• Big Tech was hit with $3.5B fines over three years, Surfshark found
• Many were fined for using personal data unlawfully
• Enforceability remains a key challenge

Major tech companies have already been hit by fines totalling $3.5 billion for using vast amounts of users’ personal data to train their AI models, raising hopes that the days of AI operating in a regulatory vacuum might be coming to an end.

The figures come from Surfshark, one of the best VPNs on the market, which recently analysed 10 AI-related sanctions imposed on the usual suspects — Anthropic, Meta, Google, Clearview, Apple, Amazon, and OpenAI — between 2022 and 2026.

Disturbingly, nine out of ten fines were imposed for using users’ personal data — including biometric data, copyright-protected content, facial images, and children's voice recordings — without user consent or legal authorisation.

AI violations: which company misused our data the most?

According to Surfshark’s study, Clearview AI was the first, in 2022, to be fined a total of around $46 million for collecting facial images for its facial recognition database.

But the pace picked up in 2024, with five new separate fines imposed on Google, OpenAI, Meta, Clearview, and Amazon.

The size of the fines has also increased substantially, signalling a positive shift from regulatory warnings to severe financial consequences. In 2024, Meta was fined $1.4 billion for collecting users’ biometric data without consent, followed by Anthropic in 2025 with a record $1.5 billion for training its AI models using pirated books.

On a different note, the $250 million fine imposed on Apple in 2026 for AI misleading marketing practices might signal that current AI advertisement tactics might also soon become a thing of the past.

"This could be only the beginning," says Dr. Luis Costa, research lead at Surfshark. "The overarching trend suggests that accountability is catching up with innovation, and the industry must re-evaluate both how it builds AI and how it markets it."

While regulations and authorities seem to be starting to catch up and match their punishments with Big Tech's wrongdoings, the findings continue to raise serious questions about the risks users face when using these AI platforms.

"Firstly, the scale of unauthorised data collection is unprecedented: 90 per cent of AI-related fines imposed since 2022 relate to the use of data without the necessary consent," Costa explains.

"Second, this harvesting often targets highly sensitive, unchangeable data, as seen in Meta’s $1.4 billion biometric settlement and Amazon’s fine over children’s voice recordings," he adds.

It also remains alarming that many companies fail to adequately inform the public about how their sensitive data is used, leaving consumers oblivious to the fact that their personal information is permanently baked into commercial AI models.

Better enforceability is needed

Additionally, while these fines may seem exorbitant, it is worrying that the financial impact of such punishments rarely acts as a deterrent to these large technology companies, whose market capitalisation runs into the hundreds of billions of dollars.

In its research, Proton previously found that the $7.8 billion in privacy and competition fines imposed on Big Tech in 2025 could be collectively paid by these firms in less than a month.

However, Costa argues that the issue is more complex and regulators might be working toward targeted changes. "First, regulators are escalating the financial stakes, shifting toward massive penalties like Anthropic's $1.5 billion and Meta's $1.4 billion settlements."

Additionally, a major challenge right now is actually enforceability — particularly as some companies have already been exploiting loopholes to avoid paying fines. Clearview AI, for example, managed to avoid paying $105 million in fines imposed by four different European regulatory authorities by arguing that it did not fall within European jurisdiction.

"Even if these early fines are manageable for tech giants, their real value lies in establishing the firm legal precedents that will govern how AI must operate in the future," Costa concludes.