Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe and North America: 756 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Garante per la protezione dei dati personali €6.72m 100 % · 4 cases
What for?
by area of lawAll areas of law
Who?
by companyWhen?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q3 2023 | 0 | — |
| Q4 2023 | 0 | — |
| Q1 2024 | 0 | — |
| Q2 2024 | 0 | — |
| Q3 2024 | 0 | — |
| Q4 2024 | 1 | — |
| Q1 2025 | 1 | — |
| Q2 2025 | 1 | €5m |
| Q3 2025 | 0 | — |
| Q4 2025 | 0 | — |
| Q1 2026 | 0 | — |
| Q2 2026 | 1 | €1.72m |
| Q3 2026 | 0 | — |
4 cases
14 May 2026 Wind Tre S.p.A.Garante: 1.7 million EUR against Wind Tre after data exfiltration via deceived shop staff €1.72m
Attackers posed as technical support, induced staff at points of sale to grant system access and obtained data on more than 365,000 customers, including payment data for 41,359 of them. The Italian data protection authority (Garante per la protezione dei dati personali) criticised deficient management of access credentials and digital certificates as well as inadequate security assessments, and imposed 1,715,600 EUR.
Staff in branches and partner shops must verify alleged support calls before granting access.
Social engineering / fake IT support
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- DSGVO (Integrität und Vertraulichkeit, Art. 32)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Published
- 16 Jul 2026
- Newsletter del 16 luglio 2026 – Data breach, il Garante privacy sanziona Wind Tre per 1,7 milioni di euro Press release of an authority
- Garante – Provvedimento del 14 maggio 2026 [10263796] (Wind Tre) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
10 Apr 2025 Luka Inc.Garante: 5 million EUR against Replika operator Luka over lack of legal basis €5m
The US operator of the Replika chatbot had not determined a legal basis for the processing, had an inadequate privacy notice and, despite declaring that minors were excluded, had no age verification. Italy's data protection authority (Garante per la protezione dei dati personali) imposed 5 million EUR and opened further proceedings concerning the training of the underlying language model.
A declared exclusion of minors is worthless without effective age verification at registration and during use.
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- DSGVO (Rechtmäßigkeit, Transparenz, Schutz Minderjähriger)
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Telecoms, IT and software
- Published
- 19 May 2025
- AI: Il Garante sanziona la società che gestisce il chatbot “Replika” Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
30 Jan 2025 Hangzhou DeepSeek Artificial Intelligence Co., Ltd.; Beijing DeepSeek Artificial Intelligence Co., Ltd.Garante blocks DeepSeek: immediate limitation of processing for Italian users Order
After the Chinese providers had declared that they did not operate in Italy and were not subject to the GDPR, Italy's data protection authority (Garante per la protezione dei dati personali) ordered, as a matter of urgency and with immediate effect, the limitation of the processing of Italian users' data and opened an investigation.
Companies that offer AI services to European users are subject to the GDPR – regardless of where they are headquartered.
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- DSGVO, Art. 58 Abs. 2 lit. f (Beschränkung der Verarbeitung)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Published
- 30 Jan 2025
- Intelligenza artificiale: il Garante privacy blocca DeepSeek Press release of an authority
- Garante, Provvedimento del 30 gennaio 2025 [10098477] (DeepSeek) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
2 Nov 2024 OpenAIGarante: 15 million EUR against OpenAI over ChatGPT – later annulled by the court overturned
Italy's data protection authority (Garante per la protezione dei dati personali) imposed 15 million EUR because OpenAI trained ChatGPT with user data without an appropriate legal basis, breached transparency obligations, failed to report a data breach from March 2023 and did not provide for age verification; in addition, a six-month information campaign was ordered. The Rome Court (Tribunale di Roma) upheld OpenAI's action in judgment no. 4153/2026 (published on 18 March 2026); the Garante subsequently removed the decision from its website.
Companies that train AI models with personal data need a documented legal basis and age verification in advance.
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- AI and digital regulation · AI systems
- Legal basis
- DSGVO (Rechtsgrundlage, Transparenz, Meldung von Datenpannen, Schutz Minderjähriger)
- Action
- Fine
- Status of proceedings
- overturned
- Sector
- Telecoms, IT and software
- Published
- 20 Dec 2024
Amount in EUR; no ECB reference rate is available for this currency.
- ChatGPT, il Garante privacy chiude l’istruttoria Press release of an authority
- OpenAI, annullata la sanzione del Garante privacy Additional reference (not official)
Checked against the official source on 25 Sep 2026 · Direct link