Who was sanctioned, and for what?

In 2022–2024, the delivery service used a standard clause to prohibit restaurants from being cheaper on their own channels than on Wolt, while at the same time being able to grant discounts without consultation and to compensate customers up to 400 DKK at the restaurants’ expense. The Konkurrencerådet (Danish Competition Council) ordered the practice to cease, required Wolt to inform all restaurants and intends to enforce a fine through the courts.

Authority / court

Konkurrencerådet (Danish Competition Council)

Area of law

Competition law · Abuse of market power

Legal basis

Konkurrenceloven; AEUV Art. 102

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Published

26 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Agência Nacional de Proteção de Dados (ANPD, Brazilian data protection authority) imposed three fines totalling 153,769,671.33 BRL on ByteDance Brasil Tecnologia Ltda., which operates TikTok in Brazil (63,176,686.67 BRL each for breaches of Art. 7 and Art. 6 VIII LGPD, and 27,416,297.99 BRL for Art. 6 X LGPD). According to the decision, data of children and adolescents were processed without a valid legal basis both in the feed available without registration and when accounts were created, and effective preventive and accountability measures were lacking. The authority also ordered the deletion of data of registered adolescents aged 13 to 18 whose legal representation is not regularised within 60 working days, backed by a daily penalty of 137,081.49 BRL for each day of delay.

Authority / court

Agência Nacional de Proteção de Dados (ANPD), Superintendência de Fiscalização

Area of law

Data protection

Legal basis

Art. 6 VIII, Art. 6 X und Art. 7 LGPD (Lei nº 13.709/2018); Sanktionen nach Art. 52 LGPD; Resolução CD/ANPD nº 4/2023 (Regulamento de Dosimetria)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

25 Aug 2026

Original amount 153,769,671.33 BRL, converted at the ECB reference rate of 24 Aug 2026.

Checked against the official source on 3 Oct 2026 · Direct link

Despite promising no hidden fees, the travel app, according to the FTC, charged tips and fees for a VIP support service without consent because they were hidden and pre-selected, and misled users about total prices and the benefits of VIP support and price freezing. The court order against the Canadian Hopper Inc. and its US subsidiary sets 35 million USD, payable in twelve instalments. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Section 5 FTC Act; Rule on Unfair or Deceptive Fees (16 C.F.R. Part 464)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Media and online platforms

Published

2 Jul 2026

Original amount 35,000,000 USD, converted at the ECB reference rate of 20 Aug 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The Nederlandse Arbeidsinspectie (Netherlands Labour Authority) imposed fines totalling 153,300 EUR on a platform for freelancers and nine companies that used it to deploy foreign workers without a right to work in hospitality and education: 146,500 EUR under the Wav (Foreign Nationals Employment Act) (platform 66,000 EUR, the nine hirers 4,000 to 27,000 EUR each, together 80,500 EUR) and 6,800 EUR under the Waadi (Placement of Personnel by Intermediaries Act) (platform 3,400 EUR, two hirers 2,000 and 1,400 EUR). The platform regarded itself merely as an intermediary; based on how it actually operated, the Labour Authority classed it as an employer under the broad Wav definition.

Authority / court

Nederlandse Arbeidsinspectie

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

Wet arbeid vreemdelingen (Wav); Wet allocatie arbeidskrachten door intermediairs (Waadi)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

13 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

SNOW Japan, to which South Korea's Snow Corporation had left decisions on advertising content in Japan for the jointly offered service, had users of X publish posts about the AI image functions of the 'SNOW' app from April 2025 onwards, for payment and following its instructions, without making the commission recognisable; the posts were treated as advertising by both companies. On 6 August 2026 each of them received an order to stop the display of posts still online, inform consumers and take measures to prevent recurrence.

Authority / court

Consumer Affairs Agency (消費者庁, CAA)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 7 Abs. 1 i. V. m. Art. 5 Nr. 3 (Bekanntmachung zu Stealth-Marketing) Act against Unjustifiable Premiums and Misleading Representations (不当景品類及び不当表示防止法, Gesetz Nr. 134/1962)

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Published

6 Aug 2026

Checked against the official source on 4 Oct 2026 · Direct link

In the programme ‘Sport aktuell’ on ORF 1 on 29 July 2025, a logo wall was visible as product placement without being labelled. The Austrian Communications Authority (Kommunikationsbehörde Austria, KommAustria) found, with final effect, a violation of the ORF Act (ORF-Gesetz).

Authority / court

Kommunikationsbehörde Austria (KommAustria)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 16 Abs. 5 Z 4 ORF-G

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Published

29 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

On 24 July 2026 Arcom imposed a fine of EUR 200,000 on Société d'exploitation d'un service d'information (SESI), the operator of the news channel CNews. In Arcom's view, two programmes broadcast in June and September 2025 contained statements about people of (presumed) immigrant background and Muslims, without sufficient context or challenge, that were capable of inciting hatred and discrimination; Arcom considered this a breach of Article 15 of Law No 86-1067 and of the channel's contractual obligations on non-discrimination and control of its programming. In setting the amount, Arcom took into account earlier sanctions against SESI for breaches of the same obligations in 2021 and 2024. Arcom did not sanction a third programme it examined. Whether the decision has been appealed is not known here.

Authority / court

Autorité de régulation de la communication audiovisuelle et numérique (Arcom)

Area of law

Other

Legal basis

Art. 15, 42-1 und 42-2 Loi n° 86-1067 du 30 septembre 1986 (liberté de communication); Art. 2-2-1 und 2-3-2 der Vereinbarungen vom 27. November 2019 und 10. Dezember 2024

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Published

29 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

At the request of the press association Alliance de la Presse d’Information Générale (APIG), the Autorité de la concurrence (French Competition Authority) imposed interim measures on Meta because its conduct in negotiations on remuneration for press publishers’ neighbouring rights could amount to an abuse of a dominant position. Meta must negotiate in good faith on remuneration for all Meta services from 1 February 2025, provide the information needed for the assessment within 15 days, must not degrade the display of press content during the negotiations and must report to the authority monthly. On the same day a similar decision (26-MC-02) was issued at the request of the collective management organisation DVP.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. L. 464-1 Code de commerce (mesures conservatoires); vorläufige Würdigung nach Art. L. 420-2 Code de commerce und Art. 102 AEUV; Art. L. 218-4 Code de la propriété intellectuelle

Action

Order

Status of proceedings

under appeal

Sector

Media and online platforms

Employees

10,000 or more

Published

8 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

In its flight booking flow, Agoda Company Pte. Ltd. did not show clearly whether a ticket was refundable and which cancellation or change fees applied – the information could only be reached via a link to baggage rules – and, for accommodation paid later, displayed a price without the possible surcharge of up to 5%, partly in a foreign currency. The authority regarded this as a breach of the duty to explain key terms under the Telecommunications Business Act (전기통신사업법), imposed a fine of 2,424,000,000 KRW and ordered Agoda to show conditions, fees and final prices early and clearly, to check screen flows internally in advance and to have Korean translations reviewed by professionals.

