Call for bigger teeth to bite big tech as $8bn fines fail

Regulatory penalties against US tech giants are in danger of being treated as the “cost of doing business”, with Alphabet, Apple, Meta, and Amazon able to pay off last year’s combined $7.8bn (£6.2bn) in fines for privacy and competition violations in just 28 days.

So says a new analysis by privacy specialist Proton, which suggests that despite a wave of high-profile crackdowns, financial sanctions are failing to serve as an effective deterrent for the world’s most powerful companies.

The study points out that, when measured against their “free cash flow” — the surplus capital generated after expenses — it would take the four companies exactly 28 days and 48 minutes to pay off the penalties concurrently.

And, while the report shows total fines in 2025 were 160% higher than in 2022, they actually dipped by 7% compared to 2024. Proton warns that this does not indicate improved compliance, but rather that regulators are struggling to keep pace with the explosive financial growth of the sector.

Alphabet (Google) topped the list with $4.2bn in penalties, yet could settle its bill in approximately three weeks; meanwhile Amazon saw regulatory penalties skyrocket by 4,000% to $2.5bn, primarily over Prime subscription practices, yet could clear the debt in 86 days.

Apple accumulated $851m across multiple rulings, including a €500m EU fine for App Store restrictions, however, this represents just over three days of cash flow, while Meta’s $228m in fines would take just over one day and two hours to pay off.

Proton public policy manager Romain Digneaux suggested that without stricter enforcement, these patterns will continue indefinitely as big tech treats fines just “as a cost of doing business”.

He added: “Clearly, fines are not working. If they were, after years of slapping them down with one enforcement action after another, we’d see some sort of change. Regulators must be given teeth big enough to make big tech feel some real pain for breaking the rules.”

The report adds weight to growing calls for authorities to move beyond monetary penalties. In the EU, regulators have already threatened more radical measures under the Digital Markets Act, including structural separations and bans on future acquisitions for repeat offenders.

Without a change in enforcement strategy, user privacy will remain a secondary concern to corporate profit margins, the report warns.