DxtraBETA
Back to blog
FinesUKEuropean UnionRegulationsSmall Business October 2026Updated 15 min read

What UK and European privacy regulators fined businesses for: a first look

A first look at what UK and EU privacy regulators fined businesses for: marketing calls, cookie banners, ignored requests, cameras and WhatsApp groups.

A data protection regulator's penalty notice stamped Fined, with a second decision in euros behind it, beside a laptop showing a cookie banner where Reject all is as easy as Accept all, a security camera and a phone with a group chat.

Big privacy fines make the news. A penalty in the millions against a global tech company is easy to read past if you run a shoe shop, a holiday rental or a five-person marketing agency.

The smaller decisions are more useful. They show what regulators expect from businesses like yours, and most of them never reach a headline.

We have started building a record of what data protection regulators publish: the fines, orders, reprimands and warnings they list on their own websites, read at the source. This post is a first look at the UK and European part of that record, covering decisions published between 1 October 2025 and 30 September 2026. It is a sample, not the whole picture. A regular series follows, and later editions add the Americas and Asia-Pacific.

In a hurry? Five mistakes come up again and again: marketing calls and texts to people who never agreed to them; cookie banners without a one-click "Reject"; ignoring customers who ask to see or delete their data; cameras that film more than they need to; and personal details shared where they do not belong, WhatsApp groups included. The checklist is at the end.

How we read the record

  • Only the regulators' own pages. The UK's Information Commissioner's Office (ICO; since 30 September 2026, the Information Commission, which still uses the name ICO); the regulators of Ireland, France, Spain, Italy, the Netherlands, Belgium and Austria (for Austria, its announcements only: its decisions database could not be read); Germany's federal regulator and its state regulators; and the European Data Protection Board's register of cross-border decisions. No news reports, no fine trackers.
  • A sample. We read up to 50 entries per regulator. For the busiest (the UK, France, Spain and Italy) that is part of the year, not all of it.
  • Size as the regulator states it. Regulators rarely say how big a business is. Where they do, we quote them. Otherwise we describe a business the way the regulator does: "a shoe retailer", "a law firm".
  • Names as the regulator publishes them. Some regulators name the business; France withholds names in its fast-track cases, and so do we wherever the regulator does.

1. Marketing calls and texts to people who never agreed

This is the clearest pattern in the UK record. Every case below is under the UK's marketing rules (the Privacy and Electronic Communications Regulations, or PECR).

  • Elderly Aids Limited, £190,000 (6 August 2026). The ICO says the company, which sold call-blocking devices, "made 758,053 unsolicited direct marketing calls" to people registered with the Telephone Preference Service (TPS) or its business equivalent. The ICO's own headline: "ICO hits company selling call blockers with £190k fine for nuisance calls".
  • Thermotech Wall and Loft Surveys Ltd, £240,000 (28 May 2026). After a search warrant, the ICO found 575,062 unsolicited marketing calls to TPS-registered numbers in six months.
  • KRA Consultancy Ltd, £300,000 (20 May 2026). "Over 5.5 million unsolicited direct marketing and fake bailiff texts", and over 60,000 complaints to the 7726 spam reporting service.
  • Energy Prices Direct Limited, £160,000 (30 March 2026). An energy-switching service that took numbers from public sources and list providers "but failed to screen the data against the TPS/CTPS prior to making a marketing call."
  • Jacksons Marketing Ltd, £130,000 (12 March 2026). 232,776 unsolicited marketing calls to TPS-registered numbers, which led to 12 complaints.
  • TMAC Ltd, £100,000 (3 February 2026), for marketing calls.
  • Allay Claims Ltd, £120,000 (15 January 2026), for unsolicited texts promoting tax refund services.
  • ZMLUK Limited, £105,000 (11 December 2025), for "sending unsolicited emails promoting energy saving products."
  • Lead Pronto Ltd, £30,000 (6 November 2025), for unsolicited texts promoting boiler grants.

Why it matters to you. Jacksons Marketing's calls led to only 12 complaints, and the fine was still £130,000. Buying a list does not move the responsibility to the seller: the business making the call has to check it. In the notices we read, the ICO also offers a 20% reduction for payment by a set date, so £130,000 becomes £104,000. That is still a sum most small businesses cannot absorb.

What to check. Before you call anyone in the UK, screen the number against the TPS (and the CTPS for business numbers). Marketing texts and emails to individuals need their consent, or the "soft opt-in" for your own existing customers.

2. Cookie banners without a one-click "Reject"

France's regulator, the CNIL, runs a fast-track procedure for cases with no particular legal difficulty. Fines are capped at €20,000, and the CNIL may not publish the name of the organization. Between January and early July 2026 it issued 23 of these, totaling €133,750; between May and October 2025, another 16, totaling €108,000.

