It isn’t only big tech
Retailers, clinics, apps, hiring platforms and lawyers have all been penalised. The rules apply to anyone handling personal data or using AI with people.
N/
Enforcement news
This is already happening. Here’s what it cost.
Real cases from around the world where companies were fined, banned or sued over data and AI. What happened, which law, the penalty, and the lesson for your business.
Live from regulators
United StatesCox Media Group, MindSift and 1010 Digital Works$930NetherlandsUber€824.99 million fineSouth KoreaCoupangAbout KRW 624.7 billion in finesUnited StatesGeneral Motors$12.75 million plus a 5-year ban on selling driving data to consumer reporting agenciesUnited KingdomReddit£14.47 million fineSaudi ArabiaMultiple data controllers (not named)48 decisions confirming violations and applying penaltiesUnited KingdomCapita£14 million in totalAustraliaAustralian Clinical LabsAUD 5.8 million civil penalty plus AUD 400ColombiaWorld Foundation and Tools for Humanity (Worldcoin)Order to close operations in ColombiaSouth KoreaSK TelecomKRW 134.8 billion fine plus KRW 9.6 million administrative penalty and corrective orderAustraliaOptus (Singtel Optus Pty Ltd and Optus Systems Pty Ltd)Civil penalty proceedings filedTurkeyxAI / X (Grok chatbot)Access block on about 50 Grok postsUnited Kingdom23andMe£2.31 million fineUnited StatesWorkdayNone yet – case ongoingKenyaTools for Humanity (Worldcoin)Order to delete all biometric data collected in Kenya and stop further processingIrelandTikTok€530 million fine
Why compliance matters
Regulators are no longer warning.
They are fining.
Data protection and AI laws are now enforced worldwide, and not only against big tech. Small businesses, apps and professionals are on the same rulebook.
€1.2 billionTotal GDPR fines reported across Europe in 2025, roughly the same as in 2024DLA Piper GDPR Fines and Data Breach Survey, January 2026€7.1 billionTotal GDPR fines reported since the law took effect in May 2018 (to 10 January 2026)DLA Piper GDPR Fines and Data Breach Survey, January 2026443 a dayAverage number of personal data breaches reported to European regulators each day (year to 27 January 2026), up 22%DLA Piper GDPR Fines and Data Breach Survey, January 2026$4.99 millionGlobal average cost of a single data breach in 2026, a record high and up 12% on the year beforeIBM Cost of a Data Breach Report 2026
The fine is rarely the biggest cost
Orders to delete data or models, bans on using a technology, lost contracts, lawsuits and headlines often cost more than the penalty itself.
AI is now on the enforcement list
Regulators have acted on AI chatbots, facial recognition, AI hiring tools and exaggerated AI marketing claims. ‘The AI did it’ has not worked as a defence.
Basics would have prevented most of it
A clear privacy notice, a lawful reason for using data, consent where needed, decent security and honest claims. Most cases below come down to one of these.
Region
Topic
Showing 43 of 43 cases
Marketing firms pay $930,000 over fake AI 'listening' ad service
$930,000 in total ($880,000 Cox Media Group; $25,000 each for the two partners)
AI marketing claims must match what the product really does. Burying 'consent' in standard terms of service will not count as permission to collect sensitive data like voice.
What happenedUber fined almost €825m for letting an algorithm switch off drivers' accounts
€824.99 million fine (just under €825 million)
If software makes a decision that seriously affects someone, such as their income or access to a service, a real person must be able to step in and the person affected must be told how it works. This is now the second-largest GDPR fine on record.
What happenedCoupang hit with Korea's biggest ever privacy fine after insider data leak
About KRW 624.7 billion in fines (about US$409 million per news reports), the largest privacy penalty in Korea's history
Insider access and key management are real breach risks, and regulators may also penalise unrelated tracking practices they find during a breach investigation.
What happenedGM pays record $12.75m for selling drivers' location and driving data
$12.75 million plus a 5-year ban on selling driving data to consumer reporting agencies
Collect only the data you need, keep it only as long as needed, and do not use it for a new purpose, such as selling it, without telling people. Data from connected products and apps is a priority for regulators.
What happenedReddit fined £14.47m for not checking the age of its users
£14.47 million fine
Writing 'no children allowed' in your terms is not enough; if children are likely to use your service, you need working age checks and a documented risk assessment.
What happenedSaudi Arabia reports 48 penalty decisions as data protection enforcement goes live
48 decisions confirming violations and applying penalties (individual amounts not published)
Saudi Arabia's privacy law is now actively enforced, so businesses there need consent for marketing and proper security, not just a policy on paper.
What happenedCapita fined £14m after hackers stole data on 6.6 million people
£14 million in total (£8m Capita plc, £6m Capita Pension Solutions), reduced from a proposed £45m
Security warnings must be acted on quickly; ignoring known weaknesses and responding slowly to alerts turns a cyber attack into a large regulatory fine as well.
