Data Privacy Statistics 2026: GDPR Fines, Laws and Consumer Attitudes

European supervisory authorities issued fines totalling approximately €1.2 billion in 2025 under the General Data Protection Regulation (GDPR), according to DLA Piper. That broadly matched 2024’s figure. The aggregate total from May 25, 2018, to January 10, 2026, stands at €7.1 billion, and Ireland’s Data Protection Commission (DPC) accounts for €4.04 billion of it. These data privacy statistics start with that enforcement record, then cover privacy laws, deletion tools and attitudes.

Survey data from the US leans the same way. Some 72% of Americans say there should be more regulation of what companies can do with people’s data than there is now, yet 56% frequently click “agree” without actually reading privacy policies. The Pew figures come from a May 2023 survey, so they are older than the enforcement data.

Key Takeaways

• Ireland’s DPC accounts for 56.9% of the €7.1 billion in GDPR fines issued from May 2018 to January 10, 2026, so one regulator sets most of the total.
• GDPR fines fell 33% in the year from January 28, 2024, to €1.2 billion, and 2025 broadly matched that figure at approximately €1.2 billion.
• Some 72% of US adults want more regulation of company data use, while 56% frequently click “agree” without reading privacy policies, according to Pew Research Center.
• More than 500,000 Californians registered for the Delete Request and Opt-out Platform (DROP) by August 25, 2026, a one-time sign-up for deletion requests to data brokers.
• 90% of organizations report their privacy programs have expanded due to AI, while 23% still lack a dedicated AI governance committee, according to Cisco’s 2026 study.
• 19 US states had passed comprehensive privacy laws as of the International Association of Privacy Professionals (IAPP) 2025 report.

Editor’s Choice

• GDPR fines issued in 2025: approximately €1.2 billion.
• Total GDPR fines, May 25, 2018, to January 10, 2026: €7.1 billion.
• Largest GDPR fine ever, against Meta in 2023: €1.2 billion.
• US adults who feel little or no control over government use of their data, 2023: 79%.
• Largest California Consumer Privacy Act (CCPA) penalty to date: General Motors, May 8, 2026, $12.75 million.
• Consumers who will not buy from organizations they don’t trust with their data, 2024: 75%.

GDPR Fines Statistics

• European supervisory authorities issued fines totalling approximately €1.2 billion in 2025, according to DLA Piper’s January 2026 survey.
• The aggregate total since May 25, 2018, to January 10, 2026, stands at €7.1 billion across all the jurisdictions surveyed.
• The highest fine in 2025 was a €530 million penalty issued by the Irish DPC in April 2025 for breaching the GDPR’s international data transfer restrictions.
• The 2025 total marks a reversal of the previous year’s downward trend, with no year-on-year increase.

Source: DLA Piper GDPR Fines and Data Breach Surveys, January 2025 and January 2026

About This Data

• Sources: 21 published pages, 11 of them regulator and government releases (Ireland’s DPC, France’s Commission Nationale de l’Informatique et des Libertés (CNIL), the European Data Protection Board and California’s privacy agency and attorney general).
• Also cited: 9 survey and research reports from DLA Piper, Cisco, Pew Research Center and the IAPP, plus one news report.
• Publication window: January 2023 to September 2026.
• Selection: regulator decisions, regulator-reported fine totals and surveys that publish their own method; breach counts and breach costs are left out.
• Updates: reviewed on a rolling basis, with figures updated when sources publish new editions.

GDPR Fines by Year

• Supervisory authorities across Europe issued €1.64 billion in fines in the year from January 28, 2022, a year-on-year increase of 50%.
• Fines reached €1.78 billion in the year from January 28, 2023.
• The 2024 survey year brought a 33% decrease, bucking the 7-year trend of increasing enforcement.
• On average, fines referred to the European Data Protection Board (EDPB) during 2022 for a ruling were increased by 630%.

Why it matters: DLA Piper’s seventh annual survey put total fines since 2018 at €5.88 billion, and €7.1 billion by January 10, 2026. Annual totals swing with a handful of large decisions, so a flat year says more about the size of the biggest cases than about how many companies regulators pursue.

Recent Developments

• August 11, 2026: The California Privacy Protection Agency Board required LocateSmarter LLC, an Iowa data broker, to pay $116,490, its first decision against a data broker under the CCPA.
• August 25, 2026: More than 500,000 Californians had registered for DROP since it launched on January 1.
• September 21, 2026: The DPC imposed administrative fines totalling €403 million on Google and ordered it to bring its processing into compliance within 6 months.
• September 21, 2026: The EDPB put Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR open for feedback until November 13, 2026.
• September 27, 2026: Governor Newsom signed the Expanding Privacy Rights Act, closing a loophole in the CCPA’s right to delete; the law takes effect January 1, 2027.