Cookies are one of its most common reasons. The CNIL describes banners with a button to accept every cookie at once, where refusing meant clicking "customize" and working through a settings screen. Its rule, in our translation: "if a site offers a way to accept all cookies in one click, it must also allow refusing them all in one click." It also fined sites that set advertising cookies before the visitor had chosen anything.

Fast-track fines on businesses where cookies were among the failings, as the CNIL lists them:

  • a general mail-order and online seller, €4,000 (9 October 2025);
  • a specialist mail-order seller, €3,000 (16 October 2025);
  • a shoe retailer, €5,000 (13 November 2025);
  • an operator of sports and leisure centers, €20,000 and an order to comply (16 October 2025), which also covered data security and the information given to people;
  • an events business selling tickets, €15,000 and an order (26 March 2026), which also covered how long it kept data and how it handled deletion requests.

At the other end of the scale, the CNIL fined American Express Carte France €1.5 million (decided 27 November 2025) for setting cookies without consent or despite a refusal, and for continuing to read cookies after consent was withdrawn. The CNIL noted that the company came into compliance during the proceedings. It fined Les Publications Condé Nast, publisher of vanityfair.fr, €750,000 (decided 20 November 2025), noting that the company had already received a formal notice that "should have led it to comply" (our translation).

Why it matters to you. These were found by the CNIL checking websites, not only by complaints. A cookie banner is the first thing a regulator can see on your site.

What to check. "Reject all" on the first screen, as easy as "Accept all". Nothing that needs consent loads before the visitor chooses. If you sell on Shopify, our ten-minute guide covers the related setting for the opt-out signal some browsers send.

3. Ignoring requests to see or delete data, and ignoring the regulator

Of the CNIL's 23 fast-track sanctions in 2026, 8 were about people's rights to see or delete their data, and 4 of those also involved a failure to cooperate with the CNIL. Of the 16 before that, 10 were for not cooperating. The CNIL names lawyers and doctors among those that did not answer it and were fined and ordered to respond. Where a business still did not respond, it had to pay a further penalty sum.

  • a law firm, €5,000 (5 November 2025): a deletion request not honored, and no cooperation with the CNIL;
  • a specialist mail-order seller, €5,000 (12 March 2026): a request to see personal data not honored.

In Italy, the regulator (the Garante) fined Fluyda Srl Società Benefit in liquidazione €1,000 (18 June 2026) in a case about the right to be forgotten. In setting the amount it took into account "the controller's nature as a micro-enterprise" and the company's liquidation (our translation).

Why it matters to you. These are the cheapest cases to avoid. A request answered on time costs an hour. A request ignored, followed by a regulator's letter ignored, is how a complaint becomes a fine.

What to check. Under the GDPR you have one month to answer a request to see or delete data. Write down who handles them. Answer every letter from a regulator.

4. Cameras that film more than they need to

The CNIL fined businesses in fast food, urban transport and shops in railway stations for running video systems without the required authorization, or for filming their staff continuously. Its reminder, in our translation: cameras "must under no circumstances film employees continuously" unless exceptional circumstances justify it. One fast-track case: a company running public toilet facilities, €7,500 (2 April 2026), for unlawful video surveillance, filming more than necessary, no proper contract with the company handling data on its behalf, and no impact assessment.

In Germany, the North Rhine-Westphalia regulator checked 38 amusement arcades (9 June 2026). Of the nine that filmed outside their doors, eight had shortcomings, often a camera view that took in too much of the street, or missing signs. At three, the regulator had to enforce switching off individual cameras.

What to check. Point cameras at what you need to protect, not at the street or at staff all day. Put up a sign that says who runs the cameras, why, on what legal basis and how long footage is kept; the North Rhine-Westphalia regulator says a camera symbol on its own is not enough. If another company runs the system for you, have a data processing contract with it.

5. Personal details shared where they do not belong

  • A taxi company in North Rhine-Westphalia (28 October 2025) ran two WhatsApp groups with all its drivers and used them to share photos of customers, ID cards and severe-disability cards, names, addresses, prescriptions, clinic names and appointment times, without asking the customers. A person removed from one group still had the photos, because WhatsApp had saved them to the phone's gallery. The company stopped after the regulator stepped in, and the regulator said it could also be fined.
  • Staines Health Group, a healthcare provider in England, received an ICO reprimand (16 December 2025). A terminally ill patient asked for five years of records to be sent to them to review. The practice sent 23 years of records straight to the patient's insurer instead. The ICO pointed to "a lack of written process for staff to follow" and no regular refresher training.
  • A landlord in North Rhine-Westphalia (11 November 2025) installed an app-controlled door entry system holding tenants' names and phone numbers without their consent. The regulator told the landlord to obtain consent from current tenants, ask new tenants in advance, and delete the data of anyone who did not agree.