Authority / court

Korea Media and Communications Commission (KMCC, 방송미디어통신위원회)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Telecommunications Business Act (전기통신사업법) Art. 50(1) Nr. 5-2, Art. 52, Art. 53; Enforcement Decree Art. 42 i. V. m. Anhang 4

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

no

Mitigating circumstances

Reduction of 10% because the authority had not imposed a fine in the preceding three years; partial voluntary corrections made after the investigation began were not accepted as a mitigating factor.

Published

6 Jul 2026

Original amount 2,424,000,000 KRW, converted at the ECB reference rate of 6 Jul 2026.

Checked against the official source on 4 Oct 2026 · Direct link

After the Facebook page of the Danish fashion retailer Clothing By Ros ApS was hacked in 2023, Meta failed to respond appropriately for almost two years, gave no reasons for the de facto suspension and offered no effective complaint-handling procedure. The Konkurrencerådet (Danish Competition Council) found infringements of the P2B Regulation and ordered Meta to comply with the rules on statements of reasons and complaint handling in future.

Authority / court

Konkurrencerådet (Danish Competition Council)

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2019/1150 (P2B) Art. 4, Art. 11

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

24 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

The ticket exchange did not include mandatory fees in the total price at the start of the purchasing process. By way of a final infringement notice, the CMA imposed a penalty of 889,200 GBP (including a 40 % settlement discount) and required the company to refund the mandatory fees.

Authority / court

Competition and Markets Authority (CMA)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Digital Markets, Competition and Consumers Act 2024

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Settlement with a 40 % discount and waiver of appeal.

Published

23 Jun 2026

Original amount 889,200 GBP, converted at the ECB reference rate of 23 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

On 17 June 2026 the Competition Commission (Hong Kong's competition authority) accepted a commitment from Kangaroo Limited, which operates the Keeta food delivery platform in Hong Kong and is a subsidiary of Meituan. The authority was concerned that clauses in Keeta's agreements with partner restaurants made access harder for new and small platforms and softened competition – a possible breach of the First Conduct Rule (the ban on anti-competitive agreements). Keeta had already amended the agreements voluntarily (cooperation with platforms of up to 10% market share without losing incentives, easier switching, no bar on lower prices on the restaurants' own channels and on rival platforms); with the acceptance, these changes are legally binding and enforceable by the authority until 28 December 2026.

Authority / court

Competition Commission (Hongkong)

Area of law

Competition law

Legal basis

Competition Ordinance (Cap. 619), s. 6 (First Conduct Rule); Annahme einer Verpflichtungszusage nach s. 60

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Published

17 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

The European Commission ordered Meta to restore access for rival general-purpose AI assistants to the WhatsApp for Business interface on the terms in place before 15 October 2025, i.e. free of charge, and to maintain it until the final decision. The Commission found a prima facie abuse of a dominant position in consumer communication apps, because Meta had first excluded third-party assistants and later charged a fee with practically the same effect; the measures had to be implemented within five working days.

Authority / court

Europäische Kommission

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV; Art. 54 EWR-Abkommen; Art. 8 Abs. 1 VO (EG) Nr. 1/2003

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

9 Jun 2026

Checked against the official source on 28 Sep 2026 · Direct link

On 7 November 2025, the publisher's news portals Origo and Magyar Nemzet linked to a map, created by unknown persons, containing the names, addresses, telephone numbers, email addresses, geo-coordinates and political preferences of Tisza sympathisers; Ripost showed an image with the name of the map. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found intentional infringements of Art. 6 and 9 GDPR, prohibited further dissemination and imposed 50 million HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection

Legal basis

DSGVO Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 58 Abs. 2 lit. b und f

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Culpability

intentional

Published

26 May 2026

Original amount 50,000,000 HUF, converted at the ECB reference rate of 26 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The publisher kept data of around 685,000 former book club members in a ‘passive database’, in around 395,000 cases more than ten years after they had left, without any deletion rules. The Danish Data Protection Agency (Datatilsynet) had recommended a fine of 1 million DKK in 2022; the case was closed on 14 April 2026 with a fine notice whose amount is not stated in the source.

Authority / court

Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet

Area of law

Data protection

Legal basis

DSGVO Art. 5 Abs. 1 lit. e, Art. 5 Abs. 2

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Cooperative conduct; only two employees had access to the passive database; deletion after the supervisory visit.

Checked against the official source on 25 Sep 2026 · Direct link

According to the FTC, StubHub displayed ticket prices on its website without clearly and conspicuously stating up front the total price including all mandatory fees. The court order relies on the new FTC rule against unfair or deceptive fees and requires StubHub to pay 10 million USD for consumer refunds. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Section 5 FTC Act; Rule on Unfair or Deceptive Fees (16 C.F.R. Part 464)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Media and online platforms

Published

9 Apr 2026

Checked against the official source on 3 Oct 2026 · Direct link

According to the AGCM, the review platform did not adequately check whether reviews – including those labelled as "verified" – were genuine, and allowed companies to invite specifically selected customers to leave reviews via paid services, which undermined the representativeness of the star ratings. In addition, information on how the platform works and on paid services was lacking; the authority also saw dark pattern elements in this.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Artt. 20, 21, 22 e 23, comma 1, lett. bb-ter Codice del Consumo

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

23 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

From March 2020 to May 2021, the operator of ss.lv/ss.com (market share over 60%) deleted advertisements and blocked accounts of users – mainly car dealers and estate agents – who also advertised on the competing platform pp.lv; anyone wishing to register with an inbox.lv address additionally had to provide a different e-mail address. The Konkurences padome (Latvian Competition Council) considered this an abuse of a dominant position (Art. 102 TFEU), imposed 186,780.65 EUR and required objective criteria for dealing with customers.

Authority / court

Konkurences padome (Lettischer Wettbewerbsrat)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

18 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

The ICO fined Reddit, Inc. £14,472,500. The regulator found that the platform did not use any robust age assurance and therefore had no lawful basis for processing the personal data of children under 13. The ICO also found that Reddit had not carried out a data protection impact assessment on the risks to children before January 2025. The ICO found infringements of Articles 5(1)(a), 6, 8 and 35 UK GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 5(1)(a), 6, 8 und 35 UK GDPR; section 155 DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Original amount 14,472,500 GBP, converted at the ECB reference rate of 23 Feb 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Since 2019, the delivery platform had required scans or photos of its users’ identity cards and passports in cases of suspected fraud, relying on legitimate interests. The Prezes Urzędu Ochrony Danych Osobowych (President of Poland’s data protection authority, UODO) regarded this as processing without a legal basis and a breach of data minimisation, imposed 5,898,064 PLN and ordered the processing to stop and the data to be erased.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 5 Abs. 2, Art. 6 Abs. 1 DSGVO (DKN.5112.33.2022)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

16 Mar 2026

Original amount 5,898,064 PLN, converted at the ECB reference rate of 19 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The Bundeskartellamt (Federal Cartel Office) declared binding commitments by Check24 GmbH under which the comparison website gives up price parity clauses when brokering electricity and gas contracts: energy suppliers may offer their tariffs more cheaply via other websites and their own sales channels without the contractual relationship, commission or ranking depending on it (no 'dimming'). In its preliminary assessment the authority had concerns under Articles 101 and 102 TFEU and Sections 1, 19 and 20 of the German Competition Act (GWB).

