What the texts allow
Regulation Maximum fine Who decides GDPR 4 % of worldwide turnover or €20 m, whichever is higher Art. 83(5) National data protection authority (CNPD in Luxembourg) Data Act Set by each Member State; GDPR-level fines for personal data under Chapters II, III and V Art. 40 National competent authorities Digital Markets Act 10 %, 20 % for repeated infringement Art. 30 European Commission Digital Services Act 6 % Art. 74 European Commission, for very large platforms AI Act 7 % or €35 m for prohibited practices Art. 99 National market surveillance; Commission for general-purpose models Competition law 10 % Reg. 1/2003 Art. 23 European Commission
The ceiling is counted at group level, on worldwide turnover.
Six regimes a data platform meets, with the maximum fine each allows. The GDPR caps fines at 4 % of total worldwide annual turnover or 20 million euros, whichever is higher, for the most serious infringements (Article 83(5)). The Data Act leaves penalties to the Member States (Article 40), but lets data protection authorities impose GDPR-level fines for infringements of Chapters II, III and V where personal data is involved. The DMA goes to 10 % of worldwide turnover and 20 % for a repeated infringement (Article 30); the DSA to 6 % (Article 74); the AI Act to 7 % or 35 million euros for prohibited practices (Article 99); competition law to 10 % (Regulation 1/2003, Article 23).
The engineering point: the ceiling is computed on the turnover of the undertaking, which for a group means the whole group. A Luxembourg subsidiary of a large group is exposed at group scale.
How big is a big fine?
Didi · CAC 2022 Meta · DPC 2023 Google · Commission 2025
Uber · Dutch AP 2024 Amazon · CNPD 2021 Apple · Commission 2025
≈ 4.6 % ≈ 1.1 % ≈ 1.0 %
≈ 0.9 % ≈ 0.2 % ≈ 0.1 %
4 %: GDPR ceiling · Didi was under the PIPL (5 %)
Only one came close to its legal ceiling, and it was not in Europe.
Fine ÷ annual revenue: Amazon 10-K 2021 Meta 10-K 2022 Alphabet 10-K 2024 Uber 10-K 2023 Apple 10-K FY2024 Didi, 2021 revenue
Each bar is a fine divided by the company's annual revenue, with one exchange rate at the date of the decision; read the values as orders of magnitude. Amazon: 746 million euros, about 880 million dollars, against 469.8 billion dollars of net sales in 2021, so about 0.19 %, or about 1.9 % of its 46.3 billion dollars of operating cash flow. Meta: 1.2 billion euros against 116.6 billion dollars of revenue in 2022, about 1.1 %. Google: 2.95 billion euros against 350 billion dollars in 2024, about 1 %. Uber: 290 million euros against 37.3 billion dollars in 2023, about 0.9 %. Apple: 500 million euros against 391 billion dollars in fiscal 2024, about 0.14 %. Didi: 8.026 billion yuan against 173.8 billion yuan of revenue in 2021, about 4.6 %.
The only fine near 4 % was imposed in China, by the Cyberspace Administration, under Chinese law. European fines on the largest groups sit around 1 % or below. That does not make them painless: the orders that come with them (stop a transfer, change a product) usually cost more than the fine.
United States companies
Amazon in Luxembourg, Meta and Uber on transfers, the Commission against gatekeepers.
Four cases with US groups. Two are about transfers of personal data to the United States, which is the GDPR twin of Article 32 of the Data Act. One is in Luxembourg. One shows the Commission's own instruments.
Amazon, Luxembourg: €746 m, then annulled
The decision CNPD, 2021
Amazon Europe Core, established in Luxembourg, is fined €746 million for processing personal data for targeted advertising without a valid legal basis.
In March 2025 the Administrative Tribunal confirmed the fine. In March 2026 the Administrative Court annulled it on procedure and sent the case back to the CNPD.
What it tells a team 3 points
The court kept the findings on substance It annulled because intent or negligence was not assessed Five years later, nothing is paid and the file is open again
A fine is a decision, not a cash flow .
CNPD, 2021-07-16 · Chronicle.lu and Reuters, 2026-03-13 · CMS Enforcement Tracker, Luxembourg
The largest GDPR fine at the time, and a Luxembourg case. On 16 July 2021 the CNPD fined Amazon Europe Core 746 million euros over online behavioural advertising. Amazon appealed. In March 2025 the Administrative Tribunal confirmed the decision. On 12 March 2026 (some reports date it 13 March) the Administrative Court, on appeal, annulled the fine and sent the whole case back to the CNPD. The court did not clear Amazon: it upheld the substance of the infringements but found two procedural shortcomings, in particular that the CNPD had not determined whether the infringements were intentional or negligent, which the GDPR requires when setting a fine.
For scale: the fine was about 0.19 % of Amazon's 2021 net sales and about 1.9 % of its operating cash flow. The lesson for a compliance team is procedural as much as legal: the file you keep, and the authority keeps, decides the outcome years later.
