TL;DR: GDPR AI enforcement is accelerating. Five major cases reveal the pattern: when you send personal data to an AI, you are the data controller and the DPA alone does not protect you. Small teams face proportional fines, not billion-euro headlines, but the compliance gaps are the same.
Cumulative GDPR fines since 2018 crossed €7.1 billion as of early 2026. The headline numbers come from large tech companies, but the underlying violations, inadequate legal basis, insufficient transparency, unauthorized data flows, and failure to conduct required impact assessments, are mistakes any organization can make when adopting AI tools without a proper governance process.
This article covers five enforcement cases that directly inform what small teams need to do differently. For each case, we explain what happened, which GDPR articles were at issue, what the fine was, and what the practical lesson is for a team with 10 to 200 people.
Case 1: Meta, €1.2 billion (2023, data transfers and profiling)
What happened. The Irish Data Protection Commission (DPC) issued a €1.2 billion fine against Meta in May 2023, the largest GDPR fine ever issued. The violation centered on Meta's practice of transferring EU user data to the United States for processing, including for AI personalization and advertising systems, without relying on Standard Contractual Clauses (SCCs) in a manner compliant with the Schrems II ruling from the Court of Justice of the EU.
GDPR articles violated. Article 46 (transfers to third countries without appropriate safeguards).
What the fine was. €1.2 billion, plus an order to suspend all transfers of Facebook user data from the EU to the US within five months.
Lesson for small teams. Cross-border AI data flows carry real regulatory risk. If you are sending EU user data to an AI provider with US-based processing, confirm that the vendor relies on SCCs or an adequacy decision and that those SCCs are implemented properly. The EU-US Data Privacy Framework, operative since 2023, provides a transfer mechanism for companies that self-certify, but it does not apply automatically. Review your vendor's data transfer documentation before sending personal data to any US-based AI provider.
Case 2: TikTok, €345 million (2023, children's data and dark patterns)
What happened. The Irish DPC fined TikTok €345 million in September 2023. The violations related to TikTok's use of AI-driven recommendation systems for accounts belonging to users under 18. TikTok's recommendation algorithm defaulted new accounts, including those of minors, to public settings, and used AI-driven personalization in ways that failed to provide meaningful transparency or parental controls. The DPC found that TikTok had used dark patterns, meaning design choices that steered minors toward privacy-invasive options, in violation of the principle of data protection by design.
GDPR articles violated. Article 5(1)(a) (lawfulness and transparency), Article 25 (data protection by design), Article 12 and 13 (transparency obligations), and child-specific obligations under Article 8.
What the fine was. €345 million.
Lesson for small teams. If your product uses AI-driven personalization or recommendation features and any portion of your user base may be minors, the default settings and the transparency of those settings are subject to scrutiny. AI recommendation systems that steer users toward privacy-invasive choices without adequate disclosure create direct GDPR exposure. Review your AI personalization defaults and ensure your privacy notices accurately describe how AI systems influence user experience.
Case 3: Clearview AI (multiple fines, biometric data without consent)
What happened. Clearview AI offers a facial recognition system trained on billions of photographs scraped from the internet without the knowledge or consent of the individuals pictured. Supervisory authorities in France, Italy, Greece, the UK, and Australia all found Clearview in violation of GDPR (or equivalent laws) for processing biometric data without a valid legal basis.
French CNIL fined Clearview €20 million in 2022. Italian Garante issued a €20 million fine and an order to delete all data on Italian residents. The UK ICO issued a £7.5 million fine, which was overturned by the First-tier Tribunal in October 2023 on jurisdictional grounds; the ICO's further appeal to the Upper Tribunal was partly upheld in October 2025.
GDPR articles violated. Article 9 (special category data, including biometric data used for identification), Article 6 (no valid legal basis for processing), and Article 17 (right to erasure, as Clearview failed to honor deletion requests).
