Who was sanctioned, and for what?

In 2022–2024, the delivery service used a standard clause to prohibit restaurants from being cheaper on their own channels than on Wolt, while at the same time being able to grant discounts without consultation and to compensate customers up to 400 DKK at the restaurants’ expense. The Konkurrencerådet (Danish Competition Council) ordered the practice to cease, required Wolt to inform all restaurants and intends to enforce a fine through the courts.

Authority / court

Konkurrencerådet (Danish Competition Council)

Area of law

Competition law · Abuse of market power

Legal basis

Konkurrenceloven; AEUV Art. 102

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Published

26 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Agência Nacional de Proteção de Dados (ANPD, Brazilian data protection authority) imposed three fines totalling 153,769,671.33 BRL on ByteDance Brasil Tecnologia Ltda., which operates TikTok in Brazil (63,176,686.67 BRL each for breaches of Art. 7 and Art. 6 VIII LGPD, and 27,416,297.99 BRL for Art. 6 X LGPD). According to the decision, data of children and adolescents were processed without a valid legal basis both in the feed available without registration and when accounts were created, and effective preventive and accountability measures were lacking. The authority also ordered the deletion of data of registered adolescents aged 13 to 18 whose legal representation is not regularised within 60 working days, backed by a daily penalty of 137,081.49 BRL for each day of delay.

Authority / court

Agência Nacional de Proteção de Dados (ANPD), Superintendência de Fiscalização

Area of law

Data protection

Legal basis

Art. 6 VIII, Art. 6 X und Art. 7 LGPD (Lei nº 13.709/2018); Sanktionen nach Art. 52 LGPD; Resolução CD/ANPD nº 4/2023 (Regulamento de Dosimetria)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

25 Aug 2026

Original amount 153,769,671.33 BRL, converted at the ECB reference rate of 24 Aug 2026.

Checked against the official source on 3 Oct 2026 · Direct link

Despite promising no hidden fees, the travel app, according to the FTC, charged tips and fees for a VIP support service without consent because they were hidden and pre-selected, and misled users about total prices and the benefits of VIP support and price freezing. The court order against the Canadian Hopper Inc. and its US subsidiary sets 35 million USD, payable in twelve instalments. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Section 5 FTC Act; Rule on Unfair or Deceptive Fees (16 C.F.R. Part 464)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Media and online platforms

Published

2 Jul 2026

Original amount 35,000,000 USD, converted at the ECB reference rate of 20 Aug 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The Nederlandse Arbeidsinspectie (Netherlands Labour Authority) imposed fines totalling 153,300 EUR on a platform for freelancers and nine companies that used it to deploy foreign workers without a right to work in hospitality and education: 146,500 EUR under the Wav (Foreign Nationals Employment Act) (platform 66,000 EUR, the nine hirers 4,000 to 27,000 EUR each, together 80,500 EUR) and 6,800 EUR under the Waadi (Placement of Personnel by Intermediaries Act) (platform 3,400 EUR, two hirers 2,000 and 1,400 EUR). The platform regarded itself merely as an intermediary; based on how it actually operated, the Labour Authority classed it as an employer under the broad Wav definition.

Authority / court

Nederlandse Arbeidsinspectie

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

Wet arbeid vreemdelingen (Wav); Wet allocatie arbeidskrachten door intermediairs (Waadi)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

13 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

SNOW Japan, to which South Korea's Snow Corporation had left decisions on advertising content in Japan for the jointly offered service, had users of X publish posts about the AI image functions of the 'SNOW' app from April 2025 onwards, for payment and following its instructions, without making the commission recognisable; the posts were treated as advertising by both companies. On 6 August 2026 each of them received an order to stop the display of posts still online, inform consumers and take measures to prevent recurrence.

Authority / court

Consumer Affairs Agency (消費者庁, CAA)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 7 Abs. 1 i. V. m. Art. 5 Nr. 3 (Bekanntmachung zu Stealth-Marketing) Act against Unjustifiable Premiums and Misleading Representations (不当景品類及び不当表示防止法, Gesetz Nr. 134/1962)

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Published

6 Aug 2026

Checked against the official source on 4 Oct 2026 · Direct link

In the programme ‘Sport aktuell’ on ORF 1 on 29 July 2025, a logo wall was visible as product placement without being labelled. The Austrian Communications Authority (Kommunikationsbehörde Austria, KommAustria) found, with final effect, a violation of the ORF Act (ORF-Gesetz).

