Regulators spent the third quarter of 2026 returning to familiar ground, with AML, data protection, governance and supervision failures behind many of the largest penalties. US authorities issued the most fines above $1m, but European data watchdogs delivered the two largest sanctions, against Uber and Google.

According to Corlytics, between July and September, regulators issued 25 fines of $1m or more, worth roughly $2bn in total. The US led on volume, while Italy’s data regulator and Australia’s financial regulator issued five each.

The UK recorded three, the Netherlands two, and South Africa, Spain, Malaysia and Ireland one apiece. AML and data failures made up most of the sanctions, and just two data fines accounted for 71% of the quarter’s total value.

The Dutch Autoriteit Persoonsgegevens fined Uber $955m (€825m) under Article 22 of GDPR, which bans decisions based solely on automated processing. Between 2018 and 2022, drivers suspected of fraud or with many low ratings had their accounts suspended without human review. Separately, the Irish Data Protection Commission fined Google $457m (€403m) after a six-year investigation into location tracking.

BEUC director general Agustín Reyna said, “Location data can be incredibly sensitive because it reveals a lot about our personal lives: where our children go to school, how many times someone visited a hospital, or even a place of prayer. This is incredibly invasive, violates fundamental rights to privacy and breaches the GDPR.”

Italy’s GPDP was the most active data regulator, penalising Hera Comm, TIM, BBVA and IQVIA. The Hera Comm case involved a flawed creditworthiness algorithm, a timely warning as the Financial Stability Board and the FCA push for stronger AI data governance and output monitoring.

Source link