--- title: "Data Privacy Statistics 2026: GDPR Fines, Laws and Consumer Attitudes" date: 2025-12-15 author: "Supriya Gharat" featured_image: "https://xtendedview.com/wp-content/uploads/2026/10/data-privacy-statistics-gdpr-fines-laws-consumer-attitudes.jpg" categories: - name: "Cybersecurity" url: "/category/cybersecurity.md" tags: - name: "Statistics" url: "/tag/statistics.md" --- # Data Privacy Statistics 2026: GDPR Fines, Laws and Consumer Attitudes European supervisory authorities issued fines totalling approximately **€1.2 billion** in 2025 under the General Data Protection Regulation (GDPR), according to DLA Piper. That broadly matched 2024’s figure. The aggregate total from May 25, 2018, to January 10, 2026, stands at **€7.1 billion**, and Ireland’s Data Protection Commission (DPC) accounts for **€4.04 billion** of it. These data privacy statistics start with that enforcement record, then cover privacy laws, deletion tools and attitudes. Survey data from the US leans the same way. Some **72%** of Americans say there should be more regulation of what companies can do with people’s data than there is now, yet **56%** frequently click “agree” without actually reading privacy policies. The Pew figures come from a May 2023 survey, so they are older than the enforcement data. ## Key Takeaways - Ireland’s DPC accounts for **56.9%** of the **€7.1 billion** in GDPR fines issued from May 2018 to January 10, 2026, so one regulator sets most of the total. - GDPR fines fell **33%** in the year from January 28, 2024, to **€1.2 billion**, and 2025 broadly matched that figure at approximately **€1.2 billion**. - Some **72%** of US adults want more regulation of company data use, while **56%** frequently click “agree” without reading privacy policies, according to Pew Research Center. - More than **500,000** Californians registered for the Delete Request and Opt-out Platform (DROP) by August 25, 2026, a one-time sign-up for deletion requests to data brokers. - **90%** of organizations report their privacy programs have expanded due to AI, while **23%** still lack a dedicated AI governance committee, according to Cisco’s 2026 study. - **19** US states had passed comprehensive privacy laws as of the International Association of Privacy Professionals (IAPP) 2025 report. ## Editor’s Choice - GDPR fines issued in 2025: approximately **€1.2 billion**. - Total GDPR fines, May 25, 2018, to January 10, 2026: **€7.1 billion**. - Largest GDPR fine ever, against Meta in 2023: **€1.2 billion**. - US adults who feel little or no control over government use of their data, 2023: **79%**. - Largest California Consumer Privacy Act (CCPA) penalty to date: General Motors, May 8, 2026, **$12.75 million**. - Consumers who will not buy from organizations they don’t trust with their data, 2024: **75%**. ## GDPR Fines Statistics - European supervisory authorities issued fines totalling approximately **€1.2 billion** in 2025, according to DLA Piper’s January 2026 survey. - The aggregate total since May 25, 2018, to January 10, 2026, stands at **€7.1 billion** across all the jurisdictions surveyed. - The highest fine in 2025 was a **€530 million** penalty issued by the Irish DPC in April 2025 for breaching the GDPR’s international data transfer restrictions. - The 2025 total marks a reversal of the previous year’s downward trend, with no year-on-year increase. | Measure | Value | Period | |---|---|---| | GDPR fines issued | approximately €1.2 billion | 2025 | | Total GDPR fines | €7.1 billion | May 25, 2018, to January 10, 2026 | | GDPR fines issued | €1.2 billion | Year from January 28, 2024 | | Total GDPR fines | €5.88 billion | 2018 to the January 2025 survey | | Luxembourg authority fines | €746.38 million | May 2018 to the January 2025 survey | | Largest GDPR fine (Meta) | €1.2 billion | 2023 | *Source: DLA Piper GDPR Fines and Data Breach Surveys, January 2025 and January 2026* ### About This Data - Sources: 21 published pages, 11 of them regulator and government releases (Ireland’s DPC, France’s Commission Nationale de l’Informatique et des Libertés (CNIL), the European Data Protection Board and California’s privacy agency and attorney general). - Also cited: 9 survey and research reports from DLA Piper, Cisco, Pew Research Center and the IAPP, plus one news report. - Publication window: January 2023 to September 2026. - Selection: regulator decisions, regulator-reported fine totals and surveys that publish their own method; breach counts and breach costs are left out. - Updates: reviewed on a rolling basis, with figures updated when sources publish new editions. ## GDPR Fines by Year - Supervisory authorities across Europe issued **€1.64 billion** in fines in the year from January 28, 2022, a year-on-year increase of **50%**. - Fines reached **€1.78 billion** in the year from January 28, 2023. - The 2024 survey year brought