---
title: "GDPR"
description: "Europe's data protection framework — what it has achieved, what it has not, and fines imposed that exceed €7 billion in total."
url: https://attentionmachine.org/en/laws/gdpr/
lang: en
updated: 2026-10-25
license: "CC BY-NC-SA 4.0 (https://creativecommons.org/licenses/by-nc-sa/4.0/)"
---

# GDPR

Europe has been trying to protect your data since 1995. It took until 2018 for the law to have teeth. The fines imposed now exceed €7 billion in total. Behavioural advertising is still the dominant business model.

## The long road

The EU's 1995 Data Protection Directive[^src-regulation-2016] established baseline privacy rights. By the 2010s it was outdated — Facebook, Google, and Amazon had built multi-billion-dollar businesses on behavioural data collection[^src-zuboff-2019] at a scale the Directive never anticipated. The GDPR was formally adopted in 2016 and became enforceable on 25 May 2018[^src-regulation-2016].

## What GDPR requires

Personal data may only be collected with a lawful basis — including genuine, informed consent. Individuals have the right to access, correct, and delete their data[^src-regulation-2016]. Data breaches must be reported within 72 hours[^src-gdpr-c]. Fines can reach 4% of global annual turnover[^src-gdpr-d]. The regulation applies to any organisation processing the data of people in the EU[^src-regulation-2016] — regardless of where the organisation is based.

> **Lawful basis / consent**
>
> Under the GDPR a company may not process your personal data just because it wants to; it needs one of six "lawful bases", the most discussed of which is your freely-given, informed, specific consent. "Freely given" is the catch: consent buried in a pre-ticked box or extracted by a manipulative banner is not valid consent in law — which is why so much enforcement turns on how the choice was designed, not whether a box was clicked.
>
> **Sources**
>
> - [GDPR Article 6 — lawfulness of processing](https://gdpr-info.eu/art-6-gdpr/).
> - [GDPR Recital 32 — conditions for consent](https://gdpr-info.eu/recitals/no-32/).
> - European Data Protection Board (2023), [_Report of the work undertaken by the Cookie Banner Taskforce_](https://www.edpb.europa.eu/system/files/documents/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf).

## The fines

2019: France fines Google €50 million[^src-conseil-detat-2020]. 2021: Luxembourg fines Amazon €746 million — a decision annulled on appeal in March 2026[^src-cour-administrative-2026]: the court confirmed the breaches but sent the case back to the regulator. 2023: Ireland fines Meta €1.2 billion[^src-data-protection-2023] — the largest GDPR fine on record — for unlawfully transferring EU user data to the United States. 2023: Ireland fines TikTok €345 million[^src-data-protection-2026] for children's data violations. 2024: Ireland fines LinkedIn €310 million[^src-data-protection-2026]. 2025: TikTok fined a further €530 million[^src-data-protection-2026]. The fines imposed under the GDPR[^src-gdpr] exceed €7 billion in total.

## What it has and has not achieved

GDPR established that data protection is a legal right with financial consequences. It created a global norm: its extraterritorial reach gave companies worldwide a reason to update their practices. What it has not done is end surveillance capitalism[^src-zuboff-2019]. Cookie consent banners, frequently designed as dark patterns to funnel users toward acceptance, provide nominal compliance. The behavioural surveillance model continues. Fines are large in absolute terms and small beside the companies they are imposed on: the record €1.2 billion fine on Meta came to about 1% of the group's revenue the year before[^src-data-protection-2023] — roughly four days of it — against a legal ceiling of 4%[^src-gdpr-d]. Most of the largest fines are still under appeal and unpaid[^src-data-protection-2026], and whether fines of this size change behaviour is contested: there is little evidence either way of their deterrent effect[^src-lintvedt-2022]. GDPR is the strongest privacy framework in the world and an insufficient response to the scale of the problem.

> **Dark patterns**
>
> Interface designs that steer you toward the choice the company prefers rather than the one you would freely make: the giant "Accept all" button next to a greyed-out, three-clicks-deep "Reject". They exploit defaults, friction, and visual hierarchy. Under the GDPR a consent obtained this way is arguably not freely given — but the banners remain near-universal because the cost of ignoring the rule is low relative to the value of the data.
>
> **Sources**
>
> - [EDPB Guidelines 03/2022 on deceptive design patterns](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032022-deceptive-design-patterns-social-media_en) (2022; version 2.0, adopted 14 February 2023).

**How we know — why €7 billion in fines imposed hasn't changed the model**

Three structural reasons. First, scale: a record €1.2 billion fine[^src-data-protection-2023] is real money, but it came to about 1% of Meta's revenue the year before, and it is still under appeal[^src-data-protection-2026]; how far fines of this size deter is contested, and there is little evidence either way[^src-lintvedt-2022]. Second, the enforcement bottleneck: under the GDPR's "one-stop-shop", the regulator of the country where a company has its EU headquarters leads — which routes most Big Tech cases through Ireland's DPC, criticised by other regulators[^src-european-data-2021] for slow, narrow enforcement[^src-federal-commissioner-2021]. Third, compliance theatre: a consent banner can be technically present and still designed to defeat the choice it nominally offers.

