Meta accounts for 91% of $26 billion social media privacy penalties since 2020
Surfshark says top social networks have incurred over $26 billion in privacy penalties since 2020, with Meta at 91%.
Meta's two platforms accounted for $23.7 billion of the global total. Facebook alone accumulated $14.3 billion, while Instagram accounted for $9.4 billion. TikTok placed a distant third with $1.6 billion in fines across global jurisdictions, making Meta's combined penalty total more than 14 times TikTok's figure.
Other platforms also faced regulatory action. LinkedIn accrued $360 million, YouTube $222 million, and X, formerly Twitter, $151 million. Snapchat recorded $35 million, Reddit $19 million, and Discord $928,000. Pinterest was the only platform in the study with zero qualifying privacy penalties.
US authorities imposed $20.9 billion, about 80% of the global fines examined. The single largest penalty was a $17.1 billion US settlement involving Facebook and Instagram over allegations that inadequate safeguards exposed minors to deliberately addictive product features. American authorities also levied $3.69 billion strictly for data-processing offenses, led by Facebook at $2.9 billion, TikTok at $593 million and X at $150 million. TikTok received an additional independent $100 million penalty in 2026 over inadequate security safeguards.
European regulators imposed $5.16 billion under the General Data Protection Regulation and national frameworks. Ireland issued $4.87 billion, or 94% of Europe's total, largely because many technology companies maintain their regional headquarters in Dublin. France followed with $245 million and the UK with $36 million.
Europe's two heaviest individual fines concerned unauthorized international data transfers. Facebook received a $1.39 billion fine for transferring EU user data to US servers, and TikTok was fined $615 million for transferring European user data to China. European regulators also penalized platforms $1.22 billion for unlawful data processing, $1.09 billion for data breach incidents and $594 million for insufficient technical security safeguards.
Regulators in South Korea and Australia added further penalties, issuing $62.4 million and about $50.5 million, respectively. The study's figures cover fines and settlements imposed by authorities in multiple jurisdictions, including the $17.1 billion US settlement and the GDPR penalties in Europe.