What happenedFirst ever Privacy Act civil penalty: Australian Clinical Labs ordered to pay $5.8m
AUD 5.8 million civil penalty plus AUD 400,000 in costs
When you acquire a business you also take on its cyber risk, and a slow investigation or late breach report can add to the penalty.
What happenedColombia shuts down Worldcoin's iris-scanning and orders data deleted
Order to close operations in Colombia, delete biometric (iris) data and stop collecting personal data
Biometric data stays personal data even after it is encrypted or split up, and paying people for it does not replace proper consent.
What happenedSK Telecom fined KRW 134.8 billion after SIM data hack
KRW 134.8 billion fine plus KRW 9.6 million administrative penalty and corrective order
Basic controls like encryption and access management, plus prompt notification, are what regulators check first after a breach, and failures there drive the size of the fine.
What happenedAustralian privacy regulator sues Optus over 2022 breach affecting 9.5m people
Civil penalty proceedings filed; up to AUD 2.22 million per contravention available (penalty not yet decided)
Large data holders are judged against what is reasonable for their size and risk, and a major breach can lead to court action years later.
What happenedTurkish court blocks Grok chatbot posts in first ban on AI-generated content
Access block on about 50 Grok posts; criminal investigation opened
Companies are responsible for what their AI says in each country they operate in, and local content laws apply to AI output just as they do to human posts.
What happened23andMe fined £2.31m after weak logins exposed UK users' genetic data
£2.31 million fine (reduced from a proposed £4.59m)
Customers reuse passwords, so a business holding sensitive data should require a second login step and watch for suspicious access; basic controls like these are what regulators check first.
What happenedCourt lets job seekers over 40 sue Workday together over AI screening
None yet – case ongoing
Both AI vendors and the businesses that use them can face discrimination claims over automated decisions. Ask vendors how their tools are tested for bias and keep records of your own checks.
What happenedKenyan court orders Worldcoin to delete iris and face data
Order to delete all biometric data collected in Kenya and stop further processing
Before collecting sensitive data such as biometrics, carry out an impact assessment and get genuine consent; skipping these can mean losing the data entirely.
What happenedTikTok fined €530m over staff in China accessing European users' data
€530 million fine (€485m for transfers, €45m for transparency), plus an order to suspend transfers to China if not fixed
Letting overseas colleagues or vendors simply view data counts as a transfer; you need to assess the destination country's laws and tell people where their data goes.
What happenedAI companion app Replika fined €5m in Italy over legal basis and age checks
€5 million fine, plus orders to fix its privacy notice and age checks
Launching an AI product does not suspend ordinary privacy rules: you need a clear legal basis, an honest privacy notice and effective age checks before you go live.
What happenedHonda fined $632,500 for making it hard to opt out of data sharing
$632,500 fine plus a simpler privacy request process and compliance certification
Opting out must be as easy as opting in, and you should not demand ID checks or extra data for a simple opt-out. Have written data protection terms with every vendor that receives customer data.
What happened'Robot lawyer' DoNotPay pays $193,000 over claims it could replace lawyers
$193,000 and a ban on unsupported claims that its AI matches a human lawyer
Before saying an AI product can replace a professional or a human task, have real evidence that it can. Regulators treat AI performance claims like any other advertising claim.
What happenedSouth Korea pauses DeepSeek downloads over how the AI app handled user data
New app downloads suspended (about two months); corrective recommendation in April 2025
Launching an AI product in a new country without checking local privacy law can get it pulled from app stores, and regulators look closely at where prompts and user data end up.
What happenedItaly orders Chinese chatbot DeepSeek to stop using Italians' data
Immediate order to stop processing Italian users' data, plus a formal investigation
If you offer a service to people in Europe, European privacy law can reach you even with no office there, and a regulator can shut you out of a market overnight.
What happenedOpenAI's €15m Italian ChatGPT fine is overturned on jurisdiction grounds
€15 million fine and a six-month public information campaign (later annulled by the Court of Rome)
Where you set up your main EU establishment decides which regulator you deal with, so corporate structure matters; but the underlying questions about AI training data remain open.
What happenedIndia fines Meta ₹213 crore over WhatsApp's 2021 'accept or leave' privacy update
₹213.14 crore penalty plus directions on data sharing
Privacy terms can be challenged under competition law too: 'take it or leave it' consent from a dominant platform is risky.
What happenedLinkedIn fined €310m for using member data for targeted ads without valid consent
€310 million fine, a reprimand and an order to fix its processing
Consent only works if people genuinely understand and agree to the specific use; vague or bundled consent for advertising will not hold up.
What happenedClearview AI fined €30.5m for scraping billions of faces from the internet
€30.5 million fine, plus up to €5.1 million more in penalties for continued non-compliance
Publicly available images are still personal data; and businesses that buy or use tools built on scraped data can face liability too.
