Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe and North America: 756 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

EUIrelandMedia and online platforms Clear all filters
5cases from 1 jurisdiction
€872mTotal of monetary amounts (3 cases with an amount)
€530mLargest single case: TikTok Technology Limited
€251mMedian per case with an amount

Click a bar to drill down one level.

by amountby number of cases

Where?

by authority
  1. Data Protection Commission (DPC) €872m 100 % · 3 cases
  2. Coimisiún na Meán (irische Medien- und Online-Sicherheitsaufsicht) — 0 % · 2 cases

What for?

by area of law

All areas of law

  1. Data protection €872m 100 % · 3 cases
  2. AI and digital regulation — 0 % · 2 cases

Who?

by company
  1. TikTok Technology Limited €530m 61 % · 1 case
  2. Meta Platforms Ireland Limited €342m 39 % · 2 cases
  3. TikTok, X und Meta (Instagram) — 0 % · 1 case
  4. WhatsApp Ireland Limited (Dienst „Channels“) und Pinterest — 0 % · 1 case

When?

per quarter, by date of decision
Trend
PeriodCasesTotal
Q3 20230—
Q4 20230—
Q1 20240—
Q2 20240—
Q3 20241€91m
Q4 20242€251m
Q1 20250—
Q2 20251€530m
Q3 20250—
Q4 20251—
Q1 20260—
Q2 20260—
Q3 20260—

5 cases

Newest firstHighest amounts
17 Oct 2025 WhatsApp Ireland Limited (Dienst „Channels“) und PinterestWhatsApp (Channels) and Pinterest: designated as ‘exposed to terrorist content’ IrelandPlatform obligations Order

After both hosting services had received at least two final removal orders from EU authorities within twelve months, Coimisiún na Meán (Ireland’s media and online safety regulator) designated them as exposed to terrorist content under the TCO Regulation. They must take specific protective measures and report on them within three months; the regulator assesses their effectiveness.

What organisations can take from it

Repeated removal orders trigger additional, monitored prevention obligations for platforms – content moderation must be prepared for this.

Authority / court
Coimisiún na Meán (irische Medien- und Online-Sicherheitsaufsicht)
Area of law
AI and digital regulation · Platform obligations
Legal basis
Verordnung (EU) 2021/784 (Terrorist Content Online Regulation): Einstufung als exponiert, spezifische Maßnahmen
Action
Order
Status of proceedings
unknown
Sector
Media and online platforms
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

2 May 2025 TikTok Technology LimitedDPC: 530 million EUR against TikTok over data access from China IrelandInternational data transfers €530m

TikTok allowed employees in China to access European users' data remotely without assessing and demonstrating that standard contractual clauses and supplementary measures ensured an equivalent level of protection against access by Chinese authorities; it also informed users inadequately. Ireland's Data Protection Commission (DPC) imposed 530 million EUR and ordered that the transfers be brought into compliance or suspended within six months.

What organisations can take from it

Even mere remote access from a third country is a transfer – without a documented transfer impact assessment, fines and a suspension order loom.

Authority / court
Data Protection Commission (DPC)
Area of law
Data protection · International data transfers
Legal basis
Art. 46 Abs. 1, Art. 13 DSGVO
Action
Fine
Status of proceedings
unknown
Sector
Media and online platforms
Employees
10,000 or more
Published
2 May 2025
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

17 Dec 2024 Meta Platforms Ireland LimitedIreland: 251 million EUR against Meta over data breach and deficient notification IrelandData breaches and data security €251m

In 2018, attackers exploited a flaw in the ‘View As’ feature and gained access to around 29 million accounts, of which around 3 million were in the EEA. Ireland's Data Protection Commission (DPC) imposed 8 million EUR (Art. 33(3)) and 3 million EUR (Art. 33(5)) for incomplete notification and documentation, as well as 130 million EUR and 110 million EUR for infringements of data protection by design (Art. 25(1) and (2)).

What organisations can take from it

Make data breach notifications complete, and document every breach internally in a traceable manner.

Authority / court
Data Protection Commission (DPC)
Area of law
Data protection · Data breaches and data security
Legal basis
DSGVO Art. 33 Abs. 3 und 5, Art. 25 Abs. 1 und 2
Action
Fine
Status of proceedings
unknown
Sector
Media and online platforms
Employees
10,000 or more
Published
17 Dec 2024
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

13 Nov 2024 TikTok, X und Meta (Instagram)TikTok, X and Instagram: Irish regulator requires measures against terrorist content IrelandPlatform obligations Order

Coimisiún na Meán (Ireland’s media and online safety regulator) determined that the services of TikTok, X and Meta (Instagram) are exposed to terrorist content after they had received at least two final removal orders from EU authorities within twelve months. The providers must take specific measures against the dissemination of terrorist content and report on them.

What organisations can take from it

Platforms should record removal orders centrally – from the second within twelve months, additional obligations monitored by the regulator loom.

Authority / court
Coimisiún na Meán (irische Medien- und Online-Sicherheitsaufsicht)
Area of law
AI and digital regulation · Platform obligations
Legal basis
Verordnung (EU) 2021/784 (Terrorist Content Online Regulation): Einstufung als exponiert, spezifische Maßnahmen
Action
Order
Status of proceedings
unknown
Sector
Media and online platforms
Employees
10,000 or more
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

26 Sep 2024 Meta Platforms Ireland LimitedIreland: 91 million EUR against Meta over plaintext passwords IrelandData breaches and data security €91m

Meta stored users' passwords unencrypted in plaintext in internal systems and reported this to Ireland's Data Protection Commission (DPC) in March 2019. The DPC found infringements of the security obligations (Art. 5(1)(f), Art. 32(1)) and of the notification and documentation obligations (Art. 33(1) and (5)), and additionally issued a reprimand.

What organisations can take from it

Never store or log passwords in plaintext – not even in internal systems.

Authority / court
Data Protection Commission (DPC)
Area of law
Data protection · Data breaches and data security
Legal basis
DSGVO Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 und 5
Action
Fine
Status of proceedings
unknown
Sector
Media and online platforms
Employees
10,000 or more
Mitigating circumstances
According to the DPC, the passwords were not disclosed to external third parties.
Published
27 Sep 2024
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

Ready for training that sticks?

Try it free for 14 days — from 1 user, no credit card, ends automatically.

Start free trial