The average data breach now costs $4.99 million, a record in IBM’s annual study, and only a year ago the figure was falling. AI risk grew alongside it. Security incidents involving shadow AI, meaning staff using AI tools their company never approved, more than doubled in a year, and 68% of breached organizations still had no AI governance in place.
European regulators kept fining: GDPR penalties passed €7.1 billion in total, even as the EU pushed its high-risk AI rules back by more than a year. In the US, the record for a CCPA penalty was broken twice in three months. And in Pew’s most recent full survey, from May 2023, 81% of US adults were concerned about how companies use their data, while 67% said they understood little or nothing about what happens to it.
Below are 50+ data privacy statistics for 2026, grouped by breaches, AI, law and fines, consumers, business and the privacy technology market. Where a newer edition of a study has replaced an older figure, both numbers are shown so you can see the direction of travel.
On this page
Key Data Privacy Statistics for 2026
- The global average cost of a data breach reached $4.99 million in 2026, up 12% from $4.44 million in 2025 (IBM Cost of a Data Breach Report 2026).
- The US average hit a record $11.50 million, up from $10.22 million (IBM, 2026).
- Security incidents involving shadow AI rose to 43% of breached organizations, from 20% a year earlier (IBM, 2026).
- 68% of breached organizations lacked AI governance to manage AI or detect shadow AI, up from 63% (IBM, 2026).
- Ransomware was involved in 48% of breaches, and third parties in 48% (Verizon 2026 Data Breach Investigations Report).
- The US recorded a record 3,321 data compromises in 2025 (Identity Theft Resource Center).
- Total GDPR fines since May 2018 reached €7.1 billion by January 2026 (DLA Piper).
- 81% of US adults were concerned about how companies use the data they collect, in Pew’s May 2023 survey (Pew Research Center).
- 90% of organizations have expanded their privacy programs because of AI (Cisco 2026 Data and Privacy Benchmark Study).
Data Breach Statistics
IBM and the Ponemon Institute studied 602 organizations breached between March 2025 and February 2026, across 17 industries and 16 countries or regions. The 2026 report reverses the two headline gains of 2025: breach costs rose again, and breaches took longer to identify and contain.
Cost of a Data Breach in 2026
- The global average breach cost is $4.99 million, a 12% rise and a record. In 2025 it had dipped 9% to $4.44 million, and in 2024 it was $4.88 million (IBM Cost of a Data Breach Report 2026).
- US breaches cost $11.50 million on average, more than double the global figure. Every one of the 16 countries and regions IBM tracks recorded a higher average cost than in 2025.
- Healthcare is still the most expensive industry at $6.64 million per breach, though that is down 10.5% from $7.42 million. Financial services came second at $6.29 million.
- Customer personally identifiable information (PII) was stolen or compromised in 52% of breaches, the most common data type, at $192 per record.
- Organizations that used AI and automation extensively in security saved $1.93 million per breach and shortened breach times by 65 days, compared with those that used none.
An older savings figure still circulates: $2.22 million, from IBM’s 2024 report. It measured something narrower, the savings for organizations using security AI and automation extensively in prevention work, against a 2024 average breach cost of $4.88 million. The 2026 figure covers extensive use across security operations as a whole, so the two are not a like-for-like trend.
How Long Breaches Take to Find and Contain
- The average breach took 247 days to identify and contain in 2026: 183 days to identify and 64 to contain (IBM).
- That is a 2.5% increase, and it ended a five-year decline. The 2025 figure was 241 days (181 plus 60).
- In IBM’s 2024 report the split was 194 days to identify and 64 days to contain, 258 days in total.
- Breaches that an organization’s own security team found were identified and contained in 209 days on average.
How Attackers Get In
Verizon’s 2026 Data Breach Investigations Report examined more than 31,000 security incidents, of which more than 22,000 were confirmed breaches, across 145 countries. It is the largest breach sample in the report’s 19 editions.