What the fine was. Over €100 million in combined EU/EEA fines (French CNIL €20M, Italian Garante €20M, Dutch DPA €30.5M, and additional fines from Greek, Austrian, and other DPAs).
Lesson for small teams. Biometric data is special category data under GDPR and requires explicit consent or another specific Article 9(2) basis to process. If you are using any AI tool that processes facial images, voice recordings, or other biometric data from individuals, the legal basis requirement is strict. You cannot rely on legitimate interests for biometric data processing. Additionally, AI systems trained on scraped data that includes personal data of EU residents create exposure even if you did not conduct the scraping yourself.
Case 4: OpenAI/ChatGPT (Italy ban 2023 and ongoing investigations)
What happened. Italy's Garante temporarily banned ChatGPT in March 2023, citing four primary concerns: no legal basis to collect and process Italian users' personal data for AI training; no age verification to prevent minors from accessing the service; inadequate transparency about how user data was used; and failure to respond appropriately to data subject rights requests. OpenAI implemented a series of remediation measures, including an opt-out from AI training, a privacy notice update, and an EU-dedicated data rights portal. The ban was lifted in April 2023.
Subsequent investigations by multiple EU supervisory authorities, including the Polish and French authorities, have examined OpenAI's data practices under GDPR. The Polish DPA's investigation, opened in 2023, continued through 2025. The European Data Protection Board established a special OpenAI task force in 2023 to coordinate cross-border enforcement.
GDPR articles at issue. Article 6 (legal basis for training data collection), Article 13 and 14 (transparency), Article 22 (automated decisions), Article 35 (need for DPIA given scale of processing).
What the outcome was. No final fine from the initial Italian action, which resolved through remediation. Investigations in other jurisdictions remain ongoing.
Lesson for small teams. AI training data practices are under regulatory scrutiny. If you use AI tools that train on user-provided data, confirm that the vendor has a documented legal basis for that training and that your privacy notice discloses it. If you are building an AI product and collecting user data for training, you need a DPIA before you begin and a legal basis that is documented and defensible. Legitimate interests typically does not suffice for large-scale AI training on personal data.
Case 5: 2025-2026 enforcement trends
The individual landmark cases above establish the patterns. The 2025-2026 period has seen those patterns applied at scale.
Annual GDPR fines in 2025 reached approximately €1.2 billion, consistent with 2024 totals, according to the DLA Piper GDPR Fines and Data Breach Survey published in January 2026. The cumulative total since GDPR's application in 2018 now stands at €7.1 billion. AI-adjacent enforcement, where the core violation involves an AI system or AI-powered data processing practice, has grown as a proportion of investigations as AI adoption has accelerated.
The categories generating the most enforcement activity in 2025 and 2026:
- AI systems processing health or biometric data without explicit consent
- Cross-border data transfers to AI providers without adequate safeguards
- Automated decision-making under Article 22 without the required human review option
- AI training data practices with insufficient transparency to data subjects
- Failure to conduct DPIAs before deploying high-risk AI processing
The direction of enforcement is toward the deployer, not just the developer. Several 2025 cases specifically found that organizations deploying third-party AI tools were responsible for conducting DPIAs, establishing legal basis, and updating privacy notices, regardless of whether the vendor provided adequate documentation.
CNIL fines IQVIA 5 million euros, May 26 2026: The French CNIL issued decision SAN-2026-008 against IQVIA Operations France, fining the health data analytics company 5 million euros for failures in its health data warehouses (LRX and EMR). The key ruling: pseudonymized data is not anonymous data. IQVIA argued its pharmacy and physician data was anonymized; the CNIL ruled individuals could still be re-identified using available external information, making the processing subject to full GDPR Article 9 health data protections. IQVIA also faces compliance injunctions with penalties up to 10,000 euros per day for continued breaches. The case reinforces a pattern: companies cannot classify data as "anonymous" to escape GDPR obligations if re-identification is technically feasible. For teams using AI tools that process any health-adjacent data, this ruling makes pseudonymization strategies legally risky without genuine anonymization.
