Area of law

Competition law · Merger control

Legal basis

Konkurencijos įstatymas (Vollzugsverbot bei Zusammenschlüssen)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

30 Oct 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

After both hosting services had received at least two final removal orders from EU authorities within twelve months, Coimisiún na Meán (Ireland’s media and online safety regulator) designated them as exposed to terrorist content under the TCO Regulation. They must take specific protective measures and report on them within three months; the regulator assesses their effectiveness.

Authority / court

Coimisiún na Meán (irische Medien- und Online-Sicherheitsaufsicht)

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2021/784 (Terrorist Content Online Regulation): Einstufung als exponiert, spezifische Maßnahmen

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The CMA objected that, during the Oasis presale, fans in the queue were not told that standing tickets were being sold at two price levels, and that "Platinum" tickets cost almost 2.5 times as much without it being adequately explained that they offered no added value compared with some standard tickets. Without admitting liability, Ticketmaster gave undertakings: advance notice of tiered pricing, price ranges in the queue, no misleading ticket descriptions and a two-year reporting obligation.

Authority / court

Competition and Markets Authority (CMA)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Britisches Verbraucherschutzrecht (Verfahren nach den vor April 2025 geltenden Befugnissen; Verpflichtungszusagen)

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

Undertakings without admission of liability.

Published

25 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The joint investigation by the Office of the Privacy Commissioner of Canada and the supervisory authorities of Québec, British Columbia and Alberta found that every year hundreds of thousands of children used the platform despite the minimum age of 13, and that TikTok processed data without valid consent, including for profiling and advertising. TikTok undertook to improve age verification and make privacy notices easier to understand, and already during the investigation largely stopped targeted advertising to under-18s (except by broad categories such as language and approximate location).

Authority / court

Office of the Privacy Commissioner of Canada gemeinsam mit den Aufsichten von Québec, British Columbia und Alberta

Area of law

Data protection · Marketing and consent

Legal basis

PIPEDA und Datenschutzgesetze für den Privatsektor von Québec, British Columbia und Alberta

Action

Other

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

23 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Customer data (including names, e-mail addresses, dates of birth, telephone numbers) could be retrieved via an unprotected development server of the advertising agency. An employee took the first alert from an external party in January 2025 to be spam; only a second alert in February reached management, which closed the gap but only notified the incident on 2 May 2025 after being requested to do so by the Datenschutzbehörde (Austrian Data Protection Authority, DSB). The authority attributed the employee’s conduct to the company.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 33 Abs. 1 iVm Art. 83 Abs. 4 lit. a DSGVO

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Culpability

negligent

Mitigating circumstances

No previous infringements and cooperation in the proceedings; gap closed immediately after the second alert, employees trained subsequently.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

When creating a Google account, users were not sufficiently informed that advertising cookies were necessarily placed in the process; in addition, Google displayed advertisements between e-mails in Gmail without prior consent. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 200 million EUR on Google LLC and 125 million EUR on Google Ireland and ordered remedial action within six months, subject to a penalty payment of 100,000 EUR per day.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 82 Loi Informatique et Libertés; Art. L. 34-5 Code des postes et des communications électroniques

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2023, the Austrian data protection authority (Datenschutzbehörde, DSB) had ordered a local news portal (a media GmbH & Co KG, name pseudonymised) by decision to offer, on the first layer of the cookie banner, an equivalent option to close it without consent. Because the company did not implement this from October 2024 until at least March 2025, the DSB imposed 6,200 EUR for failure to comply with an instruction; the penalty decision is final.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 58 Abs. 2 lit. d i. V. m. Art. 83 Abs. 6 DSGVO; Art. 7 DSGVO

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Despite objections, the health portal continued to pass data to advertising partners and transmitted article titles suggestive of diagnoses for targeted advertising; the consent banner did not stop the tracking. In addition, the required contractual clauses with advertising partners were missing. The settlement was reached with the Attorney General of California.