- Exploitation of software vulnerabilities is now the most common way in, at 31% of breaches, up from 20% (Verizon DBIR 2026).
- Credential abuse fell to 13% from 22%. Part of that drop comes from Verizon adding pretexting as a separate initial access category this year.
- Ransomware appeared in 48% of breaches, up from 44%, but 69% of ransomware victims did not pay. The median ransom paid was $139,875.
- Breaches involving a third party rose 60% in a year to 48% of the total. In the 2025 report the share was 30%.
- The human element was present in 62% of breaches, against 60% the year before.
Attackers also move faster once inside. CrowdStrike’s 2026 Global Threat Report puts the average eCrime breakout time, the gap between first access and moving to other systems, at 29 minutes in 2025, with the fastest observed at 27 seconds. Two years earlier, CrowdStrike’s 2024 report gave 62 minutes and 2 minutes 7 seconds for 2023, alongside a 60% year-over-year rise in interactive intrusion campaigns. Technology was the most targeted sector for those intrusions in 2023, followed by telecommunications and financial services.
US Data Breach Numbers
- The Identity Theft Resource Center tracked 3,322 US data compromises in 2025 in its January 2026 annual report, up from 3,152 in 2024 and a new high (ITRC 2025 Annual Data Breach Report).
- That is a 79% increase over five years, from 1,859 compromises in 2021.
- Victim notices fell 79% in a year, from 1.36 billion in 2024 to 278.8 million in 2025, as attackers moved away from the mega-breaches that inflated 2024. ITRC’s July 2026 update revised the 2025 totals to 3,321 compromises and 297.5 million notices.
- The mega-breaches came back in 2026. ITRC counted 1,803 compromises and an estimated 471.2 million victim notices in the first half of the year alone, with one compromise at Instructure’s Canvas education platform accounting for about 275 million. ITRC notes that the Canvas figure counts all reported victims and that a US-only count has not been confirmed (ITRC H1 2026).
AI and Data Privacy Statistics
AI now sits on both sides of the privacy problem. Employees feed company data into AI tools, attackers use AI to break in, and the AI systems themselves have become targets.
Shadow AI and AI Governance
- Security incidents involving shadow AI more than doubled, to 43% of breached organizations from 20% (IBM, 2026).
- Those breaches cost $5.39 million on average, up from $4.63 million the year before, and led to data loss or compromise in 49% of cases.
- 68% of breached organizations had no AI governance to manage AI or detect shadow AI. A third (33%) said they were developing governance policies, up from 22%.
- Among organizations that reported an AI-related breach, 92% lacked proper AI access controls. In 2025 the figure was 97%.
AI-Driven Attacks
- More than one in four organizations that suffered a malicious attack said it was AI-driven, a 56% increase on the previous year. Deepfake impersonation and AI-enabled malware were the most common (IBM, 2026).
- A breach involving an AI model inversion attack cost $6.07 million on average, and one involving prompt injection $5.89 million.
- AI-enabled adversaries increased their operations by 89% year over year, and attackers injected malicious prompts into legitimate generative AI tools at more than 90 organizations (CrowdStrike, 2026).
- In 2024, 45% of security leaders expected generative AI to help attackers more, while 43% expected it to favor defenders, and 44% ranked generative AI as a top initiative (Splunk State of Security 2024).
Employees and Generative AI at Work
- 45% of employees are now regular AI users on their corporate devices, authorized or not, up from 15% a year earlier (Verizon DBIR 2026).
- 67% of those users reach AI services through non-corporate accounts on work devices.
- In Cisco’s 2025 benchmark, 64% of respondents worried about inadvertently sharing sensitive information publicly or with competitors, yet nearly half admitted entering employee or non-public data into generative AI tools (Cisco, 2025).
- A year earlier, 48% had entered non-public company information and 45% had entered employee information into generative AI apps, and 27% of organizations had banned generative AI at least temporarily (Cisco 2024 Data Privacy Benchmark Study).
