General Data Protection Regulation

The EU imposes fines on Big Tech companies, such as Google’s €890 million penalty for breaching the Digital Markets Act and Alibaba’s €550 million fine for illegal product sales. Fines under competition law use a percentage of annual sales, while regulatory laws like the DMA aim to incentivize compliance with lower penalties.

The EU Court of Justice ruled that athletes caught doping can be named online to deter violations and protect fair competition, but automatic publication is not allowed. The court emphasized case-by-case decisions based on factors like an athlete's profile and the violation's severity, rejecting a one-size-fits-all approach. Athletes may challenge mandatory disclosure through data protection authorities.

The EU's highest court ruled that selling access to criminal records does not qualify as journalism, rejecting a claim by Legal Newsdesk Sweden that its Lexbase database is protected by free-expression exemptions. The court emphasized that GDPR privacy protections cannot be overridden by constitutional free-speech claims, even for entities with publication certificates.

Meta CEO Mark Zuckerberg reportedly defended monitoring employees' computer activity to train AI, citing the need to win the AI race. The leaked audio, shared by worker advocacy group More Perfect Union, claims he emphasized collecting keystrokes and screenshots to improve AI capabilities. Meta confirmed AI-focused monitoring via its Model Capability Initiative but denied using data for surveillance or performance tracking.

U.S. states issued $3.45 billion in privacy-related fines to companies in 2025, driven by stronger state laws, interstate enforcement partnerships, and focus on AI's privacy impacts. California's Privacy Protection Agency enforced the California Consumer Privacy Act (CCPA) across diverse industries, signaling a shift from dormant enforcement to aggressive penalties.