Authority / court

Kommunikationsbehörde Austria (KommAustria)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 16 Abs. 5 Z 4 ORF-G

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Published

29 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

On 24 July 2026 Arcom imposed a fine of EUR 200,000 on Société d'exploitation d'un service d'information (SESI), the operator of the news channel CNews. In Arcom's view, two programmes broadcast in June and September 2025 contained statements about people of (presumed) immigrant background and Muslims, without sufficient context or challenge, that were capable of inciting hatred and discrimination; Arcom considered this a breach of Article 15 of Law No 86-1067 and of the channel's contractual obligations on non-discrimination and control of its programming. In setting the amount, Arcom took into account earlier sanctions against SESI for breaches of the same obligations in 2021 and 2024. Arcom did not sanction a third programme it examined. Whether the decision has been appealed is not known here.

Authority / court

Autorité de régulation de la communication audiovisuelle et numérique (Arcom)

Area of law

Other

Legal basis

Art. 15, 42-1 und 42-2 Loi n° 86-1067 du 30 septembre 1986 (liberté de communication); Art. 2-2-1 und 2-3-2 der Vereinbarungen vom 27. November 2019 und 10. Dezember 2024

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Published

29 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

At the request of the press association Alliance de la Presse d’Information Générale (APIG), the Autorité de la concurrence (French Competition Authority) imposed interim measures on Meta because its conduct in negotiations on remuneration for press publishers’ neighbouring rights could amount to an abuse of a dominant position. Meta must negotiate in good faith on remuneration for all Meta services from 1 February 2025, provide the information needed for the assessment within 15 days, must not degrade the display of press content during the negotiations and must report to the authority monthly. On the same day a similar decision (26-MC-02) was issued at the request of the collective management organisation DVP.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. L. 464-1 Code de commerce (mesures conservatoires); vorläufige Würdigung nach Art. L. 420-2 Code de commerce und Art. 102 AEUV; Art. L. 218-4 Code de la propriété intellectuelle

Action

Order

Status of proceedings

under appeal

Sector

Media and online platforms

Employees

10,000 or more

Published

8 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

In its flight booking flow, Agoda Company Pte. Ltd. did not show clearly whether a ticket was refundable and which cancellation or change fees applied – the information could only be reached via a link to baggage rules – and, for accommodation paid later, displayed a price without the possible surcharge of up to 5%, partly in a foreign currency. The authority regarded this as a breach of the duty to explain key terms under the Telecommunications Business Act (전기통신사업법), imposed a fine of 2,424,000,000 KRW and ordered Agoda to show conditions, fees and final prices early and clearly, to check screen flows internally in advance and to have Korean translations reviewed by professionals.

Authority / court

Korea Media and Communications Commission (KMCC, 방송미디어통신위원회)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Telecommunications Business Act (전기통신사업법) Art. 50(1) Nr. 5-2, Art. 52, Art. 53; Enforcement Decree Art. 42 i. V. m. Anhang 4

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

no

Mitigating circumstances

Reduction of 10% because the authority had not imposed a fine in the preceding three years; partial voluntary corrections made after the investigation began were not accepted as a mitigating factor.

Published

6 Jul 2026

Original amount 2,424,000,000 KRW, converted at the ECB reference rate of 6 Jul 2026.

Checked against the official source on 4 Oct 2026 · Direct link

After the Facebook page of the Danish fashion retailer Clothing By Ros ApS was hacked in 2023, Meta failed to respond appropriately for almost two years, gave no reasons for the de facto suspension and offered no effective complaint-handling procedure. The Konkurrencerådet (Danish Competition Council) found infringements of the P2B Regulation and ordered Meta to comply with the rules on statements of reasons and complaint handling in future.

Authority / court

Konkurrencerådet (Danish Competition Council)

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2019/1150 (P2B) Art. 4, Art. 11

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

24 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

The ticket exchange did not include mandatory fees in the total price at the start of the purchasing process. By way of a final infringement notice, the CMA imposed a penalty of 889,200 GBP (including a 40 % settlement discount) and required the company to refund the mandatory fees.