- In the full 2024 study, 79% said they were getting significant or very significant value from generative AI, 69% worried it could hurt their company’s legal rights and intellectual property, and 92% said it needs new techniques to manage data and risk.
Gartner expects the problem to change shape again. In July 2026 it predicted that by 2029 most privacy incidents will come from AI-generated inferences about people, rather than from direct exposure of personal data (Gartner).
For the security side of this market, see these AI cybersecurity statistics and the top AI cybersecurity startups.
GDPR Fines and Data Privacy Law Statistics
GDPR Fines to Date
- Total GDPR fines reached €7.1 billion between May 2018 and 10 January 2026, up from €5.88 billion a year earlier (DLA Piper GDPR Fines and Data Breach Survey, January 2026; January 2025).
- Regulators issued about €1.2 billion in fines in the year to January 2026, roughly the same as the year before.
- Breach notifications averaged 443 a day, up 22% from 363 and above 400 for the first time since GDPR took effect.
- Ireland’s Data Protection Commission has issued fines totaling €4.04 billion, more than any other regulator.
- A separate count by the law firm CMS reached €6.11 billion across 2,685 fines with complete records as of 1 March 2026, with an average fine of about €2.28 million (CMS Enforcement Tracker Report 2026). The 2025 edition reported about €5.65 billion across 2,245 fines.
The two totals differ because they count differently. DLA Piper surveys regulators in the EEA and the UK, while CMS counts only fines it can match to a known amount, date and company.
Record and Recent GDPR Fines
| Company | Fine | Regulator | Year |
|---|---|---|---|
| Meta Platforms Ireland | €1.2 billion | Irish Data Protection Commission | 2023 |
| Uber | €824.99 million | Dutch Data Protection Authority, with France’s CNIL | 2026 |
| TikTok | €530 million | Irish Data Protection Commission | 2025 |
Meta’s 2023 fine for transferring EU user data to the US is still the largest ever issued. In August 2026 the Dutch regulator, working with France’s CNIL, fined Uber €824.99 million over automated decisions about drivers on its platform (CNIL). TikTok’s €530 million fine, announced on 2 May 2025, covered transfers of European user data to China (Irish Data Protection Commission).
EU AI Act Penalties and the New Timeline
- The maximum EU AI Act fine is €35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited AI practices (Article 99).
- Breaking most other obligations can cost up to €15 million or 3%, and giving regulators incorrect or misleading information up to €7.5 million or 1%.
- For small and medium-sized businesses, including startups, each fine is capped at the fixed amount or the percentage, whichever is lower (Article 99). The AI Omnibus extends the same lower-of rule to small mid-cap companies for the €15 million and €7.5 million tiers (Regulation (EU) 2026/1744).
- The bans on prohibited practices applied from 2 February 2025, and the penalty regime and rules for general-purpose AI models from 2 August 2025.
- The AI Omnibus, which entered into force on 27 July 2026, delayed the rules for high-risk AI systems. The high-risk uses listed in Annex III, originally due on 2 August 2026, now apply from 2 December 2027. AI built into regulated products such as machinery and toys, originally due on 2 August 2027, now follows from 2 August 2028 (European Commission).
US State Privacy Laws and CCPA Enforcement
- General Motors agreed in May 2026 to pay $12.75 million in civil penalties over selling driving data to data brokers, the largest penalty under the California Consumer Privacy Act (CCPA) to date and California’s first data minimization case. The settlement was announced subject to court approval (CalPrivacy).
- Three months earlier, Disney agreed to pay $2.75 million, then the largest CCPA settlement, for failing to fully honor opt-out requests across its streaming services (California Attorney General). Healthline Media’s $1.55 million in July 2025 held the record before that.
- Tractor Supply was fined $1.35 million in September 2025, the largest fine in the California Privacy Protection Agency’s history (CalPrivacy).
