GDPR
Data & Research March 24, 2026 • Updated: 9 November 2026

Privacy & GDPR
statistics 2026

50+ verified data points on privacy, GDPR enforcement, and the impact on marketing. From regulatory fines and data breaches to how Europeans manage cookies and personal data. Each figure links to its source: DLA Piper, CMS Enforcement Tracker, Eurostat, CBS, IAB Europe and more.

€7.1B

in GDPR fines from 25 May 2018 to 10 January 2026

Source: DLA Piper, 2026

58.8%

of EU internet users refused use of their personal data for advertising (2025)

Source: Eurostat, 2026

76.9%

of EU internet users actively protected their personal data online (2025)

Source: Eurostat, 2026

Statistics overview

The General Data Protection Regulation (GDPR) has been in effect for eight years, and its impact on the global marketing landscape is profound. Regulators issued about €1.2 billion in fines in 2025 alone, more Europeans refuse to let their data be used for advertising, and marketers are looking for privacy-compliant ways to keep their campaigns measurable.

This page compiles 50+ verified statistics on privacy and GDPR, sourced from DLA Piper, the CMS Enforcement Tracker, the EDPB, Eurostat, CBS (Statistics Netherlands), IAB Europe and other organizations, each with a link to the source. Essential data for anyone working with digital advertising or any form of online marketing in a world of stricter privacy rules.

GDPR
Section 1

GDPR enforcement & fines

€7.1B

total GDPR fines, 25 May 2018 to 10 January 2026

DLA Piper, 2026

€1.2B

in GDPR fines issued in 2025 (approx.)

DLA Piper, 2026

443

data breach notifications per day in Europe (up 22% from 363)

DLA Piper, 2026

3,417

GDPR enforcement cases in 32 countries in the CMS tracker

CMS Enforcement Tracker, 2026

Largest GDPR fines ever (CMS Enforcement Tracker, 9 November 2026)

Meta Platforms Ireland (IE, 2023) €1.2B
Uber Technologies (NL, 2026) €825M
TikTok Technology (IE, 2025) €530M
Meta Platforms (IE, 2022) €405M
Google Ireland (IE, 2026) €403M
Meta Platforms Ireland (IE, 2023) €390M
TikTok (IE, 2023) €345M
LinkedIn (IE, 2024) €310M
Uber Technologies / Uber B.V. (NL, 2024) €290M
Meta Platforms Ireland (IE, 2022) €265M

Source: CMS Enforcement Tracker, 2026

Fines and enforcement in numbers

  • The largest GDPR fine ever is €1.2 billion, issued by Ireland's Data Protection Commission to Meta Platforms Ireland in 2023 (DLA Piper, 2026)
  • The largest fine of 2025 was €530 million, issued by the Irish DPC in April 2025 for international data transfers (DLA Piper, 2026)
  • Ireland leads the enforcement tables: the Irish DPC has issued €4.04 billion in fines since May 2018 (DLA Piper, 2026)
  • Daily breach notifications passed 400 for the first time since 2018 (period 28 January 2025 to 27 January 2026) (DLA Piper, 2026)
  • The CMS Enforcement Tracker counts €7.59 billion in GDPR fines as of 9 November 2026 (a different count and cut-off date than DLA Piper) (CMS Enforcement Tracker, 2026)
  • On 21 August 2026 the Dutch DPA fined Uber €824.99 million for unlawful automated decision-making, after complaints from 171 French drivers; Uber has appealed (EDPB, 2026)
  • In 2024 the Dutch DPA fined Uber €290 million for transferring drivers' data to the US (EDPB, 2024)
  • The Dutch DPA issued 4 fines in 2025 (6 in 2024) and 9 reprimands (7 in 2024), while complaints and signals rose 75% (Binnenlands Bestuur on the AP annual report, 2026)
  • Data breach notifications to the Dutch DPA rose from 37,839 in 2024 to 44,374 in 2025 (national and international) (Binnenlands Bestuur on the AP annual report, 2026)
COOKIES
Section 2