Authority / court

Competition and Markets Authority (CMA)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Digital Markets, Competition and Consumers Act 2024

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Settlement with a 40 % discount and waiver of appeal.

Published

23 Jun 2026

Original amount 889,200 GBP, converted at the ECB reference rate of 23 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

On 17 June 2026 the Competition Commission (Hong Kong's competition authority) accepted a commitment from Kangaroo Limited, which operates the Keeta food delivery platform in Hong Kong and is a subsidiary of Meituan. The authority was concerned that clauses in Keeta's agreements with partner restaurants made access harder for new and small platforms and softened competition – a possible breach of the First Conduct Rule (the ban on anti-competitive agreements). Keeta had already amended the agreements voluntarily (cooperation with platforms of up to 10% market share without losing incentives, easier switching, no bar on lower prices on the restaurants' own channels and on rival platforms); with the acceptance, these changes are legally binding and enforceable by the authority until 28 December 2026.

Authority / court

Competition Commission (Hongkong)

Area of law

Competition law

Legal basis

Competition Ordinance (Cap. 619), s. 6 (First Conduct Rule); Annahme einer Verpflichtungszusage nach s. 60

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Published

17 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

The European Commission ordered Meta to restore access for rival general-purpose AI assistants to the WhatsApp for Business interface on the terms in place before 15 October 2025, i.e. free of charge, and to maintain it until the final decision. The Commission found a prima facie abuse of a dominant position in consumer communication apps, because Meta had first excluded third-party assistants and later charged a fee with practically the same effect; the measures had to be implemented within five working days.

Authority / court

Europäische Kommission

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV; Art. 54 EWR-Abkommen; Art. 8 Abs. 1 VO (EG) Nr. 1/2003

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

9 Jun 2026

Checked against the official source on 28 Sep 2026 · Direct link

On 7 November 2025, the publisher's news portals Origo and Magyar Nemzet linked to a map, created by unknown persons, containing the names, addresses, telephone numbers, email addresses, geo-coordinates and political preferences of Tisza sympathisers; Ripost showed an image with the name of the map. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found intentional infringements of Art. 6 and 9 GDPR, prohibited further dissemination and imposed 50 million HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection

Legal basis

DSGVO Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 58 Abs. 2 lit. b und f

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Culpability

intentional

Published

26 May 2026

Original amount 50,000,000 HUF, converted at the ECB reference rate of 26 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The publisher kept data of around 685,000 former book club members in a ‘passive database’, in around 395,000 cases more than ten years after they had left, without any deletion rules. The Danish Data Protection Agency (Datatilsynet) had recommended a fine of 1 million DKK in 2022; the case was closed on 14 April 2026 with a fine notice whose amount is not stated in the source.

Authority / court

Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet

Area of law

Data protection

Legal basis

DSGVO Art. 5 Abs. 1 lit. e, Art. 5 Abs. 2

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Cooperative conduct; only two employees had access to the passive database; deletion after the supervisory visit.

Checked against the official source on 25 Sep 2026 · Direct link

According to the FTC, StubHub displayed ticket prices on its website without clearly and conspicuously stating up front the total price including all mandatory fees. The court order relies on the new FTC rule against unfair or deceptive fees and requires StubHub to pay 10 million USD for consumer refunds. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Section 5 FTC Act; Rule on Unfair or Deceptive Fees (16 C.F.R. Part 464)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Media and online platforms

Published

9 Apr 2026

Checked against the official source on 3 Oct 2026 · Direct link

According to the AGCM, the review platform did not adequately check whether reviews – including those labelled as "verified" – were genuine, and allowed companies to invite specifically selected customers to leave reviews via paid services, which undermined the representativeness of the star ratings. In addition, information on how the platform works and on paid services was lacking; the authority also saw dark pattern elements in this.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Artt. 20, 21, 22 e 23, comma 1, lett. bb-ter Codice del Consumo

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

23 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

From March 2020 to May 2021, the operator of ss.lv/ss.com (market share over 60%) deleted advertisements and blocked accounts of users – mainly car dealers and estate agents – who also advertised on the competing platform pp.lv; anyone wishing to register with an inbox.lv address additionally had to provide a different e-mail address. The Konkurences padome (Latvian Competition Council) considered this an abuse of a dominant position (Art. 102 TFEU), imposed 186,780.65 EUR and required objective criteria for dealing with customers.