Authority / court

Bundeskartellamt

Area of law

Competition law · Abuse of market power

Legal basis

§ 32b Abs. 1 GWB (Verpflichtungszusagen); Bedenken nach Art. 101, 102 AEUV, §§ 1, 19, 20 GWB (Az. B8-40/25)

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Published

24 Feb 2026

Checked against the official source on 2 Oct 2026 · Direct link

So that bpost would obtain the state concession for newspaper delivery for 2023–2027, its competitor PPP refrained from submitting a bid and in return received additional delivery volumes from DPG Media and Mediahuis (bid rigging). In a settlement procedure, the Autorité belge de la Concurrence / Belgische Mededingingsautoriteit (Belgian Competition Authority, BMA) imposed 3,786,574 EUR (DPG Media), 7,788,423 EUR (Mediahuis) and 323,486 EUR (PPP); bpost, as leniency applicant, received full immunity.

Authority / court

Autorité belge de la Concurrence / Belgische Mededingingsautoriteit (BMA)

Area of law

Competition law · Cartels and collusion

Legal basis

Code de droit économique Art. IV.1; AEUV Art. 101

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Leniency programme (immunity for bpost; reductions of 50% and 40% for DPG Media and Mediahuis respectively) and 10% settlement reduction.

Liability of senior managers

Measures against individuals are not reported here.

Published

13 Feb 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Disney implemented objections to the sale and sharing of data only for individual services or devices rather than across the whole account, continued to disclose data via embedded ad-tech providers and offered no opt-out in connected TV apps. It was the largest CCPA settlement at the time of the agreement with the Attorney General of California.

Authority / court

Attorney General of California (California Department of Justice)

Area of law

Data protection · Cookies and tracking

Legal basis

California Consumer Privacy Act (CCPA)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Published

11 Feb 2026

Original amount 2,750,000 USD, converted at the ECB reference rate of 11 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The CADE Tribunal found that the Libra league, as a joint venture of clubs for the joint commercialisation of broadcasting and commercial rights, was notifiable and had been implemented before clearance, and approved a settlement (Acordo em APAC) with Libra and Flamengo, Palmeiras, Santos, São Paulo and Grêmio with an alleged pecuniary contribution of 559,267.26 BRL. The parties must notify the transactions already completed within 60 days and report changes to their commercialisation structures for three years; for the rival league FFU (formerly LFU) no infringement was found because the turnover thresholds were not met. The amount and the facts have not been confirmed against the primary source.

Authority / court

Conselho Administrativo de Defesa Econômica (CADE), Tribunal Administrativo

Area of law

Competition law · Merger control

Legal basis

Art. 88 § 3 Lei nº 12.529/2011

Action

Other

Status of proceedings

final

Sector

Media and online platforms

Published

11 Feb 2026

Original amount 559,267.26 BRL, converted at the ECB reference rate of 11 Feb 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The ICO fined MediaLab.AI, Inc., which operated the Imgur platform in the UK until 30 September 2025, £247,590. The ICO found that Imgur admitted children under 13, stated to be under parental supervision, and relied on consent as its lawful basis, but it had no way of establishing users' ages and therefore of obtaining the required parental consent. The ICO therefore found there was no valid lawful basis and also found that no data protection impact assessment had been carried out (Articles 5(1)(a), 6, 8 and 35 UK GDPR).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 5(1)(a), 6, 8 und 35 UK GDPR; section 155(1)(a) DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Original amount 247,590 GBP, converted at the ECB reference rate of 4 Feb 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The cinema company added a mandatory booking fee of 1.50 CAD to advertised ticket prices for online purchases. In September 2024, the Competition Tribunal classified this as drip pricing and imposed a penalty of 38.9 million CAD (the amount Cineplex had earned from it between June 2022 and December 2023) plus a ten-year prohibition; the Federal Court of Appeal dismissed the appeal in January 2026.

Authority / court

Federal Court of Appeal / Competition Tribunal (auf Antrag des Competition Bureau)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Competition Act, Deceptive Marketing Practices (Drip Pricing, seit 24.06.2022 ausdrücklich geregelt)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

23 Jan 2026

Original amount 38,900,000 CAD, converted at the ECB reference rate of 21 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

On a complaint filed by the U.S. Department of Justice on behalf of the FTC, the federal district court for the Central District of California entered an order against two Disney companies. Disney is alleged to have failed to label child-directed videos on YouTube as 'Made for Kids' because it designated audiences only at channel level; as a result, data from children under 13 could be collected via YouTube without notice to and consent from their parents and used for targeted advertising. Disney pays a civil penalty of 10,000,000 USD and must set up a programme for reviewing and designating the audience of its videos. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Federal Trade Commission (FTC); Klage durch das U.S. Department of Justice, Anordnung des U.S. District Court for the Central District of California

Area of law

Data protection · Marketing and consent

Legal basis

COPPA Rule, 16 C.F.R. Part 312; Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c), 6505(d); Verfahren nach 15 U.S.C. §§ 45(m)(1)(A), 53(b)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Published

31 Dec 2025

Original amount 10,000,000 USD, converted at the ECB reference rate of 23 Dec 2025.

Checked against the official source on 3 Oct 2026 · Direct link

The Ministerio de Derechos Sociales, Consumo y Agenda 2030 (Spanish Ministry of Social Rights, Consumer Affairs and 2030 Agenda) imposed fines totalling 64,055,311 EUR on the holiday rental platform Airbnb, mainly because 65,122 listings advertised holiday homes without a licence, with a non-matching registration number or without accurate information on the legal status of the hosts (63,980,311 EUR, six times the unlawful profit). In addition, 10,000 EUR were imposed for missing information on distance contracts, 10,000 EUR for unanswered information requests and 55,000 EUR for failing to comply with interim orders; Airbnb must also remove the unlawful content and publish the sanction. The decision is not final.

Authority / court

Ministerio de Derechos Sociales, Consumo y Agenda 2030

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 47.1 Buchst. m), t), i) und o) Texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios (Real Decreto Legislativo 1/2007)

Action

Fine

Status of proceedings

under appeal

Sector

Media and online platforms

Published

15 Dec 2025

Checked against the official source on 28 Sep 2026 · Direct link

First non-compliance decision under the Digital Services Act (DSA): the European Commission imposed 120 million EUR on X because the purchasable ‘verified’ checkmark deceives users, the advertising repository lacks essential information (content, topic, advertiser) and researchers are denied access to public data. X must present remedies within 60 working days and an action plan within 90 working days respectively.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/2065 (DSA), Art. 25 Abs. 1, Art. 39, Art. 40 Abs. 12

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

5 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Following preliminary findings in May 2025 that TikTok’s advertising repository did not meet the requirements of the Digital Services Act, the European Commission declared commitments binding: complete ad content including links, updates within 24 hours, disclosure of targeting criteria with aggregated reach data and improved search functions. Depending on the commitment, implementation must take place within 2 to 12 months; breaches of the commitments count as breaches of the DSA.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Digital Services Act (Verordnung (EU) 2022/2065): Pflicht zum Werbearchiv; verbindliche Zusagen nach Art. 71

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

On the Romanian marketplace publi24.ro, a fake advert appeared with photos and the telephone number of a woman, claiming that she offered sexual services. The Court of Justice of the European Union (Grand Chamber, Case C-492/23) ruled that the operator is a controller within the meaning of the GDPR, must identify adverts containing sensitive data before publication and verify identity or consent, and cannot rely on the liability exemption of the E-Commerce Directive.

