Data Privacy Enforcement & Fines Tracker
20
July 2026
Regulation
Confirmed regulatory fines and enforcement penalties issued by data protection authorities against companies for privacy violations, structured each month from regulator press releases, official registers, and legal news. Each record includes the enforcing authority, penalised company, penalty amount and currency, regulation cited, violation type, jurisdiction, and enforcement date. Coverage spans EU member state DPAs enforcing GDPR, the UK ICO, the FTC, US state attorneys general, and other national privacy regulators.
Data protection authority issuing a fine or enforcement penalty against a company for a privacy violation in the US or Europe in the last month
Data protection officers and privacy counsel use it to monitor regulatory enforcement trends and benchmark penalty levels across jurisdictions. Compliance and legal teams at multinationals track it to identify enforcement priorities by regulator. Cyber insurers and risk consultancies use it to model regulatory exposure. Journalists covering data regulation use it as a structured monthly record of confirmed enforcement actions.
1146
<table class="catchall-table"><thead><tr><th style="min-width:40px">#</th><th style="min-width:280px">Event</th><th style="min-width:160px">Location</th><th style="min-width:160px">Enforcement Authority</th><th style="min-width:160px">Penalized Company</th><th style="min-width:160px">Regulation Cited</th><th style="min-width:160px">Violation Type</th><th style="min-width:160px">Enforcement Date</th><th style="min-width:160px">Penalty Currency</th><th style="min-width:160px">Penalty Amount</th></tr></thead><tbody><tr><td style="min-width:40px">1</td><td style="min-width:280px">Spanish DPA fines parking company for GDPR violations</td><td style="min-width:160px">Spain</td><td style="min-width:160px">Spanish Data Protection Agency (AEPD)</td><td style="min-width:160px">ACVIL Aparcamientos SLU</td><td style="min-width:160px">GDPR Article 15, GDPR Article 18</td><td style="min-width:160px">violation of the right of access, violation of the right to limitation of processing</td><td style="min-width:160px">2026-07-19</td><td style="min-width:160px">EUR</td><td style="min-width:160px">150,000</td></tr><tr><td style="min-width:40px">2</td><td style="min-width:280px">Florida Attorney General's CHINA Prevention Unit subpoenas Shein for data privacy violations</td><td style="min-width:160px">United States</td><td style="min-width:160px">Florida Attorney General's Office</td><td style="min-width:160px">Shein</td><td style="min-width:160px">Florida's consumer protection statutes</td><td style="min-width:160px">data privacy violations</td><td style="min-width:160px">2026-07-21</td><td style="min-width:160px">USD</td><td style="min-width:160px">0</td></tr><tr><td style="min-width:40px">3</td><td style="min-width:280px">Italian Privacy Guarantor Fines Lusha Systems Inc. €2 Million for GDPR Violations</td><td style="min-width:160px">Italy</td><td style="min-width:160px">Privacy Guarantor</td><td style="min-width:160px">Lusha Systems Inc.</td><td style="min-width:160px">GDPR</td><td style="min-width:160px">Unlawful data processing, lack of legal basis, violation of transparency and data minimization principles, and tracking without adequate guarantees</td><td style="min-width:160px">2026-07-27</td><td style="min-width:160px">EUR</td><td style="min-width:160px">2,000,000</td></tr><tr><td style="min-width:40px">4</td><td style="min-width:280px">Federal Network Agency finds DSA violations by eBay</td><td style="min-width:160px">Germany</td><td style="min-width:160px">Federal Network Agency</td><td style="min-width:160px">eBay</td><td style="min-width:160px">Digital Services Act (DSA)</td><td style="min-width:160px">failure to implement user-friendly reporting processes, lack of transparency in user bans, and insufficient trader traceability</td><td style="min-width:160px">2026-07-06</td><td style="min-width:160px">EUR</td><td style="min-width:160px">2,500,000,000</td></tr><tr><td style="min-width:40px">5</td><td style="min-width:280px">Odido Data Breach Investigation and Potential GDPR Fines</td><td style="min-width:160px">Netherlands</td><td style="min-width:160px">Autoriteit Persoonsgegevens (Dutch Data Protection Authority)</td><td style="min-width:160px">Odido</td><td style="min-width:160px">GDPR</td><td style="min-width:160px">data breach; failure to protect customer data</td><td style="min-width:160px">2026-07-01</td><td style="min-width:160px">EUR</td><td style="min-width:160px">2,500,000,000</td></tr><tr class="catchall-blurred"><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td></tr><tr class="catchall-blurred"><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td></tr><tr class="catchall-blurred"><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td><td>████████████</td></tr></tbody></table>
<h3>Which regulators are covered?</h3><p>EU member state Data Protection Authorities enforcing GDPR, the UK Information Commissioner's Office (ICO), the US Federal Trade Commission (FTC), US state attorneys general enforcing state privacy laws (CCPA, VCDPA, and others), and equivalent national regulators in Europe. The dataset expands coverage as enforcement activity increases in new jurisdictions.</p><h3>Are investigations included or only finalised fines?</h3><p>Both. Formally opened investigations with a named company are included alongside finalised fines and penalty settlements. The enforcement stage is captured in the record so users can distinguish between an active investigation and a concluded enforcement action.</p><h3>Does this cover DSA and AI Act enforcement as well as GDPR?</h3><p>Yes. The dataset captures enforcement actions under any data protection or digital regulation where a named company is penalised or formally investigated, including GDPR, the UK GDPR, CCPA, the Digital Services Act, and emerging AI Act enforcement where it involves data processing violations.</p><h3>What is the refresh rate of this dataset?</h3><p>We rerun this dataset once a month. You can create your own dataset that updates as frequently as every one hour on <a href="https://platform.newscatcherapi.com/catchall">platform.newscatcherapi.com/catchall</a></p>