digital democracydigital privacy

Social media giants paid $26B for privacy violations

While social media connects billions, it also creates massive trails of personal data that platforms don't always protect. Over the last few years, the world’s most popular apps have faced billions in fines and settlements for how they handle, or shall we say mishandle, user data. Whether it’s inadequate safeguards for younger users or unauthorized cross-border data transfers, authorities are increasingly holding tech giants accountable. We’ve analyzed the biggest privacy payouts across major markets to see which social media giants are the most frequent offenders.

Key insights

• Since 2020, 10 of the world’s most popular social media platforms have faced more than $26 billion in privacy-related fines and settlements across Europe, the US, Australia, and South Korea.

• Meta-owned platforms accounted for 91% ($23.7 billion) of the total, with Facebook alone responsible for $14.3 billion and Instagram for $9.4 billion. TikTok ranked a distant third at $1.6 billion.

• Mid-tier totals included LinkedIn ($360 million), YouTube ($222 million), and X ($151 million), while Snapchat ($35 million) and Reddit ($19 million) recorded smaller amounts. Discord registered only $0.9 million, while Pinterest was the only platform with no qualifying fines or settlements identified in the research.

• The US imposed a total of $20.9 billion in fines on social media platforms, accounting for 80% of total global fines. The US also issued the largest single penalty in the research, a $17.1 billion settlement¹ with Meta-owned Facebook and Instagram over allegations that inadequate safeguards exposed young users to deliberately addictive platform features.

• In addition, US authorities issued fines totaling $3.69 billion for data-processing-related violations. Facebook accounted for $2.9 billion of that amount, followed by TikTok ($593 million), X ($150 million), Instagram ($68.5 million), YouTube ($36 million), and Snapchat ($35 million). TikTok also received a separate $100 million penalty in 2026 for insufficient security safeguards.

• European authorities have imposed $5.16 billion in GDPR-related fines on social media platforms, with Ireland accounting for the largest share at $4.87 billion, or 94% of the total. France followed with $245 million, ahead of the UK ($36 million), Spain ($11.6 million), and the Netherlands ($870,000).

• Europe’s two largest fines issued to social media platforms resulted from international data-transfer violations. Facebook received a $1.39 billion penalty for transferring EU user data to the US, while TikTok was fined $615 million for transferring European user data to China.

• Beyond data transfers, European authorities imposed $1.22 billion in data-processing fines on TikTok ($401 million), LinkedIn ($360 million), Facebook ($244 million), Instagram ($209 million), and YouTube ($11.6 million). Data-breach-related penalties reached $1.09 billion, including $618 million for Facebook, $470 million for Instagram, and $522,000 for X.

• EU authorities imposed an additional $594 million in fines for insufficient security, with Facebook accounting for $452 million, followed by Instagram ($106 million), Reddit ($19.3 million), and TikTok ($16.8 million). Cookie-consent violations resulted in $243.6 million in penalties for YouTube ($174 million) and Facebook ($69.6 million), while Discord was fined $928,000 for failing to comply with data-retention requirements.

• Among the other analyzed markets, South Korea imposed $62.4 million in data-processing fines on social media platforms, including $43.5 million on Facebook, $11.8 million on Instagram, and $7 million on TikTok.

• Meanwhile, Australian authorities fined Facebook nearly $50 million for data-processing violations and imposed a $463,000 penalty on X for insufficient security.

Methodology and sources

The study examined privacy-related fines and settlements involving selected social media platforms reported from 2020 onward in European countries operating under the GDPR or an equivalent national framework, as well as the US, Australia, and South Korea. Penalties were grouped by platform, country, and violation type, defined as follows:

• Data processing: Unlawful collection, use, or other processing of personal data, including failures involving transparency, consent, or a valid legal basis.

• Data transfers: Unlawful or inadequately protected transfers of personal data between countries or jurisdictions.

• Data breaches: Incidents resulting in the unauthorized exposure, theft, or loss of personal data.

• Insufficient security: Failure to implement appropriate technical or organizational safeguards to protect personal data.

• Cookie consent: Use of cookies or similar tracking technologies without valid consent or adequate user information.

• Data retention: Keeping personal data for longer than necessary or failing to establish appropriate deletion periods.

The minimum penalty included was €200,000 in Europe and $200,000 in all other markets. All amounts were converted into US dollars for consistent comparison and rounded for readability, using a conversion rate of $1 = €0.87.

Data were collected from publicly available sources, including the GDPR Enforcement Tracker, Violation Tracker, Violation Tracker Global, and Osano’s Data Privacy Enforcement Tracker, supplemented by official regulatory announcements, court records, and reputable news reports. Major penalties were cross-checked against primary or other credible sources where available. Additional cases in Australia and South Korea were identified through targeted web searches.

Social media platforms were selected using Cloudflare’s ranking² of the world’s 10 most popular internet services. YouTube was reclassified from video streaming to social media, replacing Kwai, because YouTube has a broader global reach, while Kwai’s audience is concentrated primarily in Brazil.

Data was collected from:

References: