Tracker
Enforcement tracker
Fines, settlements, court rulings, orders, investigations and complaints in data protection, privacy and AI regulation — who acted, against whom, how much and under which law. Each matter is followed as a case, from complaint or investigation to decision and appeal, and every step links to our coverage and its sources. Complaints and investigations are not findings.
13cases followed
11still open
4with a stated amount
| Latest | Authority | Against / concerning | Stage | Amount | Law |
|---|---|---|---|---|---|
| European CommissionEU | TikTok | InvestigationOpen | — | Digital Services ActEU digital rules | |
| IMY (Swedish Authority for Privacy Protection)Sweden | Legal Newsdesk Sweden AB (Lexbase) and Fuplex AB (Krimfup), ordered and reprimanded; Nusvar AB (MrKoll) and Upplysning Checknode AB (Upplysning), reprimanded | OrderOpen | — | GDPR Article 10 (criminal offence data) and Article 17 (right to erasure)GDPR | |
| Datatilsynet (Norway)Norway | Xandr (formerly AppNexus, now part of Microsoft) | FineClosed | NOK 92m | Norwegian data protection rules (GDPR); explicit consent for special-category dataGDPR | |
| US District Court for the District of ColumbiaUnited States | League of Women Voters, LULAC and EPIC v. US Department of Homeland Security and US Department of Justice | Court rulingOpen | — | Privacy Act of 1974 (5 U.S.C. § 552a); Administrative Procedure Act, 5 U.S.C. § 705US federal | |
| Oregon Department of Justice (stipulated judgment)Oregon, US | General Motors; OnStar2 steps
| Court rulingClosed | USD 220m | —US state | |
| US Federal Trade CommissionUS | Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target, Walmart | InvestigationOpen | — | FTC Act, Section 6(b) (study orders)US federal | |
| US Court of Appeals for the 4th CircuitWest Virginia, US | People-search firms incl. Thomson Reuters, Whitepages, Thryv, PeopleConnect, LexisNexis Risk Solutions (law held unconstitutional) | Court rulingOpen | — | W. Va. Code § 5A-8-24(e) (Daniel's Law)US state | |
| IMYSweden | Swedish Police Authority | OrderOpen | — | Camera Surveillance Act (information requirement)Other national law | |
| noyb and partners (complaints to DPAs in France, Italy, the Netherlands and Austria)EU (FR, IT, NL, AT) | Scale AI (Outlier platform) | ComplaintOpen | — | GDPR Articles 5(1)(c), 12(3), 15, 25(1), 28(1); French ePrivacy ruleGDPR | |
| CNILFrance | FNAC DARTY PARTICIPATIONS ET SERVICES; FNAC DIRECT | FineOpen | EUR 7m | Article 82 of the French Data Protection ActePrivacy and cookies | |
| New Mexico (jury verdict; state Department of Justice)New Mexico, US | Meta | Court rulingOpen | USD 25bn | New Mexico Unfair Practices ActUS state | |
| Berlin Commissioner for Data Protection and Freedom of InformationGermany | CDU; SPD; Bündnis 90/Die Grünen; DIE LINKE | ReprimandOpen | — | —GDPR | |
| European Commission (AI Office)EU | General-purpose AI model providers (not named officially) | InvestigationOpen | — | AI Act, Article 91 (requests for information)AI Act |
About this tracker
- Built from the stories we publish, so it covers what our sources report and our editor approves; it is not an exhaustive register of every decision.
- Amounts are as stated in the sources, in the original currency. Settlements and court awards may be appealed or paid in instalments; see each story's status.
- Complaints and investigations are claims or inquiries, not findings. Nothing in those rows has been decided.
- A case is open until it ends in a settlement or a decision the sources describe as final (for example, appeal waived); fines and rulings that can still be appealed stay open.
- Spotted a missing or wrong entry? Tell us. See also institutions and key dates.