The first year of GDPR saw the carrot; next comes the stick

GDPR was created to enshrine Article 8 of the European Convention on Human Rights in terms of protecting personal data and now means it doesn't matter where the data was collected or processed – EU citizens must properly consent to how their data is collected and used by advertisers.

Google became the first major company to receive a fine after French regulator CNIL found it had improperly obtained consent from people using its (many) apps in January. Companies face a fine of up to 4% of their annual turnover.

This €50m (£43.5m) fine makes up nearly all of the total fines levied under GDPR in the first nine months, according to figures from the European Data Protection Board. There were 206,326 cases reported over this period – nearly half of which (95,000) have been complaints to data controllers, while 65,000 were initiated by data controllers themselves.

However, in the days preceding the first anniversary of GDPR on 25 May, news broke that