{"page":"/blog/gdpr-eprivacy-bidstream-tcf","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Date","Authority","Company","Amount","What was fined","Source"],"rows":[["31 December 2021","CNIL (France)","Google","€150 million","Refusing cookies harder than accepting them; injunction","CNIL sanctions list"],["31 December 2021","CNIL","Facebook","€60 million","Same cookie-refusal design plus information failures","CNIL sanctions list"],["2 February 2022","Belgian APD","IAB Europe","€250,000","TCF design: no legal basis for the TC String, transparency, accountability","APD"],["4 January 2023","Irish DPC","Meta (Facebook, Instagram)","€210 million + €180 million","Contract used as basis for behavioural advertising","DPC"],["22 May 2023","Irish DPC","Meta","€1.2 billion","EU-US transfers under SCCs (Article 46(1)); suspension within five months","DPC"],["15 June 2023","CNIL","Criteo","€40 million","Targeted advertising without proof of consent; transparency; access and withdrawal rights; joint-controller agreement","CNIL sanctions list"],["23 April 2025","European Commission (DMA)","Meta","€200 million","\"Consent or pay\" without a less-personalized equivalent (Article 5(2))","Commission"],["1 September 2025","CNIL","Google LLC, Google Ireland","€325 million","Ads between Gmail messages without consent; advertising cookies at account creation; injunction with €100,000 per day; closed 23 September 2026 after changes","Privacy Laws & Business; CNIL, 14 October 2026"],["1 September 2025","CNIL","Shein (Infinite Styles Services)","€150 million","Cookies placed without valid consent on shein.com","CNIL sanctions list"],["2 October 2026 (published 16 October 2026)","Norwegian Datatilsynet","Xandr","€8.6 million (NOK 92 million)","RTB with Grindr users' app use, advertising ID and IP; joint controller as SSP and DSP; relied on the app's consent; Articles 6(1), 9(1)","EDPB, 16 October 2026"]],"sourceUrls":[["https://www.cnil.fr/en/sanctions-issued-cnil"],["https://www.cnil.fr/en/sanctions-issued-cnil"],["https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr"],["https://www.dataprotection.ie/en/news-media/data-protection-commission-announces-conclusion-two-inquiries-meta-ireland"],["https://www.dataprotection.ie/en/news-media/press-releases/Data-Protection-Commission-announces-conclusion-of-inquiry-into-Meta-Ireland"],["https://www.cnil.fr/en/sanctions-issued-cnil"],["https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085"],["https://www.privacylaws.com/news/cnil-fines-google-325-million-and-shein-150-million/","https://www.cnil.fr/en/closure-injunction-google"],["https://www.cnil.fr/en/sanctions-issued-cnil"],["https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en"]]}