Authority / court

Gerichtshof der Europäischen Union (Große Kammer), Rs. C-492/23

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO (Verantwortlicher, Art. 9, Art. 32); Richtlinie 2000/31/EG

Status of proceedings

unknown

Sector

Media and online platforms

Published

2 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

On a complaint by the California Attorney General, the Superior Court in Los Angeles entered a stipulated judgment against the mobile game developer Jam City. According to the investigation, none of Jam City's 21 apps offered a way, as required by the California Consumer Privacy Act (CCPA), to opt out of the sale or sharing of personal data for personalised advertising, and some games passed on data of teenagers aged between 13 and 16 without their affirmative consent. Jam City pays 1,400,000 USD, must offer opt-out options within the apps, may only sell or share data of under-16s on an opt-in basis and must instruct recipients to delete such data. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Superior Court of California, County of Los Angeles, auf Klage des Attorney General of California (California Department of Justice)

Area of law

Data protection · Data subject rights and transparency

Legal basis

California Consumer Privacy Act (CCPA), Cal. Civ. Code § 1798.100 ff.; Zahlung nach Cal. Civ. Code § 1798.199.90

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

21 Nov 2025

Original amount 1,400,000 USD, converted at the ECB reference rate of 21 Nov 2025.

Checked against the official source on 3 Oct 2026 · Direct link

On vanityfair.fr, cookies requiring consent were set before any interaction with the banner, trackers were labelled as ‘strictly necessary’ and cookies continued to be placed even after ‘Reject all’. Following a complaint by noyb, the publisher had already received a formal notice in 2021; follow-up inspections in 2023 and 2025 by the French data protection authority (CNIL) showed continuing infringements.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 82 Loi Informatique et Libertés

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Published

27 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

In 2021, the Estonian parent company of Apollo cinemas acquired control of Forum Cinemas Lithuania before the notified merger had been cleared and integrated the cinemas in Vilnius and Kaunas into its network, even though the Konkurencijos taryba (Lithuanian Competition Council) had provisionally expressed competition concerns. Fine of 7,507,930 EUR (0.8% of consolidated worldwide turnover) and obligation to end the infringement within six months. Source: archived copy of the press release.

Authority / court

Konkurencijos taryba (Litauischer Wettbewerbsrat)

Area of law

Competition law · Merger control

Legal basis

Konkurencijos įstatymas (Vollzugsverbot bei Zusammenschlüssen)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

30 Oct 2025

Checked against the official source on 25 Sep 2026 · Direct link

The Comisión Nacional del Mercado de Valores (CNMV, Spanish securities market supervisor) fined Twitter International Unlimited Company 5,000,000 EUR for a continuing very serious breach of its duties to assist the supervisor. For the advertisements listed in a CNMV request of 8 November 2023, the company did not check whether the advertiser Quantum AI was authorised to provide investment services in Spain or appeared on warning lists of the CNMV or foreign supervisors; it waived administrative appeals.

Authority / court

Comisión Nacional del Mercado de Valores (CNMV)

Area of law

Capital markets and financial supervision

Legal basis

Art. 290.1.n) i. V. m. Art. 290.2.f) Ley 6/2023 de los Mercados de Valores y de los Servicios de Inversión

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

13 Nov 2025

Checked against the official source on 28 Sep 2026 · Direct link

In January 2025 attackers infected the work computer of an employee of the online job portal Incruit with malware, took over the employee’s database access and, until February 2025, extracted data on all 7,275,843 members and 54,475 stored CVs, cover letters and copies of certificates (438 GB in total). Despite conspicuous database access outside business hours, the company only noticed the leak through an extortion message; it had already been sanctioned in July 2023 for inadequate access controls. The authority imposed a penalty surcharge of 463,000,000 KRW and ordered the appointment of a qualified chief privacy officer and a plan to prevent further incidents and support those affected.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29; Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Mitigating circumstances

Reduction of 55% because no benefit was derived and the company is a medium-sized enterprise under the Korean Framework Act on Small and Medium Enterprises, and a further 20% for cooperation, remediation and self-regulation; increase of 65% because the infringement lasted more than two years and because of the July 2023 sanction.

Liability of senior managers

The company was ordered to appoint a new, qualified chief privacy officer (CPO) and to define the CPO’s responsibility clearly.

Published

23 Oct 2025

Original amount 463,000,000 KRW, converted at the ECB reference rate of 22 Oct 2025.

Checked against the official source on 4 Oct 2026 · Direct link

After both hosting services had received at least two final removal orders from EU authorities within twelve months, Coimisiún na Meán (Ireland’s media and online safety regulator) designated them as exposed to terrorist content under the TCO Regulation. They must take specific protective measures and report on them within three months; the regulator assesses their effectiveness.

Authority / court

Coimisiún na Meán (irische Medien- und Online-Sicherheitsaufsicht)

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2021/784 (Terrorist Content Online Regulation): Einstufung als exponiert, spezifische Maßnahmen

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Checked against the official source on 25 Sep 2026 · Direct link

The CMA objected that, during the Oasis presale, fans in the queue were not told that standing tickets were being sold at two price levels, and that "Platinum" tickets cost almost 2.5 times as much without it being adequately explained that they offered no added value compared with some standard tickets. Without admitting liability, Ticketmaster gave undertakings: advance notice of tiered pricing, price ranges in the queue, no misleading ticket descriptions and a two-year reporting obligation.

Authority / court

Competition and Markets Authority (CMA)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Britisches Verbraucherschutzrecht (Verfahren nach den vor April 2025 geltenden Befugnissen; Verpflichtungszusagen)

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

Undertakings without admission of liability.

Published

25 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

The joint investigation by the Office of the Privacy Commissioner of Canada and the supervisory authorities of Québec, British Columbia and Alberta found that every year hundreds of thousands of children used the platform despite the minimum age of 13, and that TikTok processed data without valid consent, including for profiling and advertising. TikTok undertook to improve age verification and make privacy notices easier to understand, and already during the investigation largely stopped targeted advertising to under-18s (except by broad categories such as language and approximate location).

Authority / court

Office of the Privacy Commissioner of Canada gemeinsam mit den Aufsichten von Québec, British Columbia und Alberta

Area of law

Data protection · Marketing and consent

Legal basis

PIPEDA und Datenschutzgesetze für den Privatsektor von Québec, British Columbia und Alberta

Action

Other

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

23 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

According to the European Commission's findings, Google had, since at least 2014, abused its dominant position in publisher ad servers (DFP) and in programmatic ad buying tools (Google Ads, DV360) by favouring its own ad exchange AdX, for example by informing it in advance of the best rival bid. In addition to the fine of €2.95bn, the Commission ordered Google to end the self-preferencing and to propose measures against the conflicts of interest along the adtech supply chain; earlier fines imposed on Google for abuse of dominance were taken into account.