a **33%** decrease, bucking the 7-year trend of increasing enforcement. - On average, fines referred to the European Data Protection Board (EDPB) during 2022 for a ruling were increased by **630%**. GDPR FINES · Source: DLA Piper GDPR Fines and Data Breach Surveys, January 2023 to January 2026 GDPR FINES DLA · 2023 to 2026 GDPR Fines by Survey Year (€ billions) 2022 survey year €1.64B 2023 survey year €1.78B 2024 survey year €1.2B 2025 (approximate) €1.2B 0 0.4 0.8 1.2 1.6 2 SOURCE DLA Piper GDPR Fines and Data Breach Surveys, January 2023 to January 2026 View the data| Survey year (from January 28) | GDPR fines (€ billions) | |---|---| | 2022 survey year | 1.64 | | 2023 survey year | 1.78 | | 2024 survey year | 1.2 | | 2025 (approximate) | 1.2 | > **Why it matters:** DLA Piper’s seventh annual survey put total fines since 2018 at **€5.88 billion**, and **€7.1 billion** by January 10, 2026. Annual totals swing with a handful of large decisions, so a flat year says more about the size of the biggest cases than about how many companies regulators pursue. ## Recent Developments - **August 11, 2026:** The California Privacy Protection Agency Board required LocateSmarter LLC, an Iowa data broker, to pay **$116,490**, its first decision against a data broker under the CCPA. - **August 25, 2026:** More than **500,000** Californians had registered for DROP since it launched on January 1. - **September 21, 2026:** The DPC imposed administrative fines totalling **€403 million** on Google and ordered it to bring its processing into compliance within **6** months. - **September 21, 2026:** The EDPB put Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR open for feedback until November 13, 2026. - **September 27, 2026:** Governor Newsom signed the Expanding Privacy Rights Act, closing a loophole in the CCPA’s right to delete; the law takes effect January 1, 2027. ## Major European Privacy Fines - The largest fine ever imposed under the GDPR remains the **€1.2 billion** penalty the Irish DPC issued against Meta Platforms Ireland Limited in 2023. - The DPC’s decision against the [TikTok video platform](/tiktok-statistics/) includes administrative fines totalling **€530 million** and an order suspending TikTok’s transfers to China if processing is not brought into compliance within **6** months. - Google’s **€403 million** fine covers location data in Web & App Activity, Location History and Location Accuracy between May 25, 2018, and February 4, 2020. - France’s data protection authority the CNIL fined Google **325 million euros** on September 1, 2025, for showing ads between [Gmail users’ emails](/protonmail-vs-gmail-statistics/) without consent and for placing cookies at account creation without valid consent. - The CNIL fined SHEIN’s Irish subsidiary **150 million euros** on September 1, 2025, over cookies placed on the devices of users visiting shein.com. FINE · Source: Irish Data Protection Commission, CNIL, DLA Piper, 2023 to 2026 FINE Irish · 2023 to 2026 Major European Privacy Fines (€ millions) Meta, Irish DPC €1,200M TikTok, Irish DPC €530M Google, Irish DPC €403M Google, CNIL €325M LinkedIn, Irish DPC €310M Facebook, Irish DPC €210M Instagram, Irish DPC €180M SHEIN, CNIL €150M 0 300 600 900 1.2K SOURCE Irish Data Protection Commission, CNIL, DLA Piper, 2023 to 2026 View the data| Company and regulator | Fine (€ millions) | |---|---| | Meta, Irish DPC | 1200 | | TikTok, Irish DPC | 530 | | Google, Irish DPC | 403 | | Google, CNIL | 325 | | LinkedIn, Irish DPC | 310 | | Facebook, Irish DPC | 210 | | Instagram, Irish DPC | 180 | | SHEIN, CNIL | 150 | LinkedIn’s **€310 million** fine, notified on October 22, 2024, also included a reprimand and an order to bring its processing into compliance. The Meta group were on the receiving end of some of the very largest fines in DLA Piper’s 2023 survey, for Facebook and Instagram profiling practices. ### What can you not do under GDPR? The DPC found Google infringed the GDPR on the lawfulness and fairness of its location data processing, on transparency and on how long it kept that data. TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee and demonstrate that the data was afforded a level of protection essentially equivalent to that guaranteed within the EU. The pattern across the big decisions is consistent: no lawful basis, unclear notices, data kept too long, and transfers without safeguards. ## Ireland Data Protection Commission Fines - The Irish DPC accounted for **56.9%** of the €7.1 billion in GDPR fines DLA Piper recorded from May 25, 2018, to January 10, 2026. - The total value of GDPR fines imposed in Ireland stood at **€2.86 billion** in DLA Piper’s 2024 edition. - In DLA Piper’s seventh annual survey, Ireland had issued **€3.5 billion** in fines since May 2018, more than four times the **€746.38 million** issued by Luxembourg’s