Meta and Uber: the transfer is the infringement
Company Fine What was wrong Where it stands Meta €1.2 bn Facebook data sent to the US under standard contractual clauses that did not answer US surveillance law Appealed; stayed by the Irish High Court Uber €290 m Drivers' data, including ID documents and health data, sent to the US for over two years without a transfer tool Appealed
Same question as Data Act Art. 32 : whose law can reach the data?
dataprotection.ie, 2023-05-22 · Meta 10-Q, Q1 2026 · autoriteitpersoonsgegevens.nl, 2024-08-26
Meta: on 22 May 2023 the Irish Data Protection Commission fined Meta Platforms Ireland 1.2 billion euros and ordered it to suspend transfers of Facebook users' data to the US, because standard contractual clauses did not address the risks identified by the Court of Justice in Schrems II. Meta appealed; its quarterly report for the first quarter of 2026 says the decision is still under appeal and stayed by the Irish High Court.
Uber: on 26 August 2024 the Dutch Autoriteit Persoonsgegevens fined Uber 290 million euros for sending European drivers' data, including taxi licences, location, payment details, identity documents and in some cases medical and criminal data, to its US headquarters for more than two years without a valid transfer mechanism, between the end of the Privacy Shield and Uber's certification under the Data Privacy Framework. Uber appealed. The case started from complaints by more than 170 French drivers.
Link to the lecture: Article 32 of the Data Act asks the same question for non-personal data held by cloud providers. Under the GDPR it has already produced the two largest fines on this slide.
The Commission against US platforms
Date Company Fine Basis and reason 2025-04-23 Apple €500 m DMA: anti-steering rules on the App Store 2025-04-23 Meta €200 m DMA: “consent or pay” advertising model 2025-09-05 Google €2.95 bn Art. 102 TFEU: self-preferencing in advertising technology 2025-12-05 X €120 m DSA, first fine: blue checkmark, ad repository, researcher access
The first DMA and DSA fines came with orders and deadlines.
ec.europa.eu press releases · Law Society Gazette, 2025-12 · General Court, X v Commission, filed 2026-02-16
On 23 April 2025 the Commission adopted the first two non-compliance decisions under the Digital Markets Act: 500 million euros for Apple, whose App Store rules stopped developers from steering users to cheaper offers outside the store, and 200 million euros for Meta, for offering users only a binary choice between consenting to personalised advertising and paying. Both had 60 days to comply or face periodic penalty payments.
In September 2025 the Commission fined Google 2.95 billion euros under Article 102 TFEU for favouring its own ad exchange, AdX, from at least 2014, and ordered it to propose how to end the conflicts of interest. On 5 December 2025 it adopted its first DSA non-compliance decision, 120 million euros against X, for the deceptive paid blue checkmark, the advertising repository and the lack of data access for researchers; X filed an appeal at the General Court on 16 February 2026.
For engineers, the decisions are specifications: steering links, consent screens, an ad repository and a researcher API are product features that a regulator wrote into a deadline.
European companies
The rules are not a tariff on foreign platforms.
A common misreading is that EU data law only targets American platforms. The next slide lists four European companies fined under the GDPR, for ordinary operational failures.
EU companies are fined too
Company Fine Authority, year What failed Vodafone (DE)€45 m BfDI, 2025 Oversight of partner sales agencies; weak authentication around eSIM Criteo (FR)€40 m CNIL, 2023 Proof of consent for ad tracking it relied on from partners H&M (SE)€35.3 m Hamburg DPA, 2020 Detailed records on employees' private lives in Nuremberg Spotify (SE)SEK 58 m IMY, 2023 Incomplete answers to users' access requests
Vendors, consent, HR files, access requests: the boring parts.
bfdi.bund.de, 2025-06 · cnil.fr, 2023-06 · Hamburg DPA, 2020-10 · imy.se, 2023-06
Four European companies. In June 2025 the German federal commissioner, the BfDI, imposed two fines totalling 45 million euros on Vodafone GmbH: one for failing to monitor partner agencies that sold contracts in its name, where employees committed fraud, and one for authentication weaknesses that let third parties obtain customers' eSIM profiles. In June 2023 the CNIL fined Criteo, the French adtech company, 40 million euros, mainly for not being able to show that people whose data it processed had consented. In October 2020 the Hamburg authority fined H&M 35.3 million euros for keeping extensive records on the private lives of employees at its Nuremberg service centre. In June 2023 the Swedish authority IMY fined Spotify 58 million Swedish kronor for incomplete answers to access requests.
None of these is about artificial intelligence or a new technology. They are about vendor management, consent records, HR data and the right of access: the systems a platform team already runs. The Data Act adds a new right of access for product data, and the same failure modes will appear there.
Chinese companies
TikTok in Ireland, Didi at home.
Two cases. One is a European regulator acting on access from China. The other is China's own regulator acting on a Chinese company: a different model of data governance, the one Group 4 compared on their slide 40.
TikTok: remote access from China is a transfer
The decision €530 m
EEA users' data was accessed remotely by staff in China. TikTok did not show that it was protected to an equivalent standard, nor assess access by Chinese authorities under Chinese law.