Authority / court

Europäische Kommission

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV; Art. 54 EWR-Abkommen

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Repeat case

yes

Published

5 Sep 2025

Checked against the official source on 28 Sep 2026 · Direct link

Customer data (including names, e-mail addresses, dates of birth, telephone numbers) could be retrieved via an unprotected development server of the advertising agency. An employee took the first alert from an external party in January 2025 to be spam; only a second alert in February reached management, which closed the gap but only notified the incident on 2 May 2025 after being requested to do so by the Datenschutzbehörde (Austrian Data Protection Authority, DSB). The authority attributed the employee’s conduct to the company.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 33 Abs. 1 iVm Art. 83 Abs. 4 lit. a DSGVO

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Culpability

negligent

Mitigating circumstances

No previous infringements and cooperation in the proceedings; gap closed immediately after the second alert, employees trained subsequently.

Checked against the official source on 25 Sep 2026 · Direct link

When creating a Google account, users were not sufficiently informed that advertising cookies were necessarily placed in the process; in addition, Google displayed advertisements between e-mails in Gmail without prior consent. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 200 million EUR on Google LLC and 125 million EUR on Google Ireland and ordered remedial action within six months, subject to a penalty payment of 100,000 EUR per day.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 82 Loi Informatique et Libertés; Art. L. 34-5 Code des postes et des communications électroniques

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

The two leading accommodation booking platforms sold small and medium-sized lodging businesses advertising packages whose price included discount coupons for guests, and let unused coupons expire without compensation (Yanolja at the end of the contract period, Yeogi Eottae through a validity of only one day). The KFTC (Korea Fair Trade Commission, Korea's competition authority) treated this as an abuse of a superior bargaining position, issued corrective and notification orders and imposed fines totalling KRW 1,540 million: KRW 540 million on Nol Universe (Yanolja) and KRW 1,000 million, the statutory maximum fixed-amount fine, on Yeogi Eottae.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 45 Abs. 1 Nr. 6 MRFTA i. V. m. Art. 52 und Anhang 2 Nr. 6 lit. d Durchführungsverordnung (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

12 Aug 2025

Original amount 1,540,000,000 KRW, converted at the ECB reference rate of 12 Aug 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Between 25 and 31 March 2025 the listed operator of online marketplaces held one-to-one calls with 19 analysts ahead of its quiet period ("pre-close calls") and, in a recorded call, said that consensus for the first quarter and the full year 2025 was too high, adding expectations for individual business areas; the analyst then cut their EBITDA estimate and the share price fell by 10% on 26 March. The Finanstilsynet (Norwegian Financial Supervisory Authority) treated this as unlawful disclosure of inside information and imposed 10,000,000 NOK; as an aggravating factor it took into account that Vend had not initially handed over its prepared list of talking points. Vend announced that it would accept the fine and has decided to stop holding analyst calls before quiet periods.

Authority / court

Finanstilsynet (Norwegen)

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Art. 14 lit. c i. V. m. Art. 10 MAR; verdipapirhandelloven § 3-1 und § 21-1

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Culpability

negligent

Published

20 Aug 2025

Original amount 10,000,000 NOK, converted at the ECB reference rate of 12 Aug 2025.

Checked against the official source on 28 Sep 2026 · Direct link

In 2023, the Austrian data protection authority (Datenschutzbehörde, DSB) had ordered a local news portal (a media GmbH & Co KG, name pseudonymised) by decision to offer, on the first layer of the cookie banner, an equivalent option to close it without consent. Because the company did not implement this from October 2024 until at least March 2025, the DSB imposed 6,200 EUR for failure to comply with an instruction; the penalty decision is final.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 58 Abs. 2 lit. d i. V. m. Art. 83 Abs. 6 DSGVO; Art. 7 DSGVO

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Checked against the official source on 25 Sep 2026 · Direct link

Despite objections, the health portal continued to pass data to advertising partners and transmitted article titles suggestive of diagnoses for targeted advertising; the consent banner did not stop the tracking. In addition, the required contractual clauses with advertising partners were missing. The settlement was reached with the Attorney General of California.

Authority / court

Attorney General of California (California Department of Justice)

Area of law

Data protection · Cookies and tracking

Legal basis

California Consumer Privacy Act (CCPA), Unfair Competition Law

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

1 Jul 2025

Original amount 1,550,000 USD, converted at the ECB reference rate of 1 Jul 2025.

Checked against the official source on 25 Sep 2026 · Direct link

From November 2020 to July 2024, users of OLX.pl could rate sellers even without having made a purchase, buyers with several purchases could not rate all sellers, and a weighted algorithm inflated positive ratings and classified below-average scores as positive; individual ratings could not be viewed. The UOKiK (Urząd Ochrony Konkurencji i Konsumentów, the Polish Office of Competition and Consumer Protection) imposed around 28.4 million PLN by decision DOZIK-2/2025; OLX has since switched the system to averages from verified buyers. The decision was not final at the time of publication; OLX may appeal to the Court of Competition and Consumer Protection.

Authority / court

Präsident des Amts für Wettbewerbs- und Verbraucherschutz (UOKiK)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Gesetz über Wettbewerbs- und Verbraucherschutz; Gesetz zur Bekämpfung unlauterer Geschäftspraktiken

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Mitigating circumstances

Rating system changed as of 31 July 2024.

Published

12 Jun 2025

Original amount 28,420,869 PLN, converted at the ECB reference rate of 12 Jun 2025.

Checked against the official source on 28 Sep 2026 · Direct link

TikTok allowed employees in China to access European users' data remotely without assessing and demonstrating that standard contractual clauses and supplementary measures ensured an equivalent level of protection against access by Chinese authorities; it also informed users inadequately. Ireland's Data Protection Commission (DPC) imposed 530 million EUR and ordered that the transfers be brought into compliance or suspended within six months.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · International data transfers

Legal basis

Art. 46 Abs. 1, Art. 13 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

2 May 2025

Checked against the official source on 25 Sep 2026 · Direct link

Between March and November 2024, Meta offered users of Facebook and Instagram only the choice between consenting to the combination of their data for personalised advertising and a paid subscription. The European Commission saw this as a breach of the obligation under the Digital Markets Act (DMA) to offer an equivalent, less data-intensive alternative, and imposed 200 million EUR.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/1925 (DMA), Einwilligung zur Datenzusammenführung

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

23 Apr 2025

Checked against the official source on 25 Sep 2026 · Direct link

On the radio programme "La Zanzara" of 28 November 2024, a guest made statements about Muslims that AGCOM (Italian communications regulator) considered capable of spreading hatred and discrimination against a group of people; the presenters had not effectively prevented their impact. The authority fined the broadcaster five times the minimum amount, 150,000 EUR; in its view, the later distancing in a subsequent programme and the deletion of the segments from 13 December 2024 only partly mitigated the infringement and did not reduce the sanction.