authority, which ranked second. - Ireland’s aggregate fines had stood at over **€1.0 billion** in DLA Piper’s January 2023 survey. IRISH DPC CUMULATIVE FINES · Source: DLA Piper GDPR Fines and Data Breach Surveys, January 2024 to January 2026 IRISH DPC CUMULATIVE FINES DLA · 2024 to 2026 Irish DPC Cumulative GDPR Fines (€ billions) 5 3.75 2.5 1.25 0 €2.86B January 2024 €3.5B January 2025 €4.04B January 2026 SOURCE DLA Piper GDPR Fines and Data Breach Surveys, January 2024 to January 2026 View the data| DLA Piper edition | Irish DPC cumulative fines (€ billions) | |---|---| | January 2024 | 2.86 | | January 2025 | 3.5 | | January 2026 | 4.04 | Ireland’s cumulative total reached **€4.04 billion** by the January 2026 survey. Many large tech firms base their EU operations in Dublin, so the DPC acts as lead authority in most of the cases that produce nine-figure fines. ## US State Privacy Laws - In 2018, the California Consumer Privacy Act became the first comprehensive US state privacy law to pass. - No other state passed one until 2021, when Virginia and Colorado enacted laws. - Seven bills became law in 2023, including Texas and Oregon, and seven more in 2024, including New Jersey and Maryland. - **19** states have passed comprehensive privacy laws to date, and no new states added comprehensive data privacy laws in 2025, according to the IAPP report covering laws enacted to July 2025. COMPREHENSIVE STATE PRIVACY LAWS ENACTED · Source: IAPP US State Comprehensive Privacy Laws Report 2025 COMPREHENSIVE STATE PRIVACY LAWS ENACTED IAPP · 2025 US State Privacy Laws Enacted by Year (laws) 8 6 4 2 0 1 2018 2 2021 2 2022 7 2023 7 2024 0 2025 (to July) SOURCE IAPP US State Comprehensive Privacy Laws Report 2025 View the data| Year | Comprehensive state privacy laws enacted | |---|---| | 2018 | 1 | | 2021 | 2 | | 2022 | 2 | | 2023 | 7 | | 2024 | 7 | | 2025 (to July) | 0 | ### How many US states have privacy laws? The IAPP counted **19** states that had passed comprehensive privacy laws as of July 2025, with **7** enacted in both 2023 and 2024. There is still no federal equivalent, so a company serving every state works through a patchwork of rights and thresholds. ## California Privacy Enforcement - General Motors agreed to **$12.75 million** in civil penalties over the sale of hundreds of thousands of Californians’ location and driving data to two data brokers. - The settlement, announced May 8, 2026, is the largest CCPA penalty in California history to date and the first data minimization case. - Tractor Supply agreed to pay **$1,350,000**, the largest fine in the California Privacy Protection Agency (CPPA) history when it was issued. - The GM penalty is **9.4** times the Tractor Supply fine. | Case | Enforcer | Penalty ($) | |---|---|---| | General Motors | Attorney General and four district attorneys | 12,750,000 | | Tractor Supply | California Privacy Protection Agency Board | 1,350,000 | | LocateSmarter LLC | California Privacy Protection Agency Board | 116,490 | *Source: California Privacy Protection Agency, California Attorney General, 2025 to 2026* The agency has brought more than a dozen enforcement actions against data brokers. Under the CCPA as written until January 1, 2027, data a business obtained from third parties can be retained and [exposed to breach](/data-breach-statistics/) or misuse even after a deletion request. Next to the GDPR cases above, California’s largest CCPA penalty is still a fraction of a single nine-figure European fine. ## Data Broker Deletion Requests - More than **500,000** Californians had registered for DROP by August 25, 2026, [state privacy agency figures](https://privacy.ca.gov/2026/08/half-a-million-californians-have-signed-up-for-drop-to-delete-their-personal-information-from-data-brokers/) show. - Signing up is a one-time process that generally takes less than **10** minutes. - Since the August 1, 2026, deadline for brokers to begin processing requests, approximately **25%** have reported processing deletion requests. - Data brokers have already reported deletion of tens of millions of records. | DROP measure | Value | |---|---| | Californians registered | More than 500,000 | | Data brokers in the system | 654 | | Brokers reporting processed deletions | Approximately 25% | | Registrants with a profile deleted by at least one broker | 99.9% | | Brokers that removed the typical user’s information | Over 40 | *Source: California Privacy Protection Agency, August 2026* > **Key finding:** **99.9%** of consumers have already had their profile deleted by at least one broker, and the typical California DROP user has had their information removed by over **40** brokers. Before DROP, each of those requests meant contacting brokers one by one. ## US Consumer Data Privacy Statistics - The share of Americans worried about government use of people’s data increased from **64%** in 