GDPR: France imposes 27x more in fines per resident than Spain

How much do data protection authorities actually fine, once you account for the size of each country? We compared ten European countries on one ratio, euros of fines per resident, and looked at what sits behind the biggest figures.

We took the most recent documented decisions of ten European data protection authorities, up to 200 per country, and divided each country’s known fines by its population. The result is a single ratio per country: euros of fines per resident. It is not what residents pay, nor the risk of being fined, but it puts ten enforcement records of very different sizes on one scale. Three findings stand out.

In total, 1,042 decisions and €833m in known fines. Every decision, with its grounds and official source, is listed at the end of this article.

France reaches €9.58 per resident with €662m from 200 decisions. Greece follows at €3.61, on €37m for 10.4 million residents. The three Baltic states and Luxembourg sit between €0.83 and €2.21, on small populations and small totals. The other large economies are at the bottom: Italy €0.63, Germany €0.61, Poland €0.53, Spain €0.35.

Germany shows how much the denominator matters. Its €50.8m is the second-largest total of the ten, but spread over 83.5 million residents it lands near the bottom. Spain has 134 decisions in its selection, in the same range as Poland or Greece, yet the total is only €17.6m: the Spanish authority fines often and fines small.

The French figure is not the product of many large fines. It is the product of a handful of very large ones. Five decisions out of 200 carry €592m, 89% of the French total. Google at €325m and Shein at €150m alone make up 72%. The other 195 French decisions add up to €70m, and the median French fine is €11,000.

Strip the five largest decisions out and France drops to €1.01 per resident, roughly Latvia’s level and still 2.8 times Spain. France is both the country of the mega-fine and a country where the ordinary fine is in the tens of thousands.

Among the 1,042 decisions, exactly 2 target Alphabet/Google, Amazon, Apple, Meta or Microsoft: the CNIL’s €325m Google decision of September 2025 on cookies and Gmail advertising, and its €15m Amazon France Logistique decision on employee monitoring, as reduced on appeal. Two decisions, €340m, 40.8% of all known fine amounts in ten countries, from 0.2% of the decisions.

Put differently, Google’s single fine is worth 1.9 times the known fines of the nine other countries combined, 842 decisions and €171m. The 961 smallest decisions in the collection, 92% of all decisions, add up to €293m, still less than that one decision.

Without those two decisions, France would still be at €4.66 per resident, 13× Spain. US Big Tech explains about 51% of the French total, not the gap itself.

The headline numbers hide how small most decisions are. Of the 965 decisions with a known amount, 529 are below €10,000 and 820 are below €100,000. Only 39 reach €1 million. The 11 decisions at €10 million or more carry €697m, 84% of all the money.

The median also varies a lot by country. Germany has the highest typical fine among the decisions with a published amount, €20,000, followed by France at €11,000 and Greece at €10,000. Spain and Lithuania sit around €6,500, Italy at €5,000, Luxembourg at €2,800 and Latvia at €1,000. Estonia has only two decisions in the register, both above €1 million.

For 580 of the 1,042 decisions, the official text documents the grounds precisely enough to classify them. One decision often has several. Insufficient security is the most frequent ground, in 163 decisions, ahead of no valid legal basis, poor information to individuals and not cooperating with the authority.

Money tells the opposite story. Cookie rules appear in only 39 decisions, but those decisions carry €543m, 65% of the entire collection, because they include Google, Shein and Orange. Consent failures follow with €370m in 29 decisions. Failure to cooperate with the authority is cited 112 times and accounts for €0.9m: it is the ground of the small fine.

Medians and largest fines use the decisions with a known amount. Periods are the span of dated decisions in each selection.

Appeals and payment have not been verified. Initial amount excluding periodic penalty payments.

21/07/2026FRHOPITAL PRIVE DE LA LOIREThe security of patient records was insufficient. The hospital had not directly informed the trusted contacts whose data had been stolen.Grounds Insufficient security, mishandled data breach.Follow-up and amountsAppeals and payment have not been verified. Initial amount excluding periodic penalty payments.

26/05/2026FRIQVIA OPERATIONS FRANCEThe health data warehouses did not comply with all the conditions of their authorisations, particularly concerning security, information and the right to object. The pharmacy software could transmit data despite a refusal to allow transmission.Grounds Health data rules, poor information to individuals, ignoring individuals’ requests, insufficient security, privacy by design.Follow-up and amountsAppeals and payment have not been verified. Initial amount excluding periodic penalty payments.

02/04/2026FRRestroom facilities operatorThe CNIL identifies failures concerning the lawfulness of the video surveillance system, data minimisation, oversight of processors and the impact assessment.Grounds No valid legal basis, excessive collection or monitoring, processor obligations, missing or flawed impact assessment.Follow-up and amountsAppeals and payment have not been verified. Initial amount excluding periodic penalty payments.

26/03/2026FRTourist accommodation companyThe sanction concerns data minimisation, retention periods and the arrangements governing processor relationships.Grounds Excessive collection or monitoring, keeping data too long, processor obligations.Follow-up and amountsAppeals and payment have not been verified. Initial amount excluding periodic penalty payments.