Major European Privacy Fines

• The largest fine ever imposed under the GDPR remains the €1.2 billion penalty the Irish DPC issued against Meta Platforms Ireland Limited in 2023.
• The DPC’s decision against the TikTok video platform includes administrative fines totalling €530 million and an order suspending TikTok’s transfers to China if processing is not brought into compliance within 6 months.
• Google’s €403 million fine covers location data in Web & App Activity, Location History and Location Accuracy between May 25, 2018, and February 4, 2020.
• France’s data protection authority the CNIL fined Google 325 million euros on September 1, 2025, for showing ads between Gmail users’ emails without consent and for placing cookies at account creation without valid consent.
• The CNIL fined SHEIN’s Irish subsidiary 150 million euros on September 1, 2025, over cookies placed on the devices of users visiting shein.com.

LinkedIn’s €310 million fine, notified on October 22, 2024, also included a reprimand and an order to bring its processing into compliance. The Meta group were on the receiving end of some of the very largest fines in DLA Piper’s 2023 survey, for Facebook and Instagram profiling practices.

What can you not do under GDPR?

The DPC found Google infringed the GDPR on the lawfulness and fairness of its location data processing, on transparency and on how long it kept that data. TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee and demonstrate that the data was afforded a level of protection essentially equivalent to that guaranteed within the EU. The pattern across the big decisions is consistent: no lawful basis, unclear notices, data kept too long, and transfers without safeguards.

Ireland Data Protection Commission Fines

• The Irish DPC accounted for 56.9% of the €7.1 billion in GDPR fines DLA Piper recorded from May 25, 2018, to January 10, 2026.
• The total value of GDPR fines imposed in Ireland stood at €2.86 billion in DLA Piper’s 2024 edition.
• In DLA Piper’s seventh annual survey, Ireland had issued €3.5 billion in fines since May 2018, more than four times the €746.38 million issued by Luxembourg’s authority, which ranked second.
• Ireland’s aggregate fines had stood at over €1.0 billion in DLA Piper’s January 2023 survey.

Ireland’s cumulative total reached €4.04 billion by the January 2026 survey. Many large tech firms base their EU operations in Dublin, so the DPC acts as lead authority in most of the cases that produce nine-figure fines.

US State Privacy Laws

• In 2018, the California Consumer Privacy Act became the first comprehensive US state privacy law to pass.
• No other state passed one until 2021, when Virginia and Colorado enacted laws.
• Seven bills became law in 2023, including Texas and Oregon, and seven more in 2024, including New Jersey and Maryland.
• 19 states have passed comprehensive privacy laws to date, and no new states added comprehensive data privacy laws in 2025, according to the IAPP report covering laws enacted to July 2025.

How many US states have privacy laws?

The IAPP counted 19 states that had passed comprehensive privacy laws as of July 2025, with 7 enacted in both 2023 and 2024. There is still no federal equivalent, so a company serving every state works through a patchwork of rights and thresholds.

California Privacy Enforcement

• General Motors agreed to $12.75 million in civil penalties over the sale of hundreds of thousands of Californians’ location and driving data to two data brokers.
• The settlement, announced May 8, 2026, is the largest CCPA penalty in California history to date and the first data minimization case.
• Tractor Supply agreed to pay $1,350,000, the largest fine in the California Privacy Protection Agency (CPPA) history when it was issued.
• The GM penalty is 9.4 times the Tractor Supply fine.

Source: California Privacy Protection Agency, California Attorney General, 2025 to 2026

The agency has brought more than a dozen enforcement actions against data brokers. Under the CCPA as written until January 1, 2027, data a business obtained from third parties can be retained and exposed to breach or misuse even after a deletion request. Next to the GDPR cases above, California’s largest CCPA penalty is still a fraction of a single nine-figure European fine.

Data Broker Deletion Requests

• More than 500,000 Californians had registered for DROP by August 25, 2026, state privacy agency figures show.
• Signing up is a one-time process that generally takes less than 10 minutes.
• Since the August 1, 2026, deadline for brokers to begin processing requests, approximately 25% have reported processing deletion requests.
• Data brokers have already reported deletion of tens of millions of records.

Source: California Privacy Protection Agency, August 2026

Key finding: 99.9% of consumers have already had their profile deleted by at least one broker, and the typical California DROP user has had their information removed by over 40 brokers. Before DROP, each of those requests meant contacting brokers one by one.

