GDPR fines hit €1.2 billion in 2024 on 8.3% more breach reports

Corporation violations of GDPR rules resulted in total fines of €1.2 billion in 2024, according to a report from international law firm DLA Piper. This sum represents a 33% decrease compared to 2023, breaking a seven-year run of increasing fines year over year.

One reason for the decline, according to DLA Piper, is that a €1.2 billion penalty was imposed in 2023 — the same amount as in all of 2024 — against Meta alone, a fine that remains the record-setter for the biggest of all time.

“After seeing an increase in administrative penalty fees since the GDPR came into force in 2018, we are now seeing a decrease. This is due to the fact that no large record fines have been issued in 2024. However, the number of reports of personal data breaches has continued to rise,” said Anna Jussil Broms, head of intellectual property and technology at DLA Piper in Sweden. 

The number of data breach notifications increased in 2024 to an average of 363 per day, versus 335 per day the year prior, an increase of 8.3%. 

As before, it is the big tech companies and social media giants that are the ones that have been primarily hit by fines. The largest fines in 2024 were issued by the Irish GDPR regulator and targeted LinkedIn (€310 million) and Meta (€251 million). 

“It is clear that GDPR oversight continues to evolve and adapt. We are seeing increased oversight in sectors beyond large technology and social media companies. For example, a focus on governance and oversight has led the Dutch Data Protection Authority to investigate whether individuals in the management team of Clearview AI can be held personally liable for GDPR violations, following a fine of €30.5 million against the company,” said Gustav Lundin, partner at DLA Piper in Sweden.