Cookie consent & management

38.9%

of EU internet users changed browser settings to prevent or limit cookies (2025)

Eurostat, 2025

56.2%

of Dutch internet users did the same, among the highest in the EU

Eurostat, 2025

21.2%

of EU internet users use software that limits tracking of their online activity

Eurostat, 2025

Internet users who changed browser settings to limit cookies (2025)

Finland 69.9%
69.9%
Netherlands 56.2%
56.2%
Germany 47.5%
47.5%
Ireland 47.4%
47.4%
Belgium 40.6%
40.6%
EU average 38.9%
38.9%
France 35.8%
35.8%
Spain 32.4%
32.4%
Italy 32.0%
32.0%

Source: Eurostat, 2025 (share of people aged 16-74 who used the internet in the last 3 months; this is not a consent rate)

  • Up from 36.5% in 2023: the share of EU internet users limiting cookies via their browser rose to 38.9% in 2025 (Eurostat, 2025)
  • 31.8% of Dutch internet users use anti-tracking software, against 21.2% across the EU (Eurostat, 2025)
  • On 38% of websites checked by the Dutch consumer association Consumentenbond, refusing cookies was harder than accepting them (Consumentenbond, 2025)
  • Browser share in the Netherlands (October 2026): Chrome 64.79%, Safari 17.2%, Edge 6.19%, Samsung Internet 4.33%, Firefox 3.7% (Statcounter, 2026)
  • Chrome keeps third-party cookies: on 22 April 2025 Google decided to keep its current approach to third-party cookie choice and not to roll out a standalone prompt (Google Privacy Sandbox, 2025)
DATA
Section 3

Impact of privacy on marketing

58.8%

of EU internet users refused use of personal data for advertising (2025)

Eurostat, 2026

68%

of European ad-industry respondents name cross-platform data access as the top addressability challenge

IAB Europe, 2025

58%

name privacy regulations as a challenge

IAB Europe, 2025

48%

name signal loss from cookie deprecation

IAB Europe, 2025

  • 53% of respondents see attribution without cookies as a measurement barrier, and 58% the lack of standardisation (79+ companies in 27+ European markets) (IAB Europe, 2025)
  • In the Netherlands, 68.4% of internet users refused use of their data for advertising in 2025, up from 64.8% in 2023 (Eurostat, 2025)
  • 66% of digital advertising in the Netherlands was set up cookieless in 2025, according to the VIA/Deloitte Digital Ad Spend study (Mediaonderzoek.nl on VIA/Deloitte, 2026)
  • 54% of Americans say personalized ads creep them out (US survey) (YouGov, 2025)
  • 75% of consumers will not buy from organizations they don't trust with their data (2,600+ consumers, 12 countries) (Cisco, 2024)

With consent choices and browser settings limiting what can be measured, first-party data strategies and robust tracking infrastructure are becoming table stakes, work typically led by a conversion optimisation agency that combines server-side tracking with consent-mode analytics. For Dutch companies, how to compare channels side by side on cost per lead: more on cost-per-lead marketing (in Dutch).

Section 4

Consumer privacy awareness

76.9%

of EU internet users protected their personal data online in 2025 (73.2% in 2023)

Eurostat, 2026

37.6%

read privacy policy statements before providing personal data

Eurostat, 2026

39.0%

checked that the website where they gave personal data was secure

Eurostat, 2026

11.7%

asked a website or search engine to access, update or delete their data

Eurostat, 2025

How EU internet users protected personal data online (2025)

Refused use of personal data for advertising 58.8%
Restricted or refused access to their location 56.2%
Limited access to social media profile or shared storage 46.0%
Checked that the website was secure 39.0%
Read the privacy policy first 37.6%
Asked to access, update or delete their data 11.7%

Source: Eurostat, 2025 (share of people aged 16-74 who used the internet in the last 3 months)

