GDPR Enforcement in 2026: Major Fines, Trends, and What They Signal

GDPR enforcement has moved through distinct phases since the regulation came into force in May 2018. The first two years were procedural — DPAs building investigation capacity, establishing processes, handling notification backlogs. From 2021 onward, large fines began to accumulate. By 2025, cumulative GDPR fines exceeded €4 billion.

This post surveys the enforcement landscape as of early 2026: what categories of violations are attracting the largest penalties, which DPAs are most active, and what the patterns suggest for compliance priorities.

The Enforcement Structure

GDPR enforcement is decentralized. Each EU member state has a supervisory authority (DPA) with independent enforcement powers. The Irish DPA (DPC) has jurisdiction over most large technology companies due to the EU headquarters concentration in Ireland. The Luxembourgish CNPD covers Amazon and PayPal. The German federal and state authorities handle the considerable volume of German-originating cases.

The consistency mechanism — under which DPAs with cross-border relevance must coordinate — has been a source of ongoing tension. The EDPB has repeatedly had to compel the Irish DPC to act, leading to some of the largest fines ever issued (Meta €1.2 billion, 2023).

Major Enforcement Actions 2025–2026

Data Transfers

Post-Schrems II, transfers of personal data to the US without adequate safeguards remain an active enforcement category. The EDPB's transfer toolbox (Standard Contractual Clauses + Transfer Impact Assessments) provides a compliance path, but implementation is uneven. Several enforcement actions in 2024–2025 targeted organizations using US cloud services without adequate TIAs or SCCs.

With the Data Privacy Framework in place since 2023, certified US companies have a workable transfer basis — but the framework remains politically fragile. Privacy Shield (2016–2020) and Privacy Shield II (2020–2023) were both invalidated by CJEU rulings. Organizations relying on the DPF should maintain parallel SCC documentation.

Special Category Data

Health data, biometric data, genetic data, and data revealing political opinions or religious beliefs face additional protection under Article 9. Enforcement actions involving health data breaches, biometric workplace monitoring systems, and unauthorized political profiling have been among the most penalized.

Biometric data has attracted particular attention. Facial recognition systems used without explicit consent — in workplaces, at events, by law enforcement — have generated enforcement actions across multiple member states.

Cookie Consent Violations

The CNIL (France) and Belgian DPA have been the most active on cookie consent violations, issuing fines against major platforms for dark patterns in consent UIs. The requirements — freely given, specific, informed, unambiguous consent — have been interpreted strictly: "accept all" buttons larger than "reject all," pre-ticked boxes, and "legitimate interest" claims for advertising all attract enforcement attention.

The IAB Europe TCF (Transparency and Consent Framework) has been subject to ongoing enforcement. The Belgian DPA's 2022 finding that the TCF violates GDPR was upheld on appeal, forcing substantial modifications to how the framework operates.

AI and Automated Decision-Making

ChatGPT, image generators, and other AI tools are under active investigation by multiple DPAs. The Italian DPA's temporary ban on ChatGPT in March 2023 (later lifted after OpenAI made modifications) established that generative AI tools are subject to full GDPR scrutiny.

Key concerns in AI enforcement:
• Legal basis for training data: Was personal data in training sets processed lawfully?
• Data subject rights: Can individuals whose data appeared in training sets exercise access, erasure, or rectification rights?
• Automated decision-making: Where AI outputs affect individuals, do Articles 21–22 apply?
• Transparency: Are individuals informed that AI was used in decisions affecting them?

The EDPB AI task force has been examining these questions across multiple investigations. Enforcement decisions are expected to clarify the legal basis question in particular — critical for the EU AI Act compliance timeline.

DPA Activity Patterns

Irish DPC: After years of criticism for slow processing of cross-border cases, the DPC has issued several landmark fines under EDPB pressure. The €1.2 billion Meta fine (2023), the €1.3 billion Meta fine for US data transfers (same action), and various other Meta/Google decisions have established Ireland as a significant enforcement forum despite the political tensions involved.

CNIL (France): Consistently active, particularly on cookie consent and tracking. The CNIL's fines against Google (€150M), Facebook (€60M), and various others for cookie consent violations set important precedents on what consent mechanisms are acceptable.

Italian Garante: Proactive on AI and behavioral advertising. The ChatGPT action demonstrated willingness to take immediate action on novel technology. Active enforcement against location data brokers.

German DPAs (federal + state): Germany's federated DPA structure means 17 separate authorities. The Bavarian DPA and Berlin DSB have been particularly active on technical violations. The federal BfDI handles federal authority data processing.

Spanish AEPD: One of the highest fine-count DPAs. Active across a range of violations including employment data, CCTV, and marketing.

What the Enforcement Pattern Signals

Several themes emerge from the 2024–2026 enforcement landscape:

1. Systemic Over Individual Incidents

The largest fines are not for individual breaches but for systemic violations — practices baked into business models that affect large numbers of individuals. Training personal data in AI models without adequate legal basis, systematic dark-pattern consent flows, and structural transfer violations are all "systemic" rather than accidental.

This means enforcement exposure is correlated with scale. Organizations processing large volumes of personal data in systematic ways face higher fine exposure than organizations with limited processing activities.

2. Legal Basis Is Everything

A disproportionate share of enforcement actions come down to legal basis — the organization could not demonstrate a valid Article 6 basis for the processing in question. Legitimate interests (Article 6(1)(f)) has been found insufficient for behavioral advertising, tracking, and training data. Consent as the legal basis fails when consent mechanisms do not meet the GDPR standard.

For AI training data specifically: legitimate interest is unlikely to survive scrutiny for large-scale scraping of publicly available personal data. Consent is impractical at training scale. This leaves organizations in a difficult position — which is precisely why the EU AI Act's Article 10 documentation obligations create pressure.

3. Data Subject Rights Compliance Is Improving But Still Fails

DSARs (Data Subject Access Requests) remain a common trigger for formal complaints. Organizations frequently respond late, provide incomplete responses, or refuse requests without adequate justification. The GDPR one-month response window is strictly enforced; extensions require documented justification.

Erasure requests (the "right to be forgotten") are particularly challenging for organizations using AI systems trained on personal data, where erasure from the model may be technically impossible.

4. Cross-Border Consistency Is Improving

The one-stop-shop mechanism was intended to create consistent enforcement for organizations with EU-wide activities. In practice, inconsistency between DPAs led to strategic forum shopping and delayed enforcement. Recent EDPB interventions have produced more consistent outcomes, though the mechanism remains imperfect.

Compliance Priorities for 2026

Given the enforcement trajectory, organizations should focus on:

The enforcement environment in 2026 is mature. DPAs have developed investigation capacity, EDPB has developed interpretive guidance on most major issues, and fine levels have moved beyond symbolic. GDPR compliance is now an operational requirement with material financial consequences.