How much do data protection authorities actually fine, once you account for the size of each country? We compared ten European countries on one ratio, euros of fines per resident, and looked at what sits behind the biggest figures.
We took the most recent documented decisions of ten European data protection authorities, up to 200 per country, and divided each country’s known fines by its population. The result is a single ratio per country: euros of fines per resident. It is not what residents pay, nor the risk of being fined, but it puts ten enforcement records of very different sizes on one scale. Three findings stand out.
Fines per resident, 10 countries, 1,042 decisions
In total, 1,042 decisions and €833m in known fines. Every decision, with its grounds and official source, is listed at the end of this article.
France at €9.58 per resident, Spain at €0.35: the full ranking
France reaches €9.58 per resident with €662m from 200 decisions. Greece follows at €3.61, on €37m for 10.4 million residents. The three Baltic states and Luxembourg sit between €0.83 and €2.21, on small populations and small totals. The other large economies are at the bottom: Italy €0.63, Germany €0.61, Poland €0.53, Spain €0.35.
Germany shows how much the denominator matters. Its €50.8m is the second-largest total of the ten, but spread over 83.5 million residents it lands near the bottom. Spain has 134 decisions in its selection, in the same range as Poland or Greece, yet the total is only €17.6m: the Spanish authority fines often and fines small.
Five French decisions explain 89% of the French total
The French figure is not the product of many large fines. It is the product of a handful of very large ones. Five decisions out of 200 carry €592m, 89% of the French total. Google at €325m and Shein at €150m alone make up 72%. The other 195 French decisions add up to €70m, and the median French fine is €11,000.
Strip the five largest decisions out and France drops to €1.01 per resident, roughly Latvia’s level and still 2.8 times Spain. France is both the country of the mega-fine and a country where the ordinary fine is in the tens of thousands.
Two US Big Tech decisions, 41% of all fines
Among the 1,042 decisions, exactly 2 target Alphabet/Google, Amazon, Apple, Meta or Microsoft: the CNIL’s €325m Google decision of September 2025 on cookies and Gmail advertising, and its €15m Amazon France Logistique decision on employee monitoring, as reduced on appeal. Two decisions, €340m, 40.8% of all known fine amounts in ten countries, from 0.2% of the decisions.
Put differently, Google’s single fine is worth 1.9 times the known fines of the nine other countries combined, 842 decisions and €171m. The 961 smallest decisions in the collection, 92% of all decisions, add up to €293m, still less than that one decision.
| Group | Authority | Date | Fine | Share of the €833m | Grounds |
|---|---|---|---|---|---|
| Alphabet / Google | CNIL | September 2025 | €325,000,000 | 39% | Cookies and Gmail advertising |
| Amazon | CNIL | December 2023 | €15,000,000 | 1.8% | Employee monitoring, amount after appeal |
| US Big Tech | €340,000,000 | 40.8% | 0.2% of decisions |
Without those two decisions, France would still be at €4.66 per resident, 13× Spain. US Big Tech explains about 51% of the French total, not the gap itself.
The typical fine is €7,274, not €325m
The headline numbers hide how small most decisions are. Of the 965 decisions with a known amount, 529 are below €10,000 and 820 are below €100,000. Only 39 reach €1 million. The 11 decisions at €10 million or more carry €697m, 84% of all the money.
The median also varies a lot by country. Germany has the highest typical fine among the decisions with a published amount, €20,000, followed by France at €11,000 and Greece at €10,000. Spain and Lithuania sit around €6,500, Italy at €5,000, Luxembourg at €2,800 and Latvia at €1,000. Estonia has only two decisions in the register, both above €1 million.
Security is the most frequent ground, cookies the most expensive
For 580 of the 1,042 decisions, the official text documents the grounds precisely enough to classify them. One decision often has several. Insufficient security is the most frequent ground, in 163 decisions, ahead of no valid legal basis, poor information to individuals and not cooperating with the authority.
Money tells the opposite story. Cookie rules appear in only 39 decisions, but those decisions carry €543m, 65% of the entire collection, because they include Google, Shein and Orange. Consent failures follow with €370m in 29 decisions. Failure to cooperate with the authority is cited 112 times and accounts for €0.9m: it is the ground of the small fine.
The ten countries in numbers
| Country | € / resident | × Spain | Known fines | decisions | Median fine | Largest fine | Population | Period covered |
|---|---|---|---|---|---|---|---|---|
| France | €9.58 | 27× | €661,782,000 | 200 | €11,000 | €325,000,000 | 69,112,309 | Feb 2023 – Jul 2026 |
| Greece | €3.61 | 10× | €37,399,749 | 130 | €10,000 | €20,000,000 | 10,366,586 | Jul 2019 – Oct 2026 |
| Estonia | €2.21 | 6.2× | €3,005,000 | 2 | €1,502,500 | €3,000,000 | 1,360,745 | Dec 2024 – Sept 2025 |
| Lithuania | €1.13 | 3.2× | €3,263,038 | 403 amounts unavailable | €6,600 | €2,385,276 | 2,887,592 | May 2019 – Jun 2026 |
| Latvia | €0.99 | 2.8× | €1,833,060 | 381 amount unavailable | €1,000 | €1,200,000 | 1,845,096 | Aug 2019 – Jul 2026 |
| Luxembourg | €0.83 | 2.3× | €573,736 | 55 | €2,800 | €175,000 | 690,959 | Apr 2021 – Dec 2025 |
| Italy | €0.63 | 1.8× | €37,214,293 | 2008 amounts unavailable | €5,000 | €9,516,000 | 58,942,828 | Dec 2025 – Oct 2026 |
| Germany | €0.61 | 1.7× | €50,826,200 | 10259 amounts unavailable | €20,000 | €30,000,000 | 83,467,117 | Report years only |
| Poland | €0.53 | 1.5× | €19,160,846 | 1416 amounts unavailable | €5,858 | €4,328,687 | 36,332,765 | Mar 2019 – Sept 2026 |
| Spain | €0.35 | 1× | €17,597,950 | 134 | €6,500 | €5,000,000 | 49,590,099 | Jan 2022 – Aug 2026 |
| Full collection | €832,655,872 | 1,042 | €7,274 | €325,000,000 |
Medians and largest fines use the decisions with a known amount. Periods are the span of dated decisions in each selection.
How we counted
- Per resident is the sum of documented fine amounts in the selection divided by the Eurostat population on 1 January 2026. It is not an amount paid by residents, nor a probability of being fined.
- Each selection holds up to the 200 most recent documented decisions we found in official registers, publications or annual reports. It is not certified as the latest 200 national decisions, and periods differ by country.
- Amounts are those documented by official sources, with verified appeal reductions applied. Missing, unverifiable or annulled amounts are left out of the sums, never counted as zero. Polish amounts are converted at the ECB rate on the decision date.
- GDPR, cookie and related national data protection rules are included. Fines under general administrative procedure are excluded.
- US Big Tech covers Alphabet/Google, Amazon, Apple, Meta and Microsoft, including subsidiaries identified in an official source. A decision mentioning YouTube, WhatsApp or another service does not make the sanctioned party a US Big Tech company.
- Grounds are classified from the official text where it is precise enough, for 580 decisions. The remaining 462 have no classified grounds and are left out of the grounds chart only.