GDPR DPA Enforcement Trends 2025: €1.4B in Total Fines, Ireland Leads

Ireland's DPC is the lead supervisory authority for the vast majority of major US technology companies with EU headquarters in Ireland: Meta, Google, Apple, LinkedIn, Airbnb, and many others. This gives the DPC outsized responsibility for cross-border enforcement. Total fines since GDPR enforcement began in May 2018: over €3.5B — more than four times Luxembourg, the next largest DPA by volume. Major fines: Meta €1.2B (2023, data transfers), Instagram €405M (2022, children's data), WhatsApp €225M (2021, transparency), TikTok €345M (2023, children's data), LinkedIn €310M (2024, lawful basis), Meta €251M (2024, 2018 data breach).

Luxembourg's CNPD issued the second-largest GDPR fine ever — €746M against Amazon Europe Core in July 2021 — for unlawful advertising targeting. France's CNIL is known for large cookie consent fines: €150M against Google (2022), €60M against Facebook (2022), and €40M against Apple (2022), all for making cookie rejection harder than acceptance. CNIL also fined TikTok €5M in 2023 and has been active on AI Act overlap investigations beginning in 2025.

Spain's Agencia Española de Protección de Datos (AEPD) is the most active DPA in Europe by number of enforcement actions. Fines are typically smaller than Ireland or Luxembourg but cover a wide range: unsolicited marketing calls, video surveillance without notice, employer processing violations, and financial sector data sharing. Italy and Romania follow in second and third place by fine count. The AEPD's high volume reflects aggressive enforcement of data subjects' complaint rights.

Italy's Garante blocked ChatGPT for one month in 2023 for GDPR violations before reaching a compliance agreement, and fined OpenAI €15M in December 2024. Germany's 16 state-level DPAs operate independently — the Hamburg DPA and Berlin Commissioner frequently investigate consumer platforms; the BfDI handles federal matters and cross-border cases. German DPAs have fined H&M €35M (employee surveillance), Notebooksbilliger.de €10.4M (excessive CCTV), and Deutsche Wohnen €14.5M (excessive data retention).

Understand Your GDPR Penalty Exposure

Use ComplianceStack's free tools to identify gaps before regulators do.

Which EU country has issued the most GDPR fines by number?

Spain's AEPD has issued the most GDPR fines by number every year since enforcement began in 2019. Spanish enforcement is characterized by high volume, faster case resolution, and smaller average fine sizes compared to Ireland or Luxembourg. Italy and Romania follow in second and third place by fine count. By monetary value, Ireland leads by a wide margin due to its role as lead supervisory authority for major US tech companies headquartered there. The contrast reflects two enforcement philosophies: Ireland pursues fewer, larger cross-border cases through the Article 60 cooperation mechanism; Spain and Italy pursue larger volumes of domestic complaints and self-initiated investigations.

Why does Ireland issue so many of the largest GDPR fines?

Ireland is the EU headquarters of the world's largest technology companies: Meta, Google, Apple, LinkedIn, Airbnb, Twitter/X, TikTok, and many others. Under the GDPR's main establishment rule (Article 56), the lead supervisory authority is the DPA in the EU member state where a company has its main establishment — defined as the central EU administration or where decisions about data processing purposes are taken. Since these companies have EU headquarters in Ireland, the DPC handles all cross-border complaints and investigations involving their EU processing. This gives the DPC jurisdiction over the most data-intensive companies in the world, explaining why Ireland accounts for over 80% of cumulative GDPR fine value.

How will the EU AI Act affect GDPR enforcement in 2025–2026?

Significantly. The EU AI Act (entered into force August 1, 2024) overlaps substantially with GDPR enforcement for AI systems that process personal data. The AI Act prohibits certain AI practices outright including real-time biometric surveillance in public spaces and social scoring. EU DPAs will enforce GDPR violations arising from AI systems — unlawful processing of training data, automated decision-making without transparency, biometric data without valid basis — alongside the new EU AI Office enforcing AI Act prohibitions. The first wave of AI Act enforcement actions, including GDPR-grounded investigations of AI companies' training data practices, began in 2025. Full AI Act enforcement for high-risk AI systems applies from August 2, 2026.

Which sectors received the most GDPR fines in 2024–2025?

Technology and social media remained the largest single sector by fine value, driven by Ireland's enforcement against Meta, LinkedIn, TikTok, and Google. However, the share of non-tech fines grew substantially: healthcare providers faced increased scrutiny for insecure data sharing and breach notification failures; financial services firms (banks, insurers, fintech) were targeted for improper credit scoring and automated decision-making; employers faced fines for employee monitoring and surveillance in the workplace (H&M €35M, various smaller fines in 2024–2025); municipalities and government agencies were fined for CCTV over-collection and inadequate transparency. The EDPB's 2025 Coordinated Enforcement Framework specifically targeted AI systems in hiring, credit, and insurance — marking a structural shift in enforcement priorities away from cookies and toward algorithmic processing.