The data controller problem: why your DPA is not enough
This is the single most important concept for small teams adopting AI tools.
A Data Processing Agreement between your organization and an AI vendor establishes the processor's obligations: what security measures it must maintain, what it can and cannot do with the data, and how it must respond to data subject requests. It is a necessary document. But it does not create the legal basis for sending personal data to the AI in the first place.
When you decide to send customer data to an AI tool for analysis, you are making a data controller decision. You are determining the purpose of the processing and the means by which it will be carried out. GDPR assigns responsibility for that decision to the controller, not the processor.
This means:
- The legal basis for the AI processing must be established by you, not the vendor
- The privacy notice must disclose that the AI tool processes the data
- If a DPIA is required, you must conduct it before beginning the processing
- If the processing involves automated decisions with significant effects, you must comply with Article 22 requirements including providing a human review option
A DPA from your AI vendor is a necessary starting point, not a compliance endpoint.
What the fine scale means for small teams
A 10-person company will not receive a €1.2 billion fine. GDPR fine calculation is proportional to turnover. But proportionality does not eliminate the risk.
For a company with €1 million annual revenue, the Article 83(4) maximum for violations of processor requirements, data subject rights, and transfer obligations is €10 million or 2% of turnover, applying whichever is higher. For more serious violations of fundamental data processing principles or legal basis requirements, the Article 83(5) maximum is €20 million or 4% of turnover.
In practice, supervisory authorities apply these maxima rarely for first-time violations by small organizations. A more realistic outcome for a small team is a reprimand, an order to implement corrective measures, and a fine in the range of €5,000 to €50,000 depending on severity and mitigating factors. The indirect costs of responding to an investigation, legal fees, staff time, potential reputational damage, can exceed the fine itself.
The mitigation is straightforward: audit your AI data flows, confirm legal basis for each processing activity, maintain your Article 30 records, execute DPAs with every vendor that processes personal data, and update your privacy notices before new AI processing begins, not after.
Risk and mitigation summary
| Risk category | GDPR issue | Mitigation |
|---|---|---|
| Cross-border AI data transfer | Article 46, no adequate safeguards | Confirm vendor relies on SCCs or adequacy decision |
| AI system processing biometric data | Article 9, no explicit consent | Explicit consent or narrow Article 9(2) basis required |
| AI trained on scraped user data | Article 6, no legal basis | Audit vendor training data practices before adopting |
| AI recommendation system with minors | Article 25, not privacy-by-design | Review defaults, add age verification, update notices |
| Sending customer data to AI without notice | Article 13/14, inadequate transparency | Update privacy notice before beginning processing |
| Automated decisions affecting users | Article 22, no human review option | Implement opt-out and human review for significant decisions |
| No DPIA before high-risk AI deployment | Article 35, required assessment omitted | Conduct DPIA before deploying any high-risk AI processing |
Related reading
- AI Enforcement Tracker: every real AI regulatory action worldwide, sourced
- AI data privacy for small teams GDPR CCPA
- GDPR Article 30 AI tools record of processing activities template
- GDPR Article 22 automated decisions AI tools
- GDPR-compliant AI assistants comparison 2026
- Anthropic vs OpenAI GDPR compliance 2026
- AI vendor DPA tracker 2026
- Privacy-first AI API no training GDPR CCPA
- EU AI Act compliance guide for small teams
- AI meeting transcription data leak compliance 2026
- Connecticut Data Privacy Law Expands July 1: CTDPA SB 4 Small Team Compliance
- AI compliance cost for small teams 2026
- AI Agent Memory and GDPR: How to Handle Persistent Context Without a Com
- Synthetic data governance and GDPR: what you need to document in 2026
- CCPA and AI in 2026: what California's privacy law requires for AI tools
- Enterprise AI privacy pages: direct links to OpenAI, Anthropic, Google, Microsoft documentation
- Does your AI vendor train on your business data? 11 vendors compared