Authority / court

Konkurences padome (Lettischer Wettbewerbsrat)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

18 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

The ICO fined Reddit, Inc. £14,472,500. The regulator found that the platform did not use any robust age assurance and therefore had no lawful basis for processing the personal data of children under 13. The ICO also found that Reddit had not carried out a data protection impact assessment on the risks to children before January 2025. The ICO found infringements of Articles 5(1)(a), 6, 8 and 35 UK GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 5(1)(a), 6, 8 und 35 UK GDPR; section 155 DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Original amount 14,472,500 GBP, converted at the ECB reference rate of 23 Feb 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Since 2019, the delivery platform had required scans or photos of its users’ identity cards and passports in cases of suspected fraud, relying on legitimate interests. The Prezes Urzędu Ochrony Danych Osobowych (President of Poland’s data protection authority, UODO) regarded this as processing without a legal basis and a breach of data minimisation, imposed 5,898,064 PLN and ordered the processing to stop and the data to be erased.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 5 Abs. 2, Art. 6 Abs. 1 DSGVO (DKN.5112.33.2022)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

16 Mar 2026

Original amount 5,898,064 PLN, converted at the ECB reference rate of 19 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The Bundeskartellamt (Federal Cartel Office) declared binding commitments by Check24 GmbH under which the comparison website gives up price parity clauses when brokering electricity and gas contracts: energy suppliers may offer their tariffs more cheaply via other websites and their own sales channels without the contractual relationship, commission or ranking depending on it (no 'dimming'). In its preliminary assessment the authority had concerns under Articles 101 and 102 TFEU and Sections 1, 19 and 20 of the German Competition Act (GWB).

Authority / court

Bundeskartellamt

Area of law

Competition law · Abuse of market power

Legal basis

§ 32b Abs. 1 GWB (Verpflichtungszusagen); Bedenken nach Art. 101, 102 AEUV, §§ 1, 19, 20 GWB (Az. B8-40/25)

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Published

24 Feb 2026

Checked against the official source on 2 Oct 2026 · Direct link

So that bpost would obtain the state concession for newspaper delivery for 2023–2027, its competitor PPP refrained from submitting a bid and in return received additional delivery volumes from DPG Media and Mediahuis (bid rigging). In a settlement procedure, the Autorité belge de la Concurrence / Belgische Mededingingsautoriteit (Belgian Competition Authority, BMA) imposed 3,786,574 EUR (DPG Media), 7,788,423 EUR (Mediahuis) and 323,486 EUR (PPP); bpost, as leniency applicant, received full immunity.

Authority / court

Autorité belge de la Concurrence / Belgische Mededingingsautoriteit (BMA)

Area of law

Competition law · Cartels and collusion

Legal basis

Code de droit économique Art. IV.1; AEUV Art. 101

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Leniency programme (immunity for bpost; reductions of 50% and 40% for DPG Media and Mediahuis respectively) and 10% settlement reduction.

Liability of senior managers

Measures against individuals are not reported here.

Published

13 Feb 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Disney implemented objections to the sale and sharing of data only for individual services or devices rather than across the whole account, continued to disclose data via embedded ad-tech providers and offered no opt-out in connected TV apps. It was the largest CCPA settlement at the time of the agreement with the Attorney General of California.

Authority / court

Attorney General of California (California Department of Justice)

Area of law

Data protection · Cookies and tracking

Legal basis

California Consumer Privacy Act (CCPA)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Published

11 Feb 2026

Original amount 2,750,000 USD, converted at the ECB reference rate of 11 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The CADE Tribunal found that the Libra league, as a joint venture of clubs for the joint commercialisation of broadcasting and commercial rights, was notifiable and had been implemented before clearance, and approved a settlement (Acordo em APAC) with Libra and Flamengo, Palmeiras, Santos, São Paulo and Grêmio with an alleged pecuniary contribution of 559,267.26 BRL. The parties must notify the transactions already completed within 60 days and report changes to their commercialisation structures for three years; for the rival league FFU (formerly LFU) no infringement was found because the turnover thresholds were not met. The amount and the facts have not been confirmed against the primary source.

