Record GDPR fines in 2025 — what it means for the Czech market

A record year for GDPR enforcement

2025 saw GDPR fines totaling approximately €1.2 billion across the European Union. Supervisory authorities across member states significantly tightened enforcement.

The largest individual fines of 2025:

• TikTok — €530 million (DPC, Ireland) for illegal data transfers to China. The first major enforcement case for data transfers to Asian countries.
• Meta — €479 million (Spain) for unlawful processing of user data in its advertising ecosystem.
• Google — €200 million (CNIL, France) for Gmail ads without valid consent.
• SHEIN — €150 million (CNIL, France) for setting cookies without valid consent.

France led in total fine volume (€486.8M), followed by Spain and Italy.

The most significant violations came in these areas:

• Unlawful processing of personal data — without a valid legal basis, including missing or invalid consent.
• Insufficient transparency — incomplete or misleading information about processing in cookie banners and privacy policies.
• Violation of data subject rights — not respecting consent withdrawal, unavailable preference center.
• Illegal data transfers to third countries — using services without adequate safeguards.

What this means for Czech businesses

The Czech Office for Personal Data Protection (UOOU) follows the European trend. Audits focus on:

Cookie banners and consent. UOOU actively checks whether cookie banners meet valid consent requirements — equal-prominence buttons, granular choice, rejection without friction. Generic cookie banners with pre-ticked consent are a clear violation.

Processing without a legal basis. Firing analytics or marketing cookies before consent is the most common mistake. Automatic cookie blocking until consent is granted should be the standard.

Missing audit trail. During an inspection, you must prove consent was validly given — who, when, for what, which banner version. Without a transaction record, your consent is a claim, not proof.

Practical recommendations

1. Audit your cookie banner. Verify it meets all six conditions of valid GDPR consent.
2. Set up automatic blocking. No cookies before consent — Waulter handles this by default.
3. Maintain audit-ready logs. Transaction ID, timestamp, configuration version for every consent.
4. Update legal documents. Cookie policy and privacy notices must match the current configuration.

Record fines are not a reason to panic, but to act. Proper CMP setup is the first step to compliance — and with Waulter, it takes minutes, not weeks.