Authority / court

Attorney General of California (California Department of Justice)

Area of law

Data protection · Cookies and tracking

Legal basis

California Consumer Privacy Act (CCPA), Unfair Competition Law

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

1 Jul 2025

Original amount 1,550,000 USD, converted at the ECB reference rate of 1 Jul 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between March and November 2024, Meta offered users of Facebook and Instagram only the choice between consenting to the combination of their data for personalised advertising and a paid subscription. The European Commission saw this as a breach of the obligation under the Digital Markets Act (DMA) to offer an equivalent, less data-intensive alternative, and imposed 200 million EUR.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/1925 (DMA), Einwilligung zur Datenzusammenführung

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

23 Apr 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Sports broadcasters and production companies exchanged sensitive information in 15 instances about day rates and fee increases for freelance camera operators and sound technicians in order to coordinate pay. Fines: BT 1,738,453 GBP, IMG 1,737,820 GBP, BBC 424,165 GBP, ITV 339,918 GBP; Sky received immunity as the first to come forward.

Authority / court

Competition and Markets Authority (CMA)

Area of law

Competition law · Cartels and collusion

Legal basis

Chapter I Competition Act 1998

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

20 % settlement discount for all; leniency discounts for BT, IMG, ITV; immunity for Sky

Published

21 Mar 2025

Original amount 4,240,356 GBP, converted at the ECB reference rate of 21 Mar 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following a report through which a minor victim became identifiable, an inspection found that the broadcaster had no risk analysis for editorial work, no rules for checking personal data before publication and no encryption of mobile storage media. Poland’s data protection authority (UODO) imposed 56,824 PLN; the Warsaw Administrative Court dismissed the action on 18 March 2026.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 24 Abs. 1, Art. 32 Abs. 1 und 2 DSGVO (DKN.5112.10.2024)

Action

Fine

Status of proceedings

under appeal

Sector

Media and online platforms

Published

11 Mar 2025

Original amount 56,824 PLN, converted at the ECB reference rate of 6 Mar 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Google undertook to the CMA to improve the detection and removal of fake reviews, to ban repeat offenders worldwide, to place warnings on business profiles with manipulated reviews and deactivate their review function, and to set up simple reporting channels; the CMA will monitor implementation for three years.

Authority / court

Competition and Markets Authority (CMA)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Britisches Verbraucherschutzrecht (Verpflichtungszusagen)

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

Voluntary undertakings without a fine.

Published

24 Jan 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

According to the FTC, the AI-powered review platform collected star ratings for its business customers at the time of purchase, before customers had received the product or service, thereby inflating average ratings and review counts, including in search engine results. The FTC issued a final settlement order prohibiting such misrepresentations.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Section 5 FTC Act

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Published

3 Jan 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2018, attackers exploited a flaw in the ‘View As’ feature and gained access to around 29 million accounts, of which around 3 million were in the EEA. Ireland's Data Protection Commission (DPC) imposed 8 million EUR (Art. 33(3)) and 3 million EUR (Art. 33(5)) for incomplete notification and documentation, as well as 130 million EUR and 110 million EUR for infringements of data protection by design (Art. 25(1) and (2)).

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 33 Abs. 3 und 5, Art. 25 Abs. 1 und 2

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

17 Dec 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between 2018 and 2020, Netflix did not adequately inform customers about what happens to their data, and the information available was partly unclear. The Dutch supervisory authority (Autoriteit Persoonsgegevens, AP) imposed 4.75 million EUR; Netflix has since revised its privacy statement.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a i. V. m. Art. 12 Abs. 1, Art. 13 Abs. 1 lit. c, e, f und Abs. 2 lit. a, Art. 15 Abs. 1 lit. a, c, d und Abs. 2 DSGVO

Action

Fine

Status of proceedings

under appeal

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

The privacy statement and the information provided were subsequently improved.

Published

18 Dec 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In April 2021, data on around 533 million Facebook users from 106 countries was made public, which unknown persons had previously linked to telephone numbers and harvested via the contact import function. Germany's Federal Court of Justice (Bundesgerichtshof, BGH) ruled that the mere loss of control over data already constitutes non-material damage under Art. 82 GDPR, considered around 100 EUR appropriate and referred the case back to the Higher Regional Court of Cologne (OLG Köln), among other things to examine the default searchability setting in the light of data minimisation.

Authority / court

Bundesgerichtshof (VI. Zivilsenat)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 82 Abs. 1 DSGVO

Action

Other

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

18 Nov 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Coimisiún na Meán (Ireland’s media and online safety regulator) determined that the services of TikTok, X and Meta (Instagram) are exposed to terrorist content after they had received at least two final removal orders from EU authorities within twelve months. The providers must take specific measures against the dissemination of terrorist content and report on them.