Authority / court

Conselho Administrativo de Defesa Econômica (CADE), Tribunal Administrativo

Area of law

Competition law · Merger control

Legal basis

Art. 88 § 3 Lei nº 12.529/2011

Action

Other

Status of proceedings

final

Sector

Media and online platforms

Published

11 Feb 2026

Original amount 559,267.26 BRL, converted at the ECB reference rate of 11 Feb 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The ICO fined MediaLab.AI, Inc., which operated the Imgur platform in the UK until 30 September 2025, £247,590. The ICO found that Imgur admitted children under 13, stated to be under parental supervision, and relied on consent as its lawful basis, but it had no way of establishing users' ages and therefore of obtaining the required parental consent. The ICO therefore found there was no valid lawful basis and also found that no data protection impact assessment had been carried out (Articles 5(1)(a), 6, 8 and 35 UK GDPR).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 5(1)(a), 6, 8 und 35 UK GDPR; section 155(1)(a) DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Original amount 247,590 GBP, converted at the ECB reference rate of 4 Feb 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The cinema company added a mandatory booking fee of 1.50 CAD to advertised ticket prices for online purchases. In September 2024, the Competition Tribunal classified this as drip pricing and imposed a penalty of 38.9 million CAD (the amount Cineplex had earned from it between June 2022 and December 2023) plus a ten-year prohibition; the Federal Court of Appeal dismissed the appeal in January 2026.

Authority / court

Federal Court of Appeal / Competition Tribunal (auf Antrag des Competition Bureau)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Competition Act, Deceptive Marketing Practices (Drip Pricing, seit 24.06.2022 ausdrücklich geregelt)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

23 Jan 2026

Original amount 38,900,000 CAD, converted at the ECB reference rate of 21 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

On a complaint filed by the U.S. Department of Justice on behalf of the FTC, the federal district court for the Central District of California entered an order against two Disney companies. Disney is alleged to have failed to label child-directed videos on YouTube as 'Made for Kids' because it designated audiences only at channel level; as a result, data from children under 13 could be collected via YouTube without notice to and consent from their parents and used for targeted advertising. Disney pays a civil penalty of 10,000,000 USD and must set up a programme for reviewing and designating the audience of its videos. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Federal Trade Commission (FTC); Klage durch das U.S. Department of Justice, Anordnung des U.S. District Court for the Central District of California

Area of law

Data protection · Marketing and consent

Legal basis

COPPA Rule, 16 C.F.R. Part 312; Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c), 6505(d); Verfahren nach 15 U.S.C. §§ 45(m)(1)(A), 53(b)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Published

31 Dec 2025

Original amount 10,000,000 USD, converted at the ECB reference rate of 23 Dec 2025.

Checked against the official source on 3 Oct 2026 · Direct link

The Ministerio de Derechos Sociales, Consumo y Agenda 2030 (Spanish Ministry of Social Rights, Consumer Affairs and 2030 Agenda) imposed fines totalling 64,055,311 EUR on the holiday rental platform Airbnb, mainly because 65,122 listings advertised holiday homes without a licence, with a non-matching registration number or without accurate information on the legal status of the hosts (63,980,311 EUR, six times the unlawful profit). In addition, 10,000 EUR were imposed for missing information on distance contracts, 10,000 EUR for unanswered information requests and 55,000 EUR for failing to comply with interim orders; Airbnb must also remove the unlawful content and publish the sanction. The decision is not final.

