The GDPR record: eight years on

The whole architecture of contractual and operational steps that this site recommends rests on an unspoken assumption: that a vendor confronted with a regulatory obligation will rationally negotiate over adjustments to its offering, rather than choose another path — pay the fine and continue, litigate, withdraw products, or in the extreme leave the market. Historical evidence suggests this assumption holds only conditionally. The GDPR is the most extensive natural experiment we have.

The numbers

The GDPR came into force in May 2018. The cumulative fine volume to April 2026 exceeds €7.1 billion. But the distribution is uneven and instructive.

Approximately 60 % of the total fine volume was imposed after January 2023 — meaning supervisory authorities took four to five years to build effective enforcement capacity. That alone is information: regulation has a ramp-up period, during which regulated entities rationally wait and see.

What changed, and what did not

What changed: the large technology players adjusted their consent mechanisms, data practices, and transparency. Superficially. Meta has been fined more than €2.5 billion in cumulative GDPR penalties (the headline being a single €1.2 bn fine from the Irish DPC in May 2023 for transatlantic data transfers, with most penalties under appeal at any given time) and adapted; but its business model — collection, aggregation, and monetisation of user data — remained intact at its core. The form changed (consent banners, legal texts, local DPOs); the substance (business model) did not.

For smaller firms and the public sector, the GDPR had a deeper impact — but there the problem was different (not monopoly providers, but underinvestment in security and process).

The key lesson for this site's argument

The GDPR shows that regulation can compel formal change, but it cannot compel a monopoly provider to change its business model when there is no alternative the customer can switch to.

A fine is an operating cost. A customer departing is a strategic threat. So far the EU has been able to impose fines but has not been able to create the conditions in which customer departure is a real possibility. That is the gap that the alternatives section and the partnerships section try to close.

The next chapter looks at whether the DMA — a more ambitious instrument — has changed this dynamic in its first 18 months.