What's the Maximum GDPR Fine for a Marketing Consent Violation?

Up to €20 million, or 4% of the violating company's total worldwide annual turnover from the preceding financial year, whichever amount is higher. That ceiling applies under GDPR Article 83(5), which covers violations of the regulation's core processing principles, including the consent and lawful-basis rules in Articles 5, 6, 7, and 9 that govern most marketing data use.

Why Marketing Consent Falls in the Higher Tier

GDPR sets two fine tiers. Article 83(4) caps lesser violations, like failing to maintain proper records, at €10 million or 2% of worldwide turnover. Article 83(5) covers the more serious category — violations of the basic principles for processing, including consent (Article 7), the lawful bases for processing (Article 6), and special category data (Article 9) — at the higher €20 million or 4% ceiling. Most marketing consent failures, such as emailing a list without valid consent or tracking users for ad targeting without a lawful basis, fall squarely under this higher tier, not the lower one.

Turnover Means Group Turnover, Not Subsidiary Turnover

A 2025 Court of Justice of the European Union ruling confirmed that when the percentage-based calculation applies, regulators use the turnover of the entire corporate group, not just the specific subsidiary that committed the violation. A marketing-focused subsidiary with modest standalone revenue can still face a fine calculated against its parent company's full global turnover.

Maximum Caps Are Not Actual Fines

Regulators rarely impose the maximum. Article 83(2) lists the factors that determine the actual amount within the cap: the nature, gravity, and duration of the violation, the number of people affected, whether it was intentional or negligent, and what mitigation steps the company took afterward. The €20 million/4% figure is a ceiling, not a typical outcome.

The UK Version Uses a Different Fixed Amount

Under UK GDPR, the equivalent top-tier fixed amount is £17.5 million rather than €20 million, with the same 4% of worldwide turnover alternative and the same "whichever is higher" structure.

Which Marketing Activities Carry This Exposure

The highest-risk activities under this tier are the ones built directly on a consent or lawful-basis claim: purchased or scraped email lists sent without documented opt-in, ad-tracking pixels that process personal data without a valid lawful basis, and any targeting built on special category data, such as health or sexual orientation inferences, without explicit consent under Article 9. Each of these maps directly to Article 83(5) rather than the lower tier, because they involve the core principles the higher cap exists to enforce.

Bottom Line

When sizing the real compliance risk of marketing data practices — unverified email consent, ad-tracking pixels without a lawful basis, biometric or special-category data used for targeting — treat Article 83(5)'s €20 million/4% ceiling as the exposure, and document the specific lawful basis behind every marketing use of personal data so you're not relying on a weak default like "legitimate interest" for consent-dependent activity.

Sources: EU GDPR Article 83, "General Conditions for Imposing Administrative Fines" (consolidated text); UK GDPR Article 83 fixed penalty amount (legislation.gov.uk); 2025 CJEU ruling on group turnover calculation for Article 83 fines.