Authority / court

Ministerio de Derechos Sociales, Consumo y Agenda 2030

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 47.1 Buchst. m), t), i) und o) Texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios (Real Decreto Legislativo 1/2007)

Action

Fine

Status of proceedings

under appeal

Sector

Media and online platforms

Published

15 Dec 2025

Checked against the official source on 28 Sep 2026 · Direct link

First non-compliance decision under the Digital Services Act (DSA): the European Commission imposed 120 million EUR on X because the purchasable ‘verified’ checkmark deceives users, the advertising repository lacks essential information (content, topic, advertiser) and researchers are denied access to public data. X must present remedies within 60 working days and an action plan within 90 working days respectively.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/2065 (DSA), Art. 25 Abs. 1, Art. 39, Art. 40 Abs. 12

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

5 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Following preliminary findings in May 2025 that TikTok’s advertising repository did not meet the requirements of the Digital Services Act, the European Commission declared commitments binding: complete ad content including links, updates within 24 hours, disclosure of targeting criteria with aggregated reach data and improved search functions. Depending on the commitment, implementation must take place within 2 to 12 months; breaches of the commitments count as breaches of the DSA.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Digital Services Act (Verordnung (EU) 2022/2065): Pflicht zum Werbearchiv; verbindliche Zusagen nach Art. 71

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

On the Romanian marketplace publi24.ro, a fake advert appeared with photos and the telephone number of a woman, claiming that she offered sexual services. The Court of Justice of the European Union (Grand Chamber, Case C-492/23) ruled that the operator is a controller within the meaning of the GDPR, must identify adverts containing sensitive data before publication and verify identity or consent, and cannot rely on the liability exemption of the E-Commerce Directive.

Authority / court

Gerichtshof der Europäischen Union (Große Kammer), Rs. C-492/23

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO (Verantwortlicher, Art. 9, Art. 32); Richtlinie 2000/31/EG

Status of proceedings

unknown

Sector

Media and online platforms

Published

2 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

On a complaint by the California Attorney General, the Superior Court in Los Angeles entered a stipulated judgment against the mobile game developer Jam City. According to the investigation, none of Jam City's 21 apps offered a way, as required by the California Consumer Privacy Act (CCPA), to opt out of the sale or sharing of personal data for personalised advertising, and some games passed on data of teenagers aged between 13 and 16 without their affirmative consent. Jam City pays 1,400,000 USD, must offer opt-out options within the apps, may only sell or share data of under-16s on an opt-in basis and must instruct recipients to delete such data. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Superior Court of California, County of Los Angeles, auf Klage des Attorney General of California (California Department of Justice)

Area of law

Data protection · Data subject rights and transparency

Legal basis

California Consumer Privacy Act (CCPA), Cal. Civ. Code § 1798.100 ff.; Zahlung nach Cal. Civ. Code § 1798.199.90

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

21 Nov 2025

Original amount 1,400,000 USD, converted at the ECB reference rate of 21 Nov 2025.

Checked against the official source on 3 Oct 2026 · Direct link

On vanityfair.fr, cookies requiring consent were set before any interaction with the banner, trackers were labelled as ‘strictly necessary’ and cookies continued to be placed even after ‘Reject all’. Following a complaint by noyb, the publisher had already received a formal notice in 2021; follow-up inspections in 2023 and 2025 by the French data protection authority (CNIL) showed continuing infringements.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 82 Loi Informatique et Libertés

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Published

27 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

In 2021, the Estonian parent company of Apollo cinemas acquired control of Forum Cinemas Lithuania before the notified merger had been cleared and integrated the cinemas in Vilnius and Kaunas into its network, even though the Konkurencijos taryba (Lithuanian Competition Council) had provisionally expressed competition concerns. Fine of 7,507,930 EUR (0.8% of consolidated worldwide turnover) and obligation to end the infringement within six months. Source: archived copy of the press release.

Authority / court

Konkurencijos taryba (Litauischer Wettbewerbsrat)

Area of law

Competition law · Merger control

Legal basis

Konkurencijos įstatymas (Vollzugsverbot bei Zusammenschlüssen)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

30 Oct 2025

Checked against the official source on 25 Sep 2026 · Direct link

The Comisión Nacional del Mercado de Valores (CNMV, Spanish securities market supervisor) fined Twitter International Unlimited Company 5,000,000 EUR for a continuing very serious breach of its duties to assist the supervisor. For the advertisements listed in a CNMV request of 8 November 2023, the company did not check whether the advertiser Quantum AI was authorised to provide investment services in Spain or appeared on warning lists of the CNMV or foreign supervisors; it waived administrative appeals.