What happenedStar Health customer and medical records leaked through Telegram chatbots
No regulatory fine reported; court injunctions against Telegram and the hacker, criminal case registered
Health and insurance data is a prime target, and once it leaks onto messaging platforms the clean-up and reputational damage can last long after the breach.
What happenedMeta pays Texas $1.4bn over facial recognition without consent
$1.4 billion paid over five years
Face scans, fingerprints and voiceprints are treated as highly sensitive. Get clear, informed consent before collecting them, and check state biometric laws before rolling out such features.
What happenedNigeria's $220m penalty on Meta over WhatsApp data practices upheld
US$220 million administrative penalty (plus US$35,000 investigation costs awarded on appeal)
In many markets, consumer and competition regulators enforce privacy alongside the data protection authority, so one practice can attract several penalties.
What happenedBrazil orders Meta to stop training its AI on Brazilians' posts
Preventive order suspending AI training on Brazilian users' data, with BRL 50,000 daily fine for non-compliance
Using customer data to train AI needs a clear legal basis, plain notice and a real way to say no, especially where children are involved.
What happenedMeta pauses AI training on Europeans' posts after Irish regulator steps in
No fine; Meta paused AI training on EU users' posts after regulator intervention
Reusing customer data to train AI is a new purpose; plan for clear notice and an easy way to object, and expect regulators to review it before launch.
What happenedSEC fines two investment firms for overstating their use of AI
$400,000 in total civil penalties ($225,000 Delphia; $175,000 Global Predictions)
Claims about using AI are ordinary marketing claims and must be true and provable. Do not describe a product as AI-powered unless you can show how.
What happenedAir Canada held responsible for wrong advice given by its website chatbot
About CA$812 in damages, interest and tribunal fees
A business is answerable for what its customer-facing AI tells people, just as it is for its staff and web pages. Test chatbots against your real policies and fix answers that could mislead customers.
What happenedRite Aid banned from facial recognition for five years after false shoplifting alerts
5-year ban on facial recognition for surveillance; delete images and any AI models built from them
If you use AI to make decisions about people, you need testing, accuracy checks, staff training and monitoring before and after launch. Weak safeguards can cost you the right to use the technology at all.
What happenedTikTok fined €345m for public-by-default settings on children's accounts
€345 million fine, a reprimand and an order to comply within three months
Products used by children must start with the most private settings switched on, and design choices that steer users towards sharing more can themselves break the law.
What happenedTutoring firm pays $365,000 after its hiring software screened out older applicants
$365,000 to rejected applicants, plus training, new policies and at least 5 years of EEOC monitoring
If an automated screening tool discriminates, the employer is liable, not the software. Check how any hiring tool filters candidates before you rely on it.
What happenedOnline therapy firm BetterHelp pays $7.8m for sharing health data with advertisers
$7.8 million for consumer refunds and a ban on sharing health data for advertising
Your privacy promises are binding. Tracking pixels and ad tools on sites that handle health or other sensitive data can break those promises without you realising it.
What happenedLawyers fined after filing a brief full of court cases ChatGPT made up
$5,000 sanction on two lawyers and their firm, plus letters to the client and to the judges falsely named
Using AI does not shift responsibility: whoever signs or sends a document must check every fact and source an AI tool produces. Firms need a simple rule that AI output is verified by a person before it goes out.
What happenedAmazon pays $25m for keeping children's Alexa voice recordings forever
$25 million civil penalty plus deletion and data-use restrictions
Keeping data 'just in case' or to train AI is not a valid reason to hold it, especially children's data. When people ask you to delete data, it must actually be deleted everywhere.
What happenedMeta fined a record €1.2bn for sending Facebook users' data to the US
€1.2 billion fine, plus orders to suspend transfers and bring past processing into line
Signing standard contract clauses is not the end of the job; you must check that the data is actually protected in the country it goes to.
What happenedTikTok drops appeal and pays £12.7m UK fine over under-13 users
£12.7 million fine
If you know or should know children are using your service, you are responsible for their data, even if your terms say they are not allowed.
What happenedFortnite maker pays $275m for collecting children's data and unsafe default settings
$275 million COPPA penalty (plus a separate $245 million for consumer refunds)
If children are likely to use your product, you need parental consent and privacy-protective default settings. Design choices that push users into decisions can be unlawful on their own.
What happenedSephora pays $1.2m for selling shopper data and ignoring browser opt-out signals
$1.2 million plus compliance changes and reporting
Ad and analytics trackers on your website can count as selling or sharing data. Know which trackers you run, say so in your privacy notice, and honour automatic opt-out signals.
What happenedChina fines Didi RMB 8 billion after year-long cybersecurity review
RMB 8.026 billion fine, plus RMB 1 million each on the CEO and president
Data handling can become a national-security issue, and regulators can hold senior executives personally responsible, not just the company.
What happened
Summaries in our own words, based on regulator announcements and reputable reporting linked on each case. Some decisions are under appeal. General information, not legal advice.