Authority / court

Autorità per le garanzie nelle comunicazioni (AGCOM)

Area of law

Other

Legal basis

Art. 30 D.Lgs. 208/2021 (Testo unico dei servizi di media audiovisivi); Art. 4 Abs. 2 lit. a und c des AGCOM-Reglements zum Schutz der Grundrechte der Person (Delibera 37/23/CONS)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

no

Published

16 Apr 2025

Checked against the official source on 28 Sep 2026 · Direct link

Sports broadcasters and production companies exchanged sensitive information in 15 instances about day rates and fee increases for freelance camera operators and sound technicians in order to coordinate pay. Fines: BT 1,738,453 GBP, IMG 1,737,820 GBP, BBC 424,165 GBP, ITV 339,918 GBP; Sky received immunity as the first to come forward.

Authority / court

Competition and Markets Authority (CMA)

Area of law

Competition law · Cartels and collusion

Legal basis

Chapter I Competition Act 1998

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

20 % settlement discount for all; leniency discounts for BT, IMG, ITV; immunity for Sky

Published

21 Mar 2025

Original amount 4,240,356 GBP, converted at the ECB reference rate of 21 Mar 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Following a report through which a minor victim became identifiable, an inspection found that the broadcaster had no risk analysis for editorial work, no rules for checking personal data before publication and no encryption of mobile storage media. Poland’s data protection authority (UODO) imposed 56,824 PLN; the Warsaw Administrative Court dismissed the action on 18 March 2026.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 24 Abs. 1, Art. 32 Abs. 1 und 2 DSGVO (DKN.5112.10.2024)

Action

Fine

Status of proceedings

under appeal

Sector

Media and online platforms

Published

11 Mar 2025

Original amount 56,824 PLN, converted at the ECB reference rate of 6 Mar 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Google undertook to the CMA to improve the detection and removal of fake reviews, to ban repeat offenders worldwide, to place warnings on business profiles with manipulated reviews and deactivate their review function, and to set up simple reporting channels; the CMA will monitor implementation for three years.

Authority / court

Competition and Markets Authority (CMA)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Britisches Verbraucherschutzrecht (Verpflichtungszusagen)

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

Voluntary undertakings without a fine.

Published

24 Jan 2025

Checked against the official source on 25 Sep 2026 · Direct link

According to the FTC, the AI-powered review platform collected star ratings for its business customers at the time of purchase, before customers had received the product or service, thereby inflating average ratings and review counts, including in search engine results. The FTC issued a final settlement order prohibiting such misrepresentations.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Section 5 FTC Act

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Published

3 Jan 2025

Checked against the official source on 25 Sep 2026 · Direct link

The FTC and the Illinois Attorney General alleged that the delivery service misled customers about delivery costs and blocked their accounts and balances, promised drivers inflated earnings and listed restaurants without their consent. The court order sets a judgment of 140 million USD, suspended except for a payment of 24.8 million USD to the FTC; in addition, 200,000 USD goes to Illinois (25 million USD in total). The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Federal Trade Commission (FTC) und Attorney General of Illinois

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Section 5 FTC Act; Restore Online Shoppers' Confidence Act; Impersonation Rule (16 C.F.R. Part 461); Illinois Consumer Fraud and Deceptive Business Practices Act (815 ILCS 505); Illinois Uniform Deceptive Trade Practices Act (815 ILCS 510)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Media and online platforms

Published

17 Dec 2024

Original amount 25,000,000 USD, converted at the ECB reference rate of 31 Dec 2024.

Checked against the official source on 3 Oct 2026 · Direct link

The Comisión Nacional de los Mercados y la Competencia (CNMC, Spanish competition and markets authority) imposed seven fines totalling 308,529 EUR (five of 44,829 and two of 42,192 EUR) on Techpump Solutions because seven video-sharing platforms with pornographic content operated by the company lacked effective age verification and minors could gain access simply by declaring themselves to be adults. According to the CNMC, the company did not adequately remedy the shortcomings despite requests to do so.

Authority / court

Comisión Nacional de los Mercados y la Competencia (CNMC)

Area of law

AI and digital regulation · Platform obligations

Legal basis

Art. 89.1.e) und Art. 157.8 Ley 13/2022 General de Comunicación Audiovisual

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

17 Jan 2025

Checked against the official source on 28 Sep 2026 · Direct link

The car repair booking platform Autobutler ApS is paying a fine of 7,000,000 DKK under a court settlement before the Sø- og Handelsretten (Danish Maritime and Commercial High Court). In June 2023 the Konkurrencerådet (Danish Competition Council) had found that from at least March 2016 to October 2021 Autobutler agreed fixed prices for specific services in specific periods with several hundred garages; Autobutler had challenged that decision in court.

Authority / court

Sø- og Handelsretten (gerichtlicher Vergleich mit dem Konkurrencerådet)

Area of law

Competition law · Cartels and collusion

Legal basis

Konkurrenceloven § 6 stk. 1, jf. stk. 2 nr. 1 og stk. 3; Art. 101 AEUV; Bußgeld nach § 23 b

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Cooperation in bringing the case to a close.

Published

20 Dec 2024

Original amount 7,000,000 DKK, converted at the ECB reference rate of 19 Dec 2024.

Checked against the official source on 28 Sep 2026 · Direct link

In 2018, attackers exploited a flaw in the ‘View As’ feature and gained access to around 29 million accounts, of which around 3 million were in the EEA. Ireland's Data Protection Commission (DPC) imposed 8 million EUR (Art. 33(3)) and 3 million EUR (Art. 33(5)) for incomplete notification and documentation, as well as 130 million EUR and 110 million EUR for infringements of data protection by design (Art. 25(1) and (2)).

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 33 Abs. 3 und 5, Art. 25 Abs. 1 und 2

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

17 Dec 2024

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

To end the civil penalty proceedings pending before the Federal Court since March 2020, the Australian Information Commissioner accepted an enforceable undertaking from Meta Platforms under which Meta sets up a payment programme of 50 million AUD for Australian Facebook users whose data may have been disclosed to the app “This is Your Digital Life”. The regulator said Meta had allegedly committed serious or repeated breaches of APP 6.1 and 11.1; the undertaking was given without any admission of liability, and the proceedings were withdrawn. Unused funds go to the Commonwealth budget; Meta also contributed to the regulator's legal costs.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data breaches and data security

Legal basis

Regulatory Powers (Standard Provisions) Act 2014 (Cth) s 114; Vorwurf: Privacy Act 1988 (Cth) s 13G i. V. m. APP 6.1 und 11.1

Action

Other

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

According to the undertaking, Meta no longer allows third-party apps to access data of Facebook friends who have not installed and authorised the app themselves, has reduced the data fields available, introduced more granular permissions and regularly checks app developers.

Published

17 Dec 2024

Checked against the official source on 3 Oct 2026 · Direct link

After a login outage of around 75 minutes on Instagram on 22 March 2024 that affected some 3.35 million users in Korea, Meta Platforms reported the incident only 24 hours and 19 minutes after it began, despite three requests from the Ministry. A report within 10 minutes and a written report within two hours are required; the Ministry imposed an administrative fine of 5,000,000 KRW under the Framework Act on Broadcasting and Communications Development (방송통신발전 기본법). The amount and the facts have not been confirmed against the primary source.

