Should privacy fines be tied to a technology company’s global revenue?

If revenue-linked fines deterred, Meta would have stopped by now. ould have stopped by now. The company has collected some of the largest GDPR penalties on record, including the 1.2 billion euro fine in 2023, and the violations kept coming, because for a firm of that size even a record fine is a quarterly event, not an existential one. The GDPR enforcement tracker shows the same names recurring, which is exactly what deterrence theory predicts when the punishment is certain but affordable: it becomes a line item. Meanwhile the headline numbers let politicians claim victory while the underlying data practices continue. A fine that does not change behavior is not a deterrent, it is a licensing fee with better PR. Real deterrence would mean structural remedies, like forced deletion or bans on processing, not a bigger number on the same invoice. GDPR enforcement tracker