2019 to **71%** in Pew Research Center’s 2023 survey. - Concern among Republicans rose from **63%** to **77%**, while Democrats’ concern held steady. - Some **67%** say they understand little to nothing about what companies are doing with their personal data, up from **59%**. - The survey was conducted among **5,101** US adults from May 15 to 21, 2023. SHARE OF US ADULTS · Source: Pew Research Center, How Americans View Data Privacy (October 2023) SHARE OF US ADULTS Pew Research Center · 2023 US Adults’ Data Privacy Concerns, 2023 (%) Little or no control over government data use 79% Little or no trust in social media leaders 77% Little or no control over company data use 73% Worried about government use of data 71% Understand little about company data use 67% 0 16 32 48 64 80 SOURCE Pew Research Center, How Americans View Data Privacy (October 2023) View the data| Concern | Share of US adults (%) | |---|---| | Little or no control over government data use | 79 | | Little or no trust in social media leaders | 77 | | Little or no control over company data use | 73 | | Worried about government use of data | 71 | | Understand little about company data use | 67 | Vast majorities feel they have little to no control over data collected by companies (**73%**) and the government (**79%**). Some **77%** of Americans have little or no trust in leaders of [social media](/social-media-statistics/) companies to publicly admit mistakes and take responsibility for data misuse. ## Privacy Policies and Consent - **56%** of Americans frequently click “agree” without actually reading privacy policies. - Some **72%** of Americans say there should be more regulation than there is now, and just **7%** say there should be less. - Most Americans (**78%**) trust themselves to make the right decisions about their personal information. - Support for more regulation crosses party lines, with **78%** of Democrats and **68%** of Republicans taking this stance. SHARE OF US ADULTS · Source: Pew Research Center, How Americans View Data Privacy (October 2023) SHARE OF US ADULTS Pew Research Center · 2023 How US Adults Handle Privacy Policies, 2023 (%) Trust themselves to decide about their data 78% See privacy policies as something to get past 69% Think policies fail to explain data use 61% Frequently click agree without reading 56% 0 16 32 48 64 80 SOURCE Pew Research Center, How Americans View Data Privacy (October 2023) View the data| Attitude | Share of US adults (%) | |---|---| | Trust themselves to decide about their data | 78 | | See privacy policies as something to get past | 69 | | Think policies fail to explain data use | 61 | | Frequently click agree without reading | 56 | Some **61%** think privacy policies are ineffective at explaining how companies use people’s data, and **69%** view these policies as just something to get past. ## Consumer Trust and Privacy Law Awareness - For the first time since the study began in 2019, a majority of consumers (**53%**) said they were aware of their country’s privacy laws, according to Cisco’s 2024 Consumer Privacy Survey. - Among those aware, **81%** feel confident in their ability to protect their data, compared to just **44%** of those unaware of such laws. - The survey covered over **2,600** consumers in **12** countries. | Consumer view (Cisco 2024) | Share of consumers (%) | |---|---| | Will not buy from organizations they don’t trust with their data | 75 | | Aware of their country’s privacy laws | 53 | | Say AI can be useful in improving lives | 63 | | Say organizations must use AI only in an ethical manner | 78 | *Source: Cisco 2024 Consumer Privacy Survey* **75%** of consumers say they will not purchase from organizations they don’t trust with their data. That puts [online privacy](/online-privacy-statistics/) inside the buying decision, not only inside the compliance budget. ## AI and Data Privacy - In Pew’s survey, among those who’ve heard about AI, **70%** have little to no trust in companies to make responsible decisions about how they use it in their products. - **81%** of those familiar with AI say its use by companies will lead to personal information being used in ways they won’t be comfortable with. - **64%** of respondents in Cisco’s 2025 study worry about inadvertently sharing sensitive information publicly or with competitors, yet nearly half admit to inputting personal employee or non-public data into [generative AI](/generative-ai-statistics/) tools. - **99%** of respondents anticipate reallocating resources from privacy budgets to AI initiatives in the future. SHARE · Source: Pew Research Center, How Americans View Data Privacy (October 2023) SHARE Pew Research Center · 2023 US Views on AI and Personal Data, 2023 (%) Expect uses they won’t be comfortable with 81% Expect uses that weren’t originally intended 80% Little or no trust in companies’ AI