The EU seems to live in a world all on its own. They can’t fine enough to actually change the behavior of big companies, but they can fine enough to kill their own startup culture.
I don’t feel bad for them anymore. Their voters seem to be fine with this status quo. And I get why other countries see these fines as trying to raise taxes by other means because it hasn’t and won’t change anything.
> They can’t fine enough to actually change the behavior of big companies
Of course they can fine enough. They just don't, which is why you see companies get fined again and again profiting from each violation.
The real issue is that fines are hard to set against companies with more money than they could ever need. What we need is for more CEOs to go to prison, but that's hard to do when the company's CEO is a citizen of another country.
There was a lot of noise a few years back about Meta getting billion-euro fines over GDPR violations.
I looked it up: they paid almost none of the fines.
If you get a ticket from a speed camera, the government will garnish your wages if you don’t pay the fine. For trillion dollar organisations payment is apparently optional.
They just need to ban these companies from operating in their countries. They are fundamentally burdens on society run by bad people.
Your best case scenario with fines is getting them into the narrow definition of compliance just until a new "innovation" gives them a different way to conduct the same abuse while evading the letter of previous judgments.
This is a judgement from the DPC in Ireland, which has a history of reluctance [0] when it comes to enforcing the GDPR on US corporations, e.g. in [1] they even had to be ordered by a court to start investigating. I don't see the Irish DPC voluntarily choosing to take on more oversight here.
Oh no, a pop-up! Tragically in 2026 much like people lacking data protections, it's impossible to block those in any way shape or form. No such means exist.
I'm truly sorry. I think we can all agree that your mild and self-inflicted inconvenience is well worth the GDPR being scrapped. Working for something like a modicum of boundaries from rapacious data hogs, who feed into ad-tech and AI systems, is clearly worthless when balanced against some pop-ups.
Seriously are people still making that joke? Is that the best gotcha possible for a serious issue? These fines are proof that despite the law changing these companies still flaunt it... maybe that should concern you more even if your own data is trivial to you.
The EU seems to live in a world all on its own. They can’t fine enough to actually change the behavior of big companies, but they can fine enough to kill their own startup culture.
I don’t feel bad for them anymore. Their voters seem to be fine with this status quo. And I get why other countries see these fines as trying to raise taxes by other means because it hasn’t and won’t change anything.
> They can’t fine enough to actually change the behavior of big companies
Of course they can fine enough. They just don't, which is why you see companies get fined again and again profiting from each violation.
The real issue is that fines are hard to set against companies with more money than they could ever need. What we need is for more CEOs to go to prison, but that's hard to do when the company's CEO is a citizen of another country.
Exactly
Do they only fine American companies in Europe?
No. For example:
https://www.enforcementtracker.com/ETid-3171 Yangoo. UAE.
https://www.enforcementtracker.com/ETid-1912 Criteo. French.
https://www.enforcementtracker.com/ETid-3162 Intesa Sanpaolo. Italian.
https://www.enforcementtracker.com/ETid-2864 Shein. Chinese.
https://www.enforcementtracker.com/ETid-2306 Enel Energia. Italian.
American companies fines tend to be highest since they are biggest and revenue affects the fine amount.
Depends. Do you go and read European news about such cases, or just check HN when they post about a FAANG EU fine?
No, they also fine American companies in China and in Australia.
for perspective, €403M = ~30 hours of net income, or ~10 hours of revenue (based on 2025 numbers, current exchange rates).
There was a lot of noise a few years back about Meta getting billion-euro fines over GDPR violations.
I looked it up: they paid almost none of the fines.
If you get a ticket from a speed camera, the government will garnish your wages if you don’t pay the fine. For trillion dollar organisations payment is apparently optional.
> they paid almost none of the fines.
Source?
https://dataprotection.ie/en/dpc-guidance/decisions/fines
So far they’ve paid something like €20 million out of €4.0 billion in GDPR fines.
Most of the fines (and all of the big ones) are simply "pending appeal".
The justice system is slow, that's why the fines are slow to be collected, that's all.
As if they'd end up paying?
They need to multiply by 100 to move that fine out of “cost of doing business” range.
They just need to ban these companies from operating in their countries. They are fundamentally burdens on society run by bad people.
Your best case scenario with fines is getting them into the narrow definition of compliance just until a new "innovation" gives them a different way to conduct the same abuse while evading the letter of previous judgments.
there might be an oversight component of the settlement that is not prominent in the press releases
This is a judgement from the DPC in Ireland, which has a history of reluctance [0] when it comes to enforcing the GDPR on US corporations, e.g. in [1] they even had to be ordered by a court to start investigating. I don't see the Irish DPC voluntarily choosing to take on more oversight here.
[0] https://arstechnica.com/tech-policy/2021/09/ireland-fails-to...
[1] https://cooltechzone.com/news/court-irish-dpa-must-investiga...
Oh geez, GDPR again. Does this mean I'll have to close out a popup every time I open Google Maps or do a search?
If you're not doing so already then you seem to have already agreed to let Google do quite a lot of things with your data.
Oh no, a pop-up! Tragically in 2026 much like people lacking data protections, it's impossible to block those in any way shape or form. No such means exist.
I'm truly sorry. I think we can all agree that your mild and self-inflicted inconvenience is well worth the GDPR being scrapped. Working for something like a modicum of boundaries from rapacious data hogs, who feed into ad-tech and AI systems, is clearly worthless when balanced against some pop-ups.
Seriously are people still making that joke? Is that the best gotcha possible for a serious issue? These fines are proof that despite the law changing these companies still flaunt it... maybe that should concern you more even if your own data is trivial to you.
It's a slap on the wrist, with a feather