- CCPA fines stand at up to $2,663 per violation and $7,988 per intentional violation or violation involving consumers the business knows are under 16, adjusted for inflation from January 2025 (CPPA).
- In September 2025, California, Colorado and Connecticut ran a joint sweep of businesses that ignore the Global Privacy Control browser signal (California Attorney General).
- California’s Delete Request and Opt-Out Platform (DROP) lets residents ask every registered data broker to delete their data in one request. From 1 August 2026, brokers must check it at least once every 45 days (CPPA).
- Oklahoma signed a broad consumer data privacy law in March 2026, taking effect on 1 January 2027 (Oklahoma House of Representatives).
- Since 1 January 2023, Californians have had the right to limit how businesses use and disclose their sensitive personal information, and to correct inaccurate data (California Attorney General).
Federal Privacy Rules
The US still has no general federal privacy law. Support for one has been high for years: in a 2022 Morning Consult and Politico poll, more than 80% of voters backed each of the four main provisions of the draft American Data Privacy and Protection Act, including letting consumers sue companies over privacy violations, with every provision at 81% or higher (Morning Consult). That bill never passed.
The main federal action has been on foreign access. On 28 February 2024, President Biden signed Executive Order 14117 to stop countries of concern from accessing Americans’ bulk sensitive personal data (Federal Register).
Consumer Privacy Statistics
What Americans Think About Data Privacy
Pew Research Center’s most recent full study of American privacy attitudes surveyed 5,101 US adults in May 2023 (Pew).
- 81% are very or somewhat concerned about how companies use the data they collect about them.
- 71% are concerned about how the government uses their data, up from 64% in 2019.
- 67% understand little to nothing about what companies do with their personal data, up from 59%.
- 73% feel they have little or no control over what companies do with their data.
- 72% say there should be more regulation of what companies can do with personal data. The support crosses parties: 78% of Democrats and 68% of Republicans.
- Among those who have heard of AI, 70% have little to no trust in companies to make responsible decisions about how they use it.
Online Security Habits
A U.S. News survey of 2,000 US adults in May 2024 found a wide gap between worry and action (U.S. News 360 Reviews).
- 82% were concerned about online security.
- Only 42% used multi-factor authentication, while 53% relied on security questions to verify their identity.
- About one in four accessed their accounts only from trusted devices.
- 22% changed their passwords regularly, at least every three months, and 5% never changed them.
Privacy Rights Requests
- 19% of consumers asked a company to change or delete their data in 2023, up from 14% the year before (Cisco 2023 Consumer Privacy Survey).
- Younger people act most: 32% of consumers aged 18 to 24 made such requests, compared with 4% of older consumers.
- 81% of consumers agreed that the way a company treats their personal data reflects how it views and respects them, and 76% said they would not buy from a company they don’t trust with their data (Cisco 2022 Consumer Privacy Survey). In Cisco’s 2024 survey of more than 2,600 adults in 12 countries, 75% said they would not buy from an organization they do not trust with their data (Cisco 2024 Consumer Privacy Report).
App Tracking on iPhone
Apple’s App Store privacy labels show how many apps declare that they track users (42matters, updated 12 September 2026).
- 17.43% of iOS apps, or 452,010 apps, declare that they use data to track users, roughly one in six.
- 38.17%, or 989,869 apps, declare that they collect data linked to users’ identities.
Online Dating Scams and AI
- 44% of current US online daters say they have been targeted by a dating scam, and 74% of those targeted say they fell for it (Norton, January 2026, 1,000 US adults).
- In Norton’s earlier global survey of 13,107 adults across 13 countries, 26%, about one in four, said they had been targeted by a dating scam (Norton Cyber Safety Insights Report, 2024).
- Among respondents in that survey who had used an online dating app or service, 32% said they had been catfished by someone they met there, and another 7% were not sure.
- In the same survey, among current online daters, 56% said they were likely to use an AI tool such as Photoshop or Canva to improve their photos, and 59% were likely to use AI for dating coaching.