Authority / court

Ministry of Science and ICT (MSIT, 과학기술정보통신부)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Framework Act on Broadcasting and Communications Development (방송통신발전 기본법) Art. 38; Basisplan zum Management von Kommunikationsstörungen 2024

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

28 Nov 2024

Original amount 5,000,000 KRW, converted at the ECB reference rate of 28 Nov 2024.

Checked against the official source on 4 Oct 2026 · Direct link

Between 2018 and 2020, Netflix did not adequately inform customers about what happens to their data, and the information available was partly unclear. The Dutch supervisory authority (Autoriteit Persoonsgegevens, AP) imposed 4.75 million EUR; Netflix has since revised its privacy statement.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a i. V. m. Art. 12 Abs. 1, Art. 13 Abs. 1 lit. c, e, f und Abs. 2 lit. a, Art. 15 Abs. 1 lit. a, c, d und Abs. 2 DSGVO

Action

Fine

Status of proceedings

under appeal

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

The privacy statement and the information provided were subsequently improved.

Published

18 Dec 2024

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Unknown persons had linked data on a very large number of Facebook users to telephone numbers via the contact import function, harvested it and later made it public. Germany's Federal Court of Justice (Bundesgerichtshof, BGH) ruled that the mere loss of control over one's own data can constitute non-material damage under Art. 82 GDPR, without proof of specific misuse; it considered compensation in the order of 100 EUR legally unobjectionable in the circumstances of the case. The case was referred back to the Higher Regional Court of Cologne (OLG Köln), among other things to examine the default searchability setting in the light of data minimisation.

Authority / court

Bundesgerichtshof (VI. Zivilsenat)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 82 Abs. 1 DSGVO

Action

Other

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

18 Nov 2024

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

The European Commission found that Meta abused its dominant position in personal social networks and in display advertising on social media: its classified ads service Facebook Marketplace was automatically linked to Facebook, and other classified ads providers advertising on Facebook and Instagram were subjected to unfair terms allowing Meta to use their ad-related data for Marketplace. In addition to the fine of €797.72m, Meta must end the conduct and must not repeat it.

Authority / court

Europäische Kommission

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV; Art. 54 EWR-Abkommen

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

14 Nov 2024

Checked against the official source on 4 Oct 2026 · Direct link

Coimisiún na Meán (Ireland’s media and online safety regulator) determined that the services of TikTok, X and Meta (Instagram) are exposed to terrorist content after they had received at least two final removal orders from EU authorities within twelve months. The providers must take specific measures against the dissemination of terrorist content and report on them.

Authority / court

Coimisiún na Meán (irische Medien- und Online-Sicherheitsaufsicht)

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2021/784 (Terrorist Content Online Regulation): Einstufung als exponiert, spezifische Maßnahmen

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Through Facebook profiles and usage behaviour, Meta Platforms, Inc. collected sensitive characteristics of around 980,000 users in Korea – such as religion, political views or same-sex marriage – and made advertising topics built on them available to around 4,000 advertisers without obtaining separate consent. Meta also refused access requests without a legitimate reason and left an unused account-recovery page online through which passwords were reset with forged ID documents and data on ten users was obtained. The authority imposed a penalty surcharge of 21,613,000,000 KRW and an administrative fine of 10,200,000 KRW (21,623,200,000 KRW in total) together with corrective orders.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Marketing and consent

Legal basis

Personal Information Protection Act (개인정보 보호법, frühere Fassung) Art. 23(1), Art. 29, Art. 35(3)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

5 Nov 2024

Original amount 21,623,200,000 KRW, converted at the ECB reference rate of 4 Nov 2024.

Checked against the official source on 4 Oct 2026 · Direct link

LinkedIn analysed data of its members, including data obtained from third parties, for behavioural analysis and targeted advertising without valid consent; legitimate interests and contractual necessity did not apply either. The Data Protection Commission (DPC, the Irish data protection authority) found infringements of the principles of lawfulness, fairness and transparency, issued a reprimand, ordered the processing to be brought into compliance and imposed fines totalling 310 million EUR.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Marketing and consent

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, Art. 6, Art. 13 Abs. 1 lit. c, Art. 14 Abs. 1 lit. c

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

24 Oct 2024

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The platform operator stored users' passwords unencrypted in plaintext in internal systems and reported this to Ireland's Data Protection Commission (DPC) in March 2019. The DPC found infringements of the security obligations (Art. 5(1)(f), Art. 32(1)) and of the notification and documentation obligations (Art. 33(1) and (5)), and additionally issued a reprimand.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 und 5

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

According to the DPC, the passwords were not disclosed to external third parties.

Published

27 Sep 2024

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 26 Sep 2026 · Direct link

A French publishing group charged a Swiss bookseller considerably higher purchase prices for direct supply in France than are customary there, although the bookseller had no reasonable alternatives. The Swiss Competition Commission (WEKO) found an abuse of relative market power and ordered the publishing group to grant the bookseller the sales and discount terms applicable in France for direct purchases, less admissible additional costs for the Swiss market; the publishing group bears the procedural costs of CHF 254,865. According to WEKO (as of March 2025), an appeal against the decision was pending before the Federal Administrative Court.

Authority / court

Wettbewerbskommission (WEKO)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 7 Abs. 1 und 2 lit. g KG (relative Marktmacht), Art. 30 Abs. 1 KG

Action

Order

Status of proceedings

under appeal

Sector

Media and online platforms

Published

21 Nov 2024

Checked against the official source on 2 Oct 2026 · Company name anonymised since 23 Sep 2026 · Direct link

The regulator found that the messaging service's revised privacy policy applicable in South Africa – unlike the European version – did not set out adequate legal bases and purposes, that consent obtained by making acceptance a condition of use was not voluntary, that sharing data with companies of its own group and third parties amounted to impermissible further processing, and that the service had demonstrated neither compliance with its documentation duty nor appropriate security safeguards. The enforcement notice of 10 September 2024 required the provider, among other things, to bring the policy into line with POPIA, submit a personal information impact assessment and maintain a risk register; according to the regulator (as of 13 November 2025), a court review brought by the provider was resolved by a settlement on additional transparency information, which is to be made an order of court.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Sections 8, 9, 11, 13, 15, 17 und 19 Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice nach Section 95 POPIA; Section 51 PAIA (Dokumentation)

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Checked against the official source on 8 Oct 2026 · Company name anonymised since 10 Sep 2026 · Direct link

The ICO issued a reprimand to a UK online betting and gaming operator (part of an international gambling group). The ICO found that between January and March 2023 the operator's website set third-party advertising cookies on arrival and thus processed visitors' personal data before they had consented. The ICO found processing without a lawful basis and without valid consent.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 5(1)(a), 6(1)(a) und 7(1) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Media and online platforms

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 2 Sep 2026 · Direct link

The platform, with a market share of 70–90 % in online hotel booking in Spain, imposed unfair conditions such as price parity clauses and obstructed other online travel agencies through ranking criteria. The CNMC imposed a fine of 413.24 million EUR.