  • 53% of consumers say they are aware of their country's privacy laws, the first majority since the survey began in 2019 (Cisco, 2024)
  • 78% say organizations have a responsibility to use AI only in an ethical manner (Cisco, 2024)
  • In the Netherlands, 14.6% of internet users (12+) were very concerned and 60.1% a little concerned about their online activities being tracked (2023) (CBS, 2024)
  • 26.5% of Dutch people aged 15+ are very concerned about theft of their personal data and 25.8% about misuse of it (survey of 33,000+ people, 2024) (CBS, 2025)
  • Among Dutch people aged 75+, 60% protect personal information online, the lowest of all age groups (2023) (CBS, 2024)
1ST
Section 5

Privacy-first marketing trends

50%+

of European ad-industry respondents use or test data clean rooms and Unified ID solutions

IAB Europe, 2025

46%

use contextual data

IAB Europe, 2025

66%

of digital advertising in the Netherlands was set up cookieless in 2025

Mediaonderzoek.nl on VIA/Deloitte, 2026

Privacy-first solutions in use or being tested (Europe, 2025)

Data clean rooms and Unified ID 50%+
50%+
Contextual data 46%
46%
Seller-defined audiences 38%
38%
Customer match 36%
36%

Source: IAB Europe, 2025

  • Over 70% of respondents report high familiarity with privacy-first measurement (IAB Europe, 2025)
  • Privacy Sandbox wound down: on 17 October 2025 Google retired Topics, Protected Audience, the Attribution Reporting API and other Privacy Sandbox technologies (Google Privacy Sandbox, 2025)
  • What stays: Google continues to support CHIPS and FedCM and maintains Private State Tokens (Google Privacy Sandbox, 2025)

Putting these privacy-first measurement stacks in place is exactly the kind of work a modern online marketing agency should deliver end-to-end, from consent mode to server-side GTM.

EU
Section 6

Global & regional comparison

92.6%

of internet users in Finland protected their personal data, the highest in the EU (2025)

Eurostat, 2026

91.2%

in the Netherlands, second highest in the EU

Eurostat, 2026

56.0%

in Romania, the lowest in the EU

Eurostat, 2026

Internet users who refused use of their data for advertising (2025)

Finland 79.5%
Spain 72.9%
Italy 70.0%
Ireland 68.6%
Netherlands 68.4%
France 64.0%
EU average 58.8%
Belgium 53.0%
Germany 49.3%

Source: Eurostat, 2025 (share of people aged 16-74 who used the internet in the last 3 months)

  • After Finland and the Netherlands, Czechia (90.3%) has the highest share of internet users protecting their data; Slovenia (57.4%) and Bulgaria (62.0%) are among the lowest (Eurostat, 2026)
  • In 2023 the Netherlands already had the highest share in the EU (people 16-75): 92% against 67% for the EU-27 (CBS, 2024)
  • Ireland's DPC has issued €4.04 billion in GDPR fines since 2018, more than any other authority (DLA Piper, 2026)
  • According to PPC Land, the Dutch DPA's four fines on Uber (2018 to 2026) add up to about €1.13 billion (PPC Land, 2026)
  • The ePrivacy Regulation, proposed in 2017 to update the 2002 ePrivacy Directive, was withdrawn by the European Commission in 2025 (EDRi, 2025)
2030
Section 7

Future: cookieless & AI

2 Aug 2026

the EU AI Act applies, including its transparency rules

European Commission, 2026

2 Dec 2027

high-risk AI rules apply to sensitive use cases (Annex III)

European Commission, 2026

2 Aug 2028

high-risk rules for AI in regulated products (Annex I)