Data After Death
A 2019 YouGov survey asked Britons what should happen to their data and social media accounts when they die (YouGov).
- 25% want their information deleted completely, and 7% want it to stay online forever.
- 26% want it downloaded, taken offline and given to family and friends.
- 34% of those aged 65 and over want their data deleted, against 17% of those aged 18 to 25.
- 53% would give family members their smartphone password before they die, and 23% would keep it to themselves.
- Among 18 to 25 year olds, 36% would take their smartphone password to the grave and 40% would pass it on.
Online content does not last forever either. Pew found that 38% of webpages that existed in 2013 were no longer accessible a decade later, and a quarter of all pages that existed at some point between 2013 and 2023 had disappeared (Pew Research Center, 2024).
Business Privacy Statistics
Cisco 2026 Data and Privacy Benchmark Study
Cisco surveyed 5,200 IT, technology and security professionals with data privacy responsibilities across 12 markets for its 2026 study, published on 26 January 2026 (Cisco).
- 90% of organizations have expanded their privacy programs because of AI, and 93% plan to invest more.
- 38% spent at least $5 million on their privacy programs in the past year, up from 14% in 2024.
- 75%, three in four, have a dedicated AI governance body, but only 12% of organizations describe those structures as mature.
- 65% struggle to access relevant, high-quality data efficiently.
- 99% report at least one tangible benefit from their privacy work, and 96% say strong privacy frameworks help them move faster on AI.
- 81% face more demand for data localization, and 85% say it adds cost, complexity and risk to serving customers across borders.
The 2025 edition, with 2,600 respondents in 12 countries, found that 96% of organizations said privacy investment returns exceeded the costs, and 99% expected to move resources from privacy budgets to AI initiatives.
What Companies Report to the Board
From Cisco’s 2024 Data Privacy Benchmark Study:
- 98% of organizations reported one or more privacy metrics to their board, and more than half reported three or more.
- The most common were audit results (44%), data breaches (43%), data protection impact assessments (34%) and data subject requests (31%).
- 91% said they need to do more to reassure customers that their data is used only for intended and legitimate purposes in AI.
- 94% said customers would not buy from them if their data was not properly protected.
How Businesses Feel About Privacy Compliance
Termly surveyed 1,037 of its own users, mostly small and medium-sized businesses, in January and February 2024. The results describe those respondents only (Termly):
- 78.1% of businesses saw no negative impact from implementing privacy requirements, while 21.9% did.
- 91.1% said they would prioritize data privacy if they knew it would increase customer trust and loyalty.
- “Necessary” was the word businesses most often used to describe data privacy.
Privacy Technology Market Statistics
Market Size
- Mordor Intelligence sizes the privacy management software market at $6.24 billion in 2026, up from $5.07 billion in 2025, and forecasts $17.63 billion by 2031, growing 23.08% a year from 2026 (Mordor Intelligence).
- Fortune Business Insights sizes the same market at $5.55 billion for 2025 and $7.90 billion for 2026, and forecasts $134.28 billion by 2034, growing 42.49% a year from 2026 (Fortune Business Insights).
- For the same year, 2026, the two firms are $1.66 billion apart, and their growth rates differ by almost 20 percentage points. They use different assumptions and forecast horizons, so read both as estimates.
- 85% of breached organizations told IBM they plan to increase spending on security tools and governance in response to new threats from frontier AI models.
Deals and Funding
- Veeam completed its $1.725 billion acquisition of Securiti AI, a data security, privacy and AI governance company, on 11 December 2025 (Veeam).
- Cyera, which sells data security posture management and privacy tools, raised $600 million at a $12 billion valuation in June 2026, quadrupling its valuation in 18 months (Cyera).
- F5 announced in September 2025 that it would acquire CalypsoAI, which builds guardrails for enterprise AI, for $180 million in purchase consideration (F5).