Order: comply within six months, or suspend the transfers to China.
What it tells a team 3 points
Storage in Europe did not settle it: remote access counted The assessment of foreign law is a deliverable The suspension order bites before any appeal ends
Location is not control: the access path is what is judged.
dataprotection.ie, 2025-05-02 · Law Society Gazette, 2025-05
On 2 May 2025 the Irish Data Protection Commission fined TikTok 530 million euros: about 485 million for unlawful transfers and 45 million for lack of transparency. Staff in China had remote access to the personal data of users in the European Economic Area. TikTok had not verified that the data received a level of protection essentially equivalent to the EU's, and had not addressed possible access by Chinese authorities under Chinese anti-terrorism, counter-espionage and other laws. The DPC ordered TikTok to bring its processing into compliance within six months, failing which the transfers would be suspended. It was the first transfer decision concerning China, and the first about remote access rather than storage. TikTok appealed.
This is the same reasoning as Case 02 of the lecture, from the other side: where the data sits matters less than who can reach it, and the operator must document why foreign law is not a problem. In April 2025 TikTok also told the DPC that some EEA data had been stored in China, contrary to what it said during the inquiry; that point is handled separately.
Didi: China's own regulator, at 4.6 % of revenue
The decision ¥8.026 bn
After a cybersecurity review opened days after Didi's listing in New York in 2021, the CAC fined the company 8.026 billion yuan under the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law.
The other model state-led
About 4.6 % of 2021 revenue, near the legal ceiling Apps removed from stores during the review Data security treated as national security
Same vocabulary as in Brussels, a different purpose .
CAC, 2022-07-21 · The Standard (HK), 2022-07 · Bamboo Works, 2022-07
On 21 July 2022 the Cyberspace Administration of China fined Didi Global 8.026 billion yuan, about 1.2 billion dollars, and fined two of its executives personally. The review had started in July 2021, days after Didi's initial public offering in New York, and its apps were removed from Chinese app stores during the review. The fine was about 4.6 % of Didi's 2021 revenue of 173.8 billion yuan. The PIPL allows fines of up to 5 % of the previous year's turnover for serious cases.
The comparison is useful because the words look familiar: personal information, data security, cross-border transfer. The purpose differs. In the EU the frame is fundamental rights and fair markets; in China the state treats data as a factor of production and data security as national security. Group 4 made the same distinction on their slide 40.
And the Data Act?
Applicable since 12 September 2025. No published fine yet.
The obvious question after these examples: where are the Data Act fines? The next slide answers honestly: there are none we could find, and the reason is structural.
No Data Act fine yet, and why
Authorities still being named Germany: Bundesnetzagentur leads, the BfDI for personal data; law adopted by the Bundestag on 26 March 2026. Luxembourg: bill 8809, ILR leading, pending.
First complaints cross-border Finland's Traficom received a complaint against a Swedish data holder refusing free access, and passed it to the Swedish authority.
What to expect an inference Orders before fines: access granted, terms rewritten, switching charges refunded. Fines follow evidence.
The first Data Act cases will be won or lost on logs .
DLA Piper, 2026-03-31 · Hannes Snellman, 2026 · chd.lu, bill 8809
We found no published fine under the Data Act as of 20 October 2026. Enforcement is national and many authorities are only now being set up. In Germany the Bundestag adopted the implementing law on 26 March 2026: the Bundesnetzagentur leads, the BfDI handles sanctions where personal data is involved, and coercive fines of up to 500,000 euros can enforce orders. In Finland, Traficom reported a first complaint about a Swedish data holder refusing to provide data free of charge to a Finnish company, and transferred it to the Swedish authority. In Luxembourg, bill 8809 designates the ILR, with the CNPD for personal data; it is still pending.
The right column is our inference, not a fact: if the GDPR is a guide, early cases will end in orders more often than in fines, and the outcome will depend on what the company can show, request by request.
What these cases teach a platform team
Transfers carry the largest fines Meta, Uber, TikTok: €2 bn together, all about who can reach the data Remote access counts as a transfer TikTok: data stored in Europe, read from China Orders bite sooner than fines Six months to comply or stop; fines wait for appeals
Procedure decides the outcome Amazon: findings upheld, fine annulled on procedure The boring systems get fined Vendors, consent records, access requests
Each one maps to a line of the production checklist .
Five lessons. Transfers and foreign access produced the largest fines: Meta's 1.2 billion, TikTok's 530 million and Uber's 290 million together exceed two billion euros. Remote access is treated as a transfer, so an architecture diagram that only shows where data is stored misses the question. Corrective orders, such as suspending transfers within six months, take effect much sooner than fines, which wait for appeals. Procedure matters: in the Amazon case the infringements were upheld and the fine annulled on procedure. And most fines concern ordinary systems: vendor oversight, consent records, access requests.
Back to the main deck: each lesson maps to a line of the production checklist (slide 37): inventory, access path, delegation, exit, keys, evidence.