Authority / court

Comisión Nacional del Mercado de Valores (CNMV)

Area of law

Capital markets and financial supervision

Legal basis

Art. 290.1.n) i. V. m. Art. 290.2.f) Ley 6/2023 de los Mercados de Valores y de los Servicios de Inversión

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

13 Nov 2025

Checked against the official source on 28 Sep 2026 · Direct link

In January 2025 attackers infected the work computer of an employee of the online job portal Incruit with malware, took over the employee’s database access and, until February 2025, extracted data on all 7,275,843 members and 54,475 stored CVs, cover letters and copies of certificates (438 GB in total). Despite conspicuous database access outside business hours, the company only noticed the leak through an extortion message; it had already been sanctioned in July 2023 for inadequate access controls. The authority imposed a penalty surcharge of 463,000,000 KRW and ordered the appointment of a qualified chief privacy officer and a plan to prevent further incidents and support those affected.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29; Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Mitigating circumstances

Reduction of 55% because no benefit was derived and the company is a medium-sized enterprise under the Korean Framework Act on Small and Medium Enterprises, and a further 20% for cooperation, remediation and self-regulation; increase of 65% because the infringement lasted more than two years and because of the July 2023 sanction.

Liability of senior managers

The company was ordered to appoint a new, qualified chief privacy officer (CPO) and to define the CPO’s responsibility clearly.

Published

23 Oct 2025

Original amount 463,000,000 KRW, converted at the ECB reference rate of 22 Oct 2025.

Checked against the official source on 4 Oct 2026 · Direct link

After both hosting services had received at least two final removal orders from EU authorities within twelve months, Coimisiún na Meán (Ireland’s media and online safety regulator) designated them as exposed to terrorist content under the TCO Regulation. They must take specific protective measures and report on them within three months; the regulator assesses their effectiveness.

Authority / court

Coimisiún na Meán (irische Medien- und Online-Sicherheitsaufsicht)

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2021/784 (Terrorist Content Online Regulation): Einstufung als exponiert, spezifische Maßnahmen

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Checked against the official source on 25 Sep 2026 · Direct link

The CMA objected that, during the Oasis presale, fans in the queue were not told that standing tickets were being sold at two price levels, and that "Platinum" tickets cost almost 2.5 times as much without it being adequately explained that they offered no added value compared with some standard tickets. Without admitting liability, Ticketmaster gave undertakings: advance notice of tiered pricing, price ranges in the queue, no misleading ticket descriptions and a two-year reporting obligation.

Authority / court

Competition and Markets Authority (CMA)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Britisches Verbraucherschutzrecht (Verfahren nach den vor April 2025 geltenden Befugnissen; Verpflichtungszusagen)

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

Undertakings without admission of liability.

Published

25 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

The joint investigation by the Office of the Privacy Commissioner of Canada and the supervisory authorities of Québec, British Columbia and Alberta found that every year hundreds of thousands of children used the platform despite the minimum age of 13, and that TikTok processed data without valid consent, including for profiling and advertising. TikTok undertook to improve age verification and make privacy notices easier to understand, and already during the investigation largely stopped targeted advertising to under-18s (except by broad categories such as language and approximate location).

Authority / court

Office of the Privacy Commissioner of Canada gemeinsam mit den Aufsichten von Québec, British Columbia und Alberta

Area of law

Data protection · Marketing and consent

Legal basis

PIPEDA und Datenschutzgesetze für den Privatsektor von Québec, British Columbia und Alberta

Action

Other

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

23 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

According to the European Commission's findings, Google had, since at least 2014, abused its dominant position in publisher ad servers (DFP) and in programmatic ad buying tools (Google Ads, DV360) by favouring its own ad exchange AdX, for example by informing it in advance of the best rival bid. In addition to the fine of €2.95bn, the Commission ordered Google to end the self-preferencing and to propose measures against the conflicts of interest along the adtech supply chain; earlier fines imposed on Google for abuse of dominance were taken into account.

Authority / court

Europäische Kommission

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV; Art. 54 EWR-Abkommen

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Repeat case

yes

Published

5 Sep 2025

Checked against the official source on 28 Sep 2026 · Direct link