Privacy enforcement over time

A yearly count of fines only means something if the source lists every fine. The trend figures therefore use only regulators' own complete registers: France CNIL, sanctions prononcées; Ireland DPC, decisions; UK ICO, civil monetary penalties. Fines from other sources (FTC press releases since collection began, and fines entered from secondary sources) are listed separately and are not used for trends.

Amounts are converted to U.S. dollars at the Treasury Reporting Rate of Exchange in effect on the date of the fine: the latest quarterly rate on or before that date. Fines whose amount the register does not state are counted but have no amount. Irish DPC fines are not payable until a court confirms them, so they are counted when the decision is issued. Fines a court overturned are counted but their amounts are left out. One very large fine can dominate a year's total, so medians are shown as well.

Two things change the counts without any change in how hard regulators enforce. Since 2022 the CNIL has had a simplified procedure for smaller cases, capped at €20,000, and most of its fines since 2023 were issued under it; the rise in French fines is mostly that procedure. Before 2019 the CNIL's table records most fines without their amount (the amount is only in each decision), so French totals for those years are understated; the “with an amount” column shows how many are included. The ICO publishes its penalties as a file it replaces from time to time; the file used here is dated 17 November 2025, so later UK fines are missing until a newer file is published.

EDPB decisions are the final decisions in cross-border cases, adopted by the lead authority after the other authorities concerned have had their say (GDPR Article 60). Each is listed once, under the lead authority.