**The honest reading.** GDPR succeeded at establishing data protection as an enforceable right and a global norm; it has not succeeded at dismantling surveillance as a business model, because the model's economics survive the fines. That is an argument about enforcement and design, not about whether the law was worth passing.

## Sources

[^src-gdpr]: [GDPR Enforcement Tracker](https://www.enforcementtracker.com) — a live table of the fines imposed under the GDPR, cited for their running total: €7.57 billion when read on 17 October 2026.

[^src-gdpr-b]: [GDPR Article 6 — lawfulness of processing](https://gdpr-info.eu/art-6-gdpr/).

[^src-gdpr-c]: [GDPR Article 33 — notification of a personal data breach](https://gdpr-info.eu/art-33-gdpr/).

[^src-gdpr-d]: [GDPR Article 83 — general conditions for imposing administrative fines](https://gdpr-info.eu/art-83-gdpr/) — "up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher" (Art. 83(5)).

[^src-edpb-2022]: [EDPB Guidelines 03/2022 on deceptive design patterns](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032022-deceptive-design-patterns-social-media_en) (2022; version 2.0, adopted 14 February 2023).

[^src-edps]: [European Data Protection Supervisor (EDPS) — independent supervisor of the EU institutions' own data processing](https://www.edps.europa.eu/data-protection/our-work_en) (distinct from the EDPB, which coordinates GDPR enforcement across national authorities).

[^src-regulation-2016]: [_Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 … repealing Directive 95/46/EC (General Data Protection Regulation)_](https://eur-lex.europa.eu/eli/reg/2016/679/oj) — Article 99(2): it "shall apply from 25 May 2018"; Article 94 and footnote 4: Directive 95/46/EC "of 24 October 1995", repealed from the same date.

[^src-conseil-detat-2020]: Conseil d'État, [_Décision n° 430810 du 19 juin 2020, Google LLC_](https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2020-06-19/430810) — upholds the CNIL's €50 million fine on Google (deliberation SAN-2019-001 of 21 January 2019).

[^src-european-data-2021]: European Data Protection Board (28 July 2021), [_Binding decision 1/2021 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding WhatsApp Ireland under Article 65(1)(a) GDPR_](https://www.edpb.europa.eu/system/files/documents/2021-09/edpb_bindingdecision_202101_ie_sa_whatsapp_redacted_en.pdf) — other authorities' objections to "the limited scope of the investigation"; the Board "instructs the IE SA to set out a higher fine amount".

[^src-federal-commissioner-2021]: Federal Commissioner for Data Protection and Freedom of Information (Germany), Ulrich Kelber (16 March 2021), [letter to the European Parliament's LIBE committee on the Irish DPC](https://noyb.eu/sites/default/files/2021-03/Letter%20BfDI%20-%20LIBE%20on%20Irish%20DPC.pdf) (in German; copy published by noyb) — more than 50 WhatsApp complaints sent to the DPC since 2018, "von denen bis heute keine einzige abgeschlossen ist" (none of them closed).

[^src-zuboff-2019]: Zuboff, S. (2019), _The Age of Surveillance Capitalism_, PublicAffairs.

[^src-data-protection-2023]: [Data Protection Commission, final decision IN-20-8-1 on Meta Platforms Ireland (data transfers)](https://www.dataprotection.ie/sites/default/files/uploads/2023-06/12.05.2023%20Decision%20IN-20-8-1%20Meta%20Platform%20Ireland%20Limited%20%28Facebook%29%20data%20transfers.pdf) (12 May 2023) — the €1.2 billion fine, and Meta's 2022 revenue of $116.61 billion as the basis (§9.124); the share (about 1%) and the days (about four) are computed at the ECB reference rate of the decision date.

[^src-data-protection-2026]: [Data Protection Commission — fines](https://www.dataprotection.ie/en/dpc-guidance/decisions/fines) (updated 21 September 2026): over €4.4 billion in fines imposed, about €20 million collected; a fine under appeal cannot be collected.

[^src-lintvedt-2022]: Lintvedt, M. N. (2022), [_Putting a price on data protection infringement_](https://doi.org/10.1093/idpl/ipab024), International Data Privacy Law 12(1), 1–15 — "there is little evidence of the effect of mere imposition of fines".

[^src-cour-administrative-2026]: Cour administrative (Luxembourg), arrêt n° 52757C du rôle (12 March 2026), [_Arrêt de la Cour administrative en relation avec un des grands acteurs mondiaux au niveau du commerce en ligne_](https://justice.public.lu/fr/actualites/2026/03/arret-cour-administrative-amazon.html) (Justice Luxembourg, 13 March 2026) — the CNPD's decision of 15 July 2021 fining Amazon €746 million annulled in full; the breaches broadly confirmed; the case sent back to the CNPD to assess fault and choose the measure.

[Digital Services Act →](https://attentionmachine.org/en/laws/dsa/)

---

Some content on this site was created with the assistance of AI tools and may contain errors. [How we use AI →](https://attentionmachine.org/en/about/how-we-use-ai/)