Why it matters to you. A group chat is convenient and impossible to control. If you run your business through WhatsApp, the same question applies to you; our post on a yoga teacher with no website works through it.

Being small changes the amount, not the rule

Italy's regulator, the Garante, explains how it sets each fine. In these decisions it took the business's size or turnover into account, and fined it anyway:

  • Associazione Culturale "Quadrante Sud", a cultural association, €2,256 (6 August 2026), under the GDPR's rules on transparency and the information given to people (Articles 5(1)(a), 12 and 13) and section 157 of the Italian Privacy Code. The Garante noted its "modest overall revenues" and its nature as a non-profit (our translation).
  • Top Secret Investigazioni e Sicurezza s.r.l., €6,500 (23 July 2026), in a case the Garante files under email, information notices and private-sector employment, under the rules on transparency, collecting only what is needed, and keeping data no longer than necessary. The Garante set the amount with reference to the company's turnover.
  • Green Partner S.r.l.s., €15,300 (11 June 2026), which ran telemarketing as a data processor for an energy company. The Garante also took its turnover into account.

Fines of this size are common. Leontinoi Società Cooperativa Sociale, a social cooperative, was fined €1,000 (6 August 2026) for processing personal data unlawfully.

The Garante's decisions can be challenged in court; these are the decisions as it published them.

The other end of the scale

For context, the two largest UK fines in the part of the record we read: Reddit, Inc., £14,472,500 (23 February 2026), for infringing Articles 5(1)(a), 6, 8 and 35 of the UK GDPR; and Capita plc and Capita Pension Solutions Ltd, a combined £14m (15 October 2025), after "a cyber attack in April 2023 which saw hackers gain access to over 6m people's data", in the ICO's words. Those amounts are not the risk for a small business. The rules behind them are the same rules.

What this first look does not cover

  • It is a sample. Up to 50 entries per regulator, in each regulator's own order.
  • Spain: the 50 entries we read from its regulator were mostly closures and appeals. Its website's legal notice prohibits reproducing its content, so Spanish cases will appear in this series as counts with links.
  • Germany's state regulators mostly publish yearly totals, not individual cases.
  • The rest of the world comes next: the US, Canada, Brazil and Asia-Pacific.

What to check first

  1. Marketing calls: screen every UK number against the TPS and CTPS before calling.
  2. Marketing texts and emails: consent, or the soft opt-in for your own customers, with an opt-out in every message.
  3. Cookie banner: "Reject all" on the first screen; nothing that needs consent loads before a choice.
  4. Requests: answer requests to see or delete data within one month, and answer every letter from a regulator.
  5. Cameras: film only what you need, put up a sign that gives the required information (a camera symbol alone is not enough), and have a data processing contract with any company that runs the system for you.
  6. Group chats: no customer IDs, health details or photos in a WhatsApp group.

The relief of knowing what your setup does

Many of the failings above come down to not knowing what a banner, a call list or a group chat is actually doing. Dxtra is built so that you do.

  • A banner that respects "Reject". Dxtra's consent banner and server-side tag manager hold back analytics and advertising tags until the visitor agrees, and a refusal is applied, including the Global Privacy Control signal some browsers send.
  • A record of every choice. Each consent decision is logged with a timestamp, so you can show what a visitor agreed to and when.
  • Requests tracked, not lost. Requests to see or delete data are tracked from start to finish, with the deadline in view.
  • A privacy notice people can find. Dxtra writes your privacy notice and publishes it on your Transparency Center, on your website or, if you do not have one, at its own link and QR code.

Not sure where you stand? The free privacy scan checks which cookies and trackers load before consent and whether "Reject all" works. No website? The 30-second quiz is built for businesses that run on social media and messaging apps. Plans start at $10/month, with a 14-day money-back guarantee on the START plan.

Sources

Current as of 15 October 2026. Decisions are listed as each regulator published them, read on its own website on 9 and 10 October 2026. Amounts are as printed. Translations from French, Italian and German are ours. Some decisions may be under appeal; check the linked page before you rely on any of them.

United Kingdom: Information Commissioner's Office (ICO)

France: Commission nationale de l'informatique et des libertés (CNIL)

Italy: Garante per la protezione dei dati personali

Germany: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)

Law

Dxtra

This article is general information, not legal advice. It reports decisions as the UK's Information Commissioner's Office, France's CNIL, Italy's Garante and North Rhine-Westphalia's data protection regulator published them, and it is not a finding by Dxtra about any business. If you have received a letter from a regulator, take it to a qualified adviser.

Know what your setup does before a regulator asks

The businesses that come out of these decisions best are the ones that can show what their site, their call list and their records actually do. Run the free scan, or get started with Dxtra from $10/month.

Ready to get compliant?

Start your privacy program today — from $10/month.

Get StartedProduct Tour