decisions 70% Expect AI use to make life easier 62% 0 20 40 60 80 100 SOURCE Pew Research Center, How Americans View Data Privacy (October 2023) View the data| View among Americans who have heard of AI | Share (%) | |---|---| | Expect uses they won't be comfortable with | 81 | | Expect uses that weren't originally intended | 80 | | Little or no trust in companies' AI decisions | 70 | | Expect AI use to make life easier | 62 | > **Worth noting:** **62%** of Americans who have heard of AI think that as companies use it, people’s information will be used to make life easier. Unease about AI and expected benefit sit side by side in the same respondents, so the AI numbers read as conditional consent rather than outright rejection. ## Children’s Online Privacy - Some **89%** of Americans are very or somewhat concerned about social media platforms knowing personal information about kids. - Large shares also worry about advertisers and online games or gaming apps using kids’ data. - **85%** say parents hold a great deal of responsibility for protecting kids’ online privacy. SAY IT HOLDS A GREAT DEAL · Say it holds a great deal of responsibility · Source: Pew Research Center, How Americans View Data Privacy (October 2023) SAY IT HOLDS A GREAT DEAL Pew Research Center · 2023 Who Should Protect Kids’ Privacy, US 2023 (%) Say it holds a great deal of responsibility Parents 85% Tech companies 59% Government 46% 0 20 40 60 80 100 SOURCE Pew Research Center, How Americans View Data Privacy (October 2023) View the data| Responsible party | Say it holds a great deal of responsibility (%) | |---|---| | Parents | 85 | | Tech companies | 59 | | Government | 46 | Fewer say the same about tech companies (**59%**) and the government (**46%**). That gap leaves parents carrying the job most Americans also expect platforms to share. ## Business Privacy Programs - **90%** of organizations in Cisco’s 2026 Data and Privacy Benchmark Study report their privacy programs have expanded due to AI. - **93%** plan to allocate more resources into privacy and data governance over the next two years. - Only **12%** describe existing governance committees as mature and proactive. - In Cisco’s 2025 study, **86%** of respondents supported privacy legislation and **96%** said privacy investments provide returns exceeding costs. - The 2026 study surveyed over **5,200** professionals with data privacy responsibilities in **12** markets. SHARE OF RESPONDENTS · Source: Cisco 2026 Data and Privacy Benchmark Study SHARE OF RESPONDENTS Cisco · 2026 Corporate Privacy Programs, Cisco 2026 (%) Plan more privacy and governance resources 93% Privacy programs expanded due to AI 90% Clear data-use communication builds most trust 46% Increased privacy spending in the past year 43% Lack a dedicated AI governance committee 23% Call their governance committees mature 12% 0 20 40 60 80 100 SOURCE Cisco 2026 Data and Privacy Benchmark Study View the data| Measure | Share of respondents (%) | |---|---| | Plan more privacy and governance resources | 93 | | Privacy programs expanded due to AI | 90 | | Clear data-use communication builds most trust | 46 | | Increased privacy spending in the past year | 43 | | Lack a dedicated AI governance committee | 23 | | Call their governance committees mature | 12 | **43%** increased privacy spending in the past year, and **46%** identify clear communication about data use as the most effective action to build customer confidence. **90%** of organizations in the 2025 study saw local storage as inherently safer, while **91%** trusted global providers for better data protection. ## Is GDPR still a thing? Yes. European regulators issued approximately **€1.2 billion** in GDPR fines in 2025, and the Irish DPC added a **€403 million** fine against Google in September 2026. The EDPB is also [consulting on draft fining guidance](https://www.edpb.europa.eu/public-consultations/guidelines-042026-on-the-application-of-the-power-to-impose-administrative_en): Guidelines 04/2026 on the application of the power to impose administrative fines, with feedback open until November 13, 2026. Enforcement has settled into a steady pattern rather than fading away. ## Conclusion GDPR fines held at approximately **€1.2 billion** in 2025, taking the total from May 2018 to January 2026 to **€7.1 billion**, while some **72%** of US adults want more regulation of company data use. Europe keeps fining a small number of large platforms, the US relies on a patchwork of 19 state laws, and consumers keep saying they care while skipping the fine print. California’s stronger right to delete takes effect January 1, 2027, and the EDPB’s Guidelines 04/2026 are open for feedback until November 13, 2026. California’s change targets a right that existed on paper but was hard to use; the EDPB guidance concerns how regulators pair fines with other corrective powers.