Authority intelligence
How authorities actually enforce
11 authority profiles — enforcement style, fine-to-max ratios, investigation timelines, and leniency culture. Data-backed, not subjective.
DG
DG COMP — European Union
DG Competition
Enforcement style
Very aggressive
Fine range
80–100%
Timeline
2–7 years
Key case
Google Android €4.34B (2018)
Domains
EU CompetitionDMA
Priority: Big tech · Pharma · Financial services · Automotive
Names & publishesCriminal referral risk
DPC
DPC — Ireland
Data Protection Commission
Enforcement style
Historically slow / lenient
Fine range
15–40%
Timeline
2–4 years
Key case
Meta €1.2B (2023)
Domains
GDPRePrivacy
Priority: Big tech — Meta · Google · Apple · LinkedIn · TikTok
Names & publishes
CNIL
CNIL — France
Commission Nationale de l'Informatique et des Libertés
Enforcement style
Aggressive — expedited procedure
Fine range
25–50%
Timeline
6–18 months
Key case
Google €150M cookie (2022)
Domains
GDPRePrivacyLIL
Priority: AdTech · Cookies · AI · HR processing
Names & publishesCriminal referral risk
FTC
FTC — United States
Federal Trade Commission
Enforcement style
Increasing under recent chairs
Fine range
N/A — consent orders + civil penalties
Timeline
12–36 months
Key case
Meta $5B consent order (2019)
Domains
FTC Act §5COPPACCPA
Priority: Health data · Children's data · AI claims · Data brokers
Names & publishes
ICO
ICO — United Kingdom
Information Commissioner's Office
Enforcement style
Increasing aggression post-2022
Fine range
10–25%
Timeline
6–24 months
Key case
British Airways £20M (2020)
Domains
UK GDPRDPA 2018PECR
Priority: AdTech · Public sector · Nuisance calls · Health
Names & publishes
BfDI
BfDI / LDAs — Germany
Bundesbeauftragte / State DPAs (16)
Enforcement style
Methodical — state DPAs vary
Fine range
10–30%
Timeline
12–24 months
Key case
H&M €35.3M employee surveillance (2020)
Domains
GDPRBDSGTTDSG
Priority: Employers · HR data · Cookies · Public sector
HHS
HHS OCR — United States
Department of Health & Human Services — OCR
Enforcement style
Increasing on tracking pixels
Fine range
2–5%
Timeline
6–24 months
Key case
Advocate Aurora $12.9M pixel (2024)
Domains
HIPAA Privacy RuleHIPAA Security Rule
Priority: Hospitals · Health apps · Insurers · Tracking pixels
Names & publishesCriminal referral risk
CAC
CAC — China
Cyberspace Administration of China
Enforcement style
Very aggressive — national security focus
Fine range
Varies enormously
Timeline
3–18 months
Key case
Didi ¥8.026B (~€1.05B) (2022)
Domains
PIPLDSLCybersecurity LawAI Generative Rules
Priority: Tech platforms · Cross-border data · Social media · AI
Criminal referral risk
PDPC
PDPC — Singapore
Personal Data Protection Commission
Enforcement style
Proportionate — guidance-first
Fine range
15–35%
Timeline
3–12 months
Key case
SingHealth S$250K (2019)
Domains
PDPA
Priority: Financial · Healthcare · Tech platforms
Names & publishes
OAIC
OAIC — Australia
Office of the Australian Information Commissioner
Enforcement style
Increasingly aggressive post-2022
Fine range
20–40%
Timeline
12–36 months
Key case
Facebook Cambridge Analytica AUD $20M (2023)
Domains
Privacy Act 1988SOCI Act
Priority: Financial services · Health · Telco · Data brokers
Names & publishesCriminal referral risk
ANPD
ANPD — Brazil
Autoridade Nacional de Proteção de Dados
Enforcement style
Maturing — building enforcement record
Fine range
5–15%
Timeline
6–24 months
Key case
Serasa Experian R$14.4M (2024)
Domains
LGPD
Priority: E-commerce · Financial · Health data
Names & publishes
Enforcement style 1–5: 1 = rare action, 5 = aggressive. Based on decision frequency, fine-to-max ratio, investigation speed, and leniency culture.