Authority / court

Coimisiún na Meán (irische Medien- und Online-Sicherheitsaufsicht)

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2021/784 (Terrorist Content Online Regulation): Einstufung als exponiert, spezifische Maßnahmen

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Meta stored users' passwords unencrypted in plaintext in internal systems and reported this to Ireland's Data Protection Commission (DPC) in March 2019. The DPC found infringements of the security obligations (Art. 5(1)(f), Art. 32(1)) and of the notification and documentation obligations (Art. 33(1) and (5)), and additionally issued a reprimand.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 und 5

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

According to the DPC, the passwords were not disclosed to external third parties.

Published

27 Sep 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Booking.com, with a market share of 70–90 % in online hotel booking in Spain, imposed unfair conditions such as price parity clauses and obstructed other online travel agencies through ranking criteria (Expediente S/0005/21). The CNMC imposed a fine of 413.24 million EUR.

Authority / court

Comisión Nacional de los Mercados y la Competencia (CNMC)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 2 LDC, Art. 102 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

30 Jul 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Acting on complaints from France and Poland, the Valstybinė duomenų apsaugos inspekcija (Lithuanian State Data Protection Inspectorate, VDAI) found that the second-hand platform rejected erasure requests when users did not state a ‘specific reason’ under Art. 17 GDPR, throttled users without their knowledge through ‘shadow banning’ and could not demonstrate how it handled access requests. Fine of 2,385,276 EUR. Source: archived copy of the press release.

Authority / court

Valstybinė duomenų apsaugos inspekcija (VDAI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a, Art. 5 Abs. 2, Art. 12 Abs. 1 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

3 Jul 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The satellite radio provider advertised subscription prices without mandatory music licensing and administration fees, which increased the price by 10 to 20 %. Under the registered settlement, SiriusXM is paying a penalty of 3.3 million CAD and 30,000 CAD in investigation costs and must improve its compliance programme.

Authority / court

Competition Bureau Canada (Consent Agreement beim Competition Tribunal)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Competition Act, Deceptive Marketing Practices (Drip Pricing)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Resolution by agreement (consent agreement).

Published

5 Jun 2024

Original amount 3,300,000 CAD, converted at the ECB reference rate of 5 Jun 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The operator of the dating site Elittárs concealed the fact that free registrations did not allow a genuine search for a partner (no profile pictures, no messages) and advertised user numbers that were not attainable for Hungarian customers. Following acknowledgement, the Gazdasági Versenyhivatal (Hungarian Competition Authority, GVH) imposed an almost halved fine of 169 million HUF.

Authority / court

Gazdasági Versenyhivatal (GVH)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Verbot unlauterer Geschäftspraktiken (VJ/16/2022)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Cooperation, acknowledgement and waiver of legal remedies.

Published

19 Dec 2023

Original amount 169,000,000 HUF, converted at the ECB reference rate of 19 Dec 2023.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2015–2019, the collecting society charged hotels and guesthouses unreasonably high licence fees for the performance of works via television and radio sets in guest rooms. The Council of the Protimonopolný úrad Slovenskej republiky (Antimonopoly Office of the Slovak Republic, PMÚ SR) upheld the fine of 57,939 EUR; final since 27 October 2023.

Authority / court

Protimonopolný úrad Slovenskej republiky (PMÚ SR)

Area of law

Competition law · Abuse of market power

Legal basis

Slowakisches Wettbewerbsschutzgesetz, Art. 102 AEUV

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

31 Oct 2023

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From at least 2012 to 2017, the Chinese majority-owned subsidiary Clear Media bribed officials with expensive gifts and hospitality and used sham intermediaries and false invoices to fund concealed consultants in order to obtain advertising space, for example at bus stops; the payments were booked as entertainment, cleaning and customer development expenses. Despite repeated warnings from internal audit, adequate controls were lacking until 2019; Clear Channel paid 16,355,567 USD in disgorgement, 3,760,920 USD in interest and a civil penalty of 6 million USD (a total of 26,116,487 USD).

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Foreign Corrupt Practices Act (Anti-Bribery, Books and Records, Internal Accounting Controls)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Original amount 26,116,487 USD, converted at the ECB reference rate of 28 Sep 2023.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report