European Commission, 2026

Key dates for privacy and marketing

  • 2 February 2025: AI Act bans on prohibited AI practices and AI literacy obligations apply (European Commission, 2026)
  • 2025: the European Commission withdraws the ePrivacy Regulation proposal; the 2002 ePrivacy Directive remains the basis for cookie rules (EDRi, 2025)
  • 22 April 2025: Google keeps third-party cookies in Chrome, with no standalone cookie prompt (Google Privacy Sandbox, 2025)
  • 2 August 2025: obligations for general-purpose AI (GPAI) models apply (European Commission, 2026)
  • 17 October 2025: Google retires Topics, Protected Audience and the Attribution Reporting API (Google Privacy Sandbox, 2025)
  • 27 July 2026: the AI Omnibus enters into force, moving the high-risk deadlines to December 2027 and August 2028 (European Commission, 2026)
Summary

Key takeaways

1

Enforcement keeps growing

€7.1 billion in GDPR fines since 2018 (DLA Piper), about €1.2 billion in 2025, and 443 breach notifications per day.

2

The Netherlands has entered the top

The Dutch DPA fined Uber €824.99 million in August 2026, the second-largest GDPR fine on record (under appeal).

3

Europeans say no to ad tracking

58.8% of EU internet users refused use of their data for advertising in 2025; in the Netherlands 68.4%.

4

Dutch users are privacy-savvy

91.2% of Dutch internet users protect their personal data online, second only to Finland (92.6%).

5

Cookies are not going away, Privacy Sandbox is

Chrome keeps third-party cookies (April 2025), while Google retired Topics and Protected Audience (October 2025).

6

Privacy-first tools are mainstream

Over 50% of European ad companies use or test clean rooms and Unified ID; 46% use contextual data.

Methodology & sources

Every figure on this page links to the source we opened when checking it (last check: 9 November 2026). Figures we could not trace to a source were removed. International figures are labeled as such; Dutch figures come from CBS, Eurostat and reporting on the Dutch DPA (Autoriteit Persoonsgegevens) annual report. Main sources:

Disclaimer: This is a statistics page, not legal advice. Fine totals differ between sources because of different counting methods and cut-off dates; we always state the source and date. Some fines are under appeal.

FAQ

Frequently asked questions

How much have GDPR fines totaled since 2018?

According to DLA Piper, European regulators issued €7.1 billion in GDPR fines between 25 May 2018 and 10 January 2026, of which about €1.2 billion in 2025. The CMS Enforcement Tracker counts €7.59 billion across 3,417 cases as of 9 November 2026. Ireland leads with €4.04 billion, including the largest fine ever (€1.2 billion for Meta in 2023). In August 2026 the Dutch DPA fined Uber €824.99 million, the second-largest fine in the tracker; Uber has appealed.

What is the average cookie consent rate in Europe?

There is no official EU-wide statistic for cookie consent rates, and we found no public benchmark we could verify. What Eurostat does measure: in 2025, 38.9% of EU internet users changed their browser settings to prevent or limit cookies (Netherlands 56.2%), and 58.8% refused use of their personal data for advertising (Netherlands 68.4%). A Dutch consumer study found that on 38% of websites refusing cookies was harder than accepting them.

How does GDPR affect marketing effectiveness?

In an IAB Europe study, 58% of ad-industry respondents name privacy regulations as an addressability challenge, 48% name signal loss from cookies and 53% see attribution without cookies as a measurement barrier. Advertisers, for example on Google Ads, increasingly rely on clean rooms and Unified ID (over 50% use or test them), contextual data (46%) and customer match (36%). In the Netherlands, 66% of digital advertising was set up cookieless in 2025 (VIA/Deloitte).

GDPR
Ready to get started?

Privacy-first marketing advice

At Searchlab, we help businesses achieve maximum marketing results within the boundaries of GDPR. Server-side tracking, first-party data, and AI-powered optimization.

Get in touch What we do
Ruud ten Have

Compiled by

Ruud ten Have

Ruud is a digital marketer with 10+ years of experience in online advertising and AI implementation. At Searchlab, he combines strategic thinking with hands-on AI tooling to deliver measurable, privacy-compliant results for businesses.

About Searchlab

We don’t just collect this data, we apply it daily as an AI-first marketing agency in Amsterdam. Dutch businesses can explore our online marketing uitbesteden services.