US Consumer Data Privacy Statistics

• The share of Americans worried about government use of people’s data increased from 64% in 2019 to 71% in Pew Research Center’s 2023 survey.
• Concern among Republicans rose from 63% to 77%, while Democrats’ concern held steady.
• Some 67% say they understand little to nothing about what companies are doing with their personal data, up from 59%.
• The survey was conducted among 5,101 US adults from May 15 to 21, 2023.

Vast majorities feel they have little to no control over data collected by companies (73%) and the government (79%). Some 77% of Americans have little or no trust in leaders of social media companies to publicly admit mistakes and take responsibility for data misuse.

Privacy Policies and Consent

• 56% of Americans frequently click “agree” without actually reading privacy policies.
• Some 72% of Americans say there should be more regulation than there is now, and just 7% say there should be less.
• Most Americans (78%) trust themselves to make the right decisions about their personal information.
• Support for more regulation crosses party lines, with 78% of Democrats and 68% of Republicans taking this stance.

Some 61% think privacy policies are ineffective at explaining how companies use people’s data, and 69% view these policies as just something to get past.

Consumer Trust and Privacy Law Awareness

• For the first time since the study began in 2019, a majority of consumers (53%) said they were aware of their country’s privacy laws, according to Cisco’s 2024 Consumer Privacy Survey.
• Among those aware, 81% feel confident in their ability to protect their data, compared to just 44% of those unaware of such laws.
• The survey covered over 2,600 consumers in 12 countries.

Source: Cisco 2024 Consumer Privacy Survey

75% of consumers say they will not purchase from organizations they don’t trust with their data. That puts online privacy inside the buying decision, not only inside the compliance budget.

AI and Data Privacy

• In Pew’s survey, among those who’ve heard about AI, 70% have little to no trust in companies to make responsible decisions about how they use it in their products.
• 81% of those familiar with AI say its use by companies will lead to personal information being used in ways they won’t be comfortable with.
• 64% of respondents in Cisco’s 2025 study worry about inadvertently sharing sensitive information publicly or with competitors, yet nearly half admit to inputting personal employee or non-public data into generative AI tools.
• 99% of respondents anticipate reallocating resources from privacy budgets to AI initiatives in the future.

Worth noting: 62% of Americans who have heard of AI think that as companies use it, people’s information will be used to make life easier. Unease about AI and expected benefit sit side by side in the same respondents, so the AI numbers read as conditional consent rather than outright rejection.

Children’s Online Privacy

• Some 89% of Americans are very or somewhat concerned about social media platforms knowing personal information about kids.
• Large shares also worry about advertisers and online games or gaming apps using kids’ data.
• 85% say parents hold a great deal of responsibility for protecting kids’ online privacy.

Fewer say the same about tech companies (59%) and the government (46%). That gap leaves parents carrying the job most Americans also expect platforms to share.

Business Privacy Programs

• 90% of organizations in Cisco’s 2026 Data and Privacy Benchmark Study report their privacy programs have expanded due to AI.
• 93% plan to allocate more resources into privacy and data governance over the next two years.
• Only 12% describe existing governance committees as mature and proactive.
• In Cisco’s 2025 study, 86% of respondents supported privacy legislation and 96% said privacy investments provide returns exceeding costs.
• The 2026 study surveyed over 5,200 professionals with data privacy responsibilities in 12 markets.

43% increased privacy spending in the past year, and 46% identify clear communication about data use as the most effective action to build customer confidence. 90% of organizations in the 2025 study saw local storage as inherently safer, while 91% trusted global providers for better data protection.

Is GDPR still a thing?

Yes. European regulators issued approximately €1.2 billion in GDPR fines in 2025, and the Irish DPC added a €403 million fine against Google in September 2026.

The EDPB is also consulting on draft fining guidance: Guidelines 04/2026 on the application of the power to impose administrative fines, with feedback open until November 13, 2026. Enforcement has settled into a steady pattern rather than fading away.

Conclusion

GDPR fines held at approximately €1.2 billion in 2025, taking the total from May 2018 to January 2026 to €7.1 billion, while some 72% of US adults want more regulation of company data use. Europe keeps fining a small number of large platforms, the US relies on a patchwork of 19 state laws, and consumers keep saying they care while skipping the fine print.

California’s stronger right to delete takes effect January 1, 2027, and the EDPB’s Guidelines 04/2026 are open for feedback until November 13, 2026. California’s change targets a right that existed on paper but was hard to use; the EDPB guidance concerns how regulators pair fines with other corrective powers.