Authority / court

Comisión Nacional de los Mercados y la Competencia (CNMC)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 2 LDC, Art. 102 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

30 Jul 2024

Checked against the official source on 28 Sep 2026 · Version 5 · Company name anonymised since 30 Jul 2026 · Direct link

During the 74th edition of a nationally broadcast music festival on the broadcaster's main channel, shoes of a well-known brand were repeatedly shown on screen during the appearance of an internationally known guest without the product placement being signalled. AGCOM (Italian communications regulator) classed this as surreptitious commercial communication and imposed twenty times the minimum amount, 206,580 EUR; the programme's large audience and a sanction for the same infringement at the previous year's festival were aggravating factors.

Authority / court

Autorità per le garanzie nelle comunicazioni (AGCOM)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 43 Abs. 1 lit. a und Art. 48 Abs. 3 lit. d D.Lgs. 208/2021 (Testo unico dei servizi di media audiovisivi) i. V. m. Ziff. 6.2 des RAI-Selbstregulierungskodex zur Produktplatzierung

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Published

24 Jul 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 24 Jul 2026 · Direct link

In follow-up proceedings on a 2020 decision, the Competition Council of the GVH (Gazdasági Versenyhivatal, Hungarian Competition Authority) found that the reservation platform had not fully stopped the practices then prohibited: pressure-inducing urgency messages until February 2024 and statements on free cancellation until April 2024. The GVH imposed HUF 382,500,000, by its own account the highest fine ever set in follow-up proceedings.

Authority / court

Gazdasági Versenyhivatal (GVH)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 77 Abs. 6 lit. e Tpvt. (ungarisches Wettbewerbsgesetz, Gesetz LVII/1996) i. V. m. einem früheren Beschluss der Wettbewerbsbehörde

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Repeat case

yes

Published

15 Jul 2024

Original amount 382,500,000 HUF, converted at the ECB reference rate of 15 Jul 2024.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 15 Jul 2026 · Direct link

Acting on complaints from France and Poland, the Valstybinė duomenų apsaugos inspekcija (Lithuanian State Data Protection Inspectorate, VDAI) found that the second-hand platform rejected erasure requests when users did not state a ‘specific reason’ under Art. 17 GDPR, throttled users without their knowledge through ‘shadow banning’ and could not demonstrate how it handled access requests. Fine of 2,385,276 EUR.

Authority / court

Valstybinė duomenų apsaugos inspekcija (VDAI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a, Art. 5 Abs. 2, Art. 12 Abs. 1 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

3 Jul 2024

Checked against the official source on 28 Sep 2026 · Version 5 · Company name anonymised since 2 Jul 2026 · Direct link

The Conselho Diretor (board of directors) of the Autoridade Nacional de Proteção de Dados (ANPD, Brazilian data protection authority) ordered, as a preventive measure, that the group suspend in Brazil the part of its new privacy policy on using personal data to train generative AI and immediately stop this processing across all of the group’s products, including for people without a user account; a daily penalty of 50,000 BRL was set for each day of non-compliance. The authority saw indications of a missing appropriate legal basis, insufficient transparency, obstacles to exercising data subject rights and a lack of safeguards for data of children and adolescents. Following a request for reconsideration, the ANPD upheld the measure in July 2024 and suspended it at the end of August 2024 after approving a compliance plan submitted by the group.

Authority / court

Autoridade Nacional de Proteção de Dados (ANPD), Conselho Diretor

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 52 III und Art. 54 LGPD (Lei nº 13.709/2018); Art. 45 Lei nº 9.784/1999; Art. 26 IV Decreto nº 10.474/2020 (Präventivmaßnahme)

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

2 Jul 2024

Checked against the official source on 7 Oct 2026 · Company name anonymised since 2 Jul 2026 · Direct link

A Rome-based animation company is paying USD 538,000 under a settlement with OFAC for apparent violations of the North Korea sanctions. According to OFAC's findings, between May 2019 and November 2021 the company remitted around USD 537,939 to a North Korean state-owned animation studio for outsourced animation work. As a result, US financial institutions processed wire transfers in which the Government of North Korea had a blocked interest and exported financial services to North Korea. OFAC treated the apparent violations as non-egregious and not voluntarily self-disclosed; the base penalty was USD 725,000. Summarised in our own words.

Authority / court

U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

North Korea Sanctions Regulations, 31 C.F.R. § 510.212; Vergleich nach den Economic Sanctions Enforcement Guidelines, 31 C.F.R. part 501, app. A

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

26 Jun 2024

Original amount 538,000 USD, converted at the ECB reference rate of 26 Jun 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 26 Jun 2026 · Direct link

The Comisión Nacional de los Mercados y la Competencia (CNMC, Spanish competition and markets authority) fined the collecting society a total of 6,387,819 EUR (3,954,364 and 2,433,455 EUR) for two abuses of its dominant position in licensing music and audiovisual rights to radio and television broadcasters. Its tariffs based on actual use were set so high that broadcasters were in practice dependent on flat-rate tariffs; in addition, the collecting society presented its music repertoire as universal and offered indemnities against third-party claims, which made switching to competing collecting societies harder.

Authority / court

Comisión Nacional de los Mercados y la Competencia (CNMC)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 2 Ley 15/2007 de Defensa de la Competencia; Art. 102 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

26 Jun 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 19 Jun 2026 · Direct link

The satellite radio provider advertised subscription prices without mandatory music licensing and administration fees, which increased the price by 10 to 20 %. Under the registered settlement, the provider is paying a penalty of 3.3 million CAD and 30,000 CAD in investigation costs and must improve its compliance programme.

Authority / court

Competition Bureau Canada (Consent Agreement beim Competition Tribunal)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Competition Act, Deceptive Marketing Practices (Drip Pricing)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Resolution by agreement (consent agreement).

Published

5 Jun 2024

Original amount 3,300,000 CAD, converted at the ECB reference rate of 5 Jun 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Jun 2026 · Direct link

The group did not inform users registering for its photo and video network via the website adequately and immediately that their data are collected and used for commercial purposes (practice 1). When accounts were suspended, its other social network did not state whether the decision was automated or manual, and neither service referred to out-of-court and judicial remedies; in addition, the 30-day deadline for internal complaints was relatively short (practice 2). The AGCM fined the group and its Irish subsidiary 3,000,000 and 500,000 EUR jointly and severally, a total of 3,500,000 EUR.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Art. 20, 21, 22 (Praxis 1) sowie Art. 20 (Praxis 2) Codice del consumo (D.lgs. 206/2005)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

5 Jun 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 21 May 2026 · Direct link

The outdoor advertising company accepted a criminal fine of 6,000,000 DKK. From September 2008 to the end of 2010 the company had agreed in writing with a competitor on uniform discount rates (media commission, information fee, security deposit, cash discount) for selling outdoor advertising space, and continued to apply the coordinated rates until April 2015.

Authority / court

National enhed for Særlig Kriminalitet (NSK) nach Anzeige des Konkurrencerådet

Area of law

Competition law · Cartels and collusion

Legal basis

Konkurrenceloven § 23 stk. 1 nr. 1 og 14, stk. 4, jf. § 6 stk. 1 og 3; Art. 101 Abs. 1 AEUV

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Consistent admission of the first period (2008–2010) and subsequent admission of the second period (2011–2015).

Published

18 Apr 2024

Original amount 6,000,000 DKK, converted at the ECB reference rate of 16 Apr 2024.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 16 Apr 2026 · Direct link