Data Privacy Trends for 2026
Breach costs are rising again. After a one-year dip, the global average hit a record, and every country and region IBM tracks got more expensive. Third parties now show up in nearly half of all breaches Verizon examined.
AI governance lags AI use. Two-thirds of breached organizations had none, and only 12% of organizations in Cisco’s study described their AI governance as mature. Shadow AI incidents more than doubled in the same year.
Regulation is splitting in two directions. European regulators keep fining at about €1.2 billion a year while giving companies more time on high-risk AI. In the US, privacy law is still built state by state: California set new CCPA penalty records in February and May 2026, Oklahoma passed a new law, and a general federal privacy law has not been enacted.
Frequently Asked Questions
What Is the Average Cost of a Data Breach in 2026?
$4.99 million globally, a 12% increase and a record, according to IBM’s Cost of a Data Breach Report 2026. The US average is $11.50 million. Healthcare is the most expensive industry at $6.64 million.
How Much Have GDPR Fines Totaled?
About €7.1 billion between May 2018 and January 2026, according to DLA Piper. Regulators issued roughly €1.2 billion in the most recent year. The largest single fine is still €1.2 billion against Meta in 2023.
What Percentage of Breaches Involve Shadow AI?
IBM found security incidents involving shadow AI at 43% of breached organizations in 2026, up from 20% in 2025. Those breaches cost $5.39 million on average.
What Percentage of Americans Are Concerned About Data Privacy?
In Pew Research Center’s May 2023 survey, the most recent full study of the question, 81% of US adults were concerned about how companies use the data they collect, and 71% were concerned about how the government uses it.
When Do the EU AI Act High-Risk Rules Apply?
After the AI Omnibus entered into force on 27 July 2026, rules for high-risk AI systems listed in Annex III apply from 2 December 2027, and rules for AI built into regulated products apply from 2 August 2028. The original dates were 2 August 2026 and 2 August 2027.
How Many Data Breaches Happen in the US Each Year?
The Identity Theft Resource Center counted a record 3,321 US data compromises in 2025, in its revised July 2026 figures, and 1,803 in the first half of 2026 alone.
What Is the Most Common Cause of Data Breaches?
In Verizon’s 2026 report, exploitation of software vulnerabilities was the most common way attackers got in, at 31% of breaches. Ransomware was involved in 48%, and a human element in 62%.
Sources and Methodology
This page collects published figures from research firms, regulators, law firms and survey organizations. Each statistic links to the report or page that published it, and the survey size, geography and date are given where the publisher states them. Figures were checked against those publications on 16 September 2026.
Where a newer edition of a study has replaced an older figure, the page shows both. Where the latest available study is older, such as Pew’s 2023 privacy survey or YouGov’s 2019 poll, the year is stated beside the figure. Market-size estimates come from commercial research firms whose assumptions and forecasts differ widely, so they are shown side by side.
Main sources:
- IBM and Ponemon Institute, Cost of a Data Breach Report 2026 (602 organizations, 16 countries and regions)
- Verizon 2026 Data Breach Investigations Report (more than 22,000 confirmed breaches)
- Identity Theft Resource Center, 2025 Annual Data Breach Report and H1 2026 update
- CrowdStrike Global Threat Reports 2024 and 2026
- DLA Piper GDPR Fines and Data Breach Surveys, January 2025 and January 2026
- CMS Enforcement Tracker Report 2026
- European Commission, California Attorney General and California Privacy Protection Agency
- Cisco Data Privacy Benchmark Studies 2024 to 2026, and Consumer Privacy Surveys 2022 to 2024
- Pew Research Center (5,101 US adults, May 2023)
- Gartner, Mordor Intelligence and Fortune Business Insights
About the author
Editorial Staff
The Editorial Staff at Bot Memo is a team of writers, analysts, and AI agents dedicated to mapping the global AI startup ecosystem. Led by Chintan Zalani, the team tracks thousands of funding rounds, classifies companies across verticals, and distills it all into actionable intelligence for investors and founders.
