Moderate
Settlement
Settled
United States (federal) · Aug 26, 2026
EFF says Meta settlement expands data collection and limits youth rights
The settlement reduces young users' access to Meta products and limits their ability to exercise free expression and community participation. It requires age assurance on every product, leading to the collection of additional personal…
Moderate
Enforcement
In effect
European Union · Aug 2, 2026 · effective Aug 2, 2026
EU Commission begins enforcing AI Act and new transparency rules on 2 August 2026
From 2 August 2026 the European Commission’s AI Office and national authorities will start enforcing the AI Act. New transparency rules require chatbots to disclose they are AI and AI‑generated content such as deepfakes to be labelled with…
European Commission AI Office · EU AI Act
Moderate
Fine
In effect
France · Mar 13, 2026
French court upholds €40M GDPR fine against Criteo
The French Data Protection Authority (CNIL) fined Criteo €40 million for GDPR violations, including lack of valid consent, transparency, and failures to honor erasure and access rights. In March 2026, the Conseil d’État rejected Criteo’s…
CNIL · General Data Protection Regulation
Moderate
Data protection authority action
Decided
Austria · Jan 27, 2026
Austrian DSB orders Microsoft to stop tracking school children with cookies
The Austrian Data Protection Authority ruled that Microsoft illegally installed tracking cookies on a pupil's device without consent. The authority ordered Microsoft to cease the use of those cookies within four weeks. The decision follows…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Fine
In effect
France · Nov 27, 2025
CNIL fines Conde Nast €750,000 for cookie consent violations
The French data protection authority CNIL fined Conde Nast €750,000 for placing cookies on its Vanity Fair website without obtaining valid user consent. The authority also found the publisher failed to adequately inform users about the…
CNIL
Moderate
Enforcement
Filed
Austria · Oct 28, 2025
noyb files criminal complaint against Clearview AI in Austria
noyb filed a criminal complaint with Austrian public prosecutors against Clearview AI and its managers for alleged GDPR violations. The complaint relies on Article 84 GDPR and Austria's § 63 Data Protection Act, which allow criminal…
Austrian public prosecutors · General Data Protection Regulation
Moderate
Data protection authority action
Decided
Austria · Oct 9, 2025
Austrian DSB rules Microsoft 365 Education illegally tracks students and orders data deletion
The Austrian Data Protection Authority found Microsoft 365 Education used tracking cookies without consent and denied a data‑access request, violating GDPR. The DSB ordered Microsoft to delete the data, provide full access, and disclose…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Data protection authority action
Published
Austria · Sep 26, 2025
Austrian DSB bans KSV1870 from automated credit checks without consent
The Austrian Data Protection Authority ruled that KSV1870's fully automated credit rating was unlawful and prohibited the agency from conducting such checks without the data subject's consent. The authority also ordered KSV1870 to provide…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Data protection authority action
Announced
Ireland · Sep 18, 2025
Former Meta lobbyist Niamh Sweeney appointed Irish DPC commissioner
Niamh Sweeney, a former senior Meta lobbyist, is set to join the Irish Data Protection Commission (DPC) as a commissioner in October. The DPC is the EU lead privacy regulator for major US tech firms. The appointment raises concerns about…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Fine
In effect
France · Sep 4, 2025
CNIL fines Google €325 million for unsolicited Gmail advertising
The French data protection authority CNIL has issued a decision siding with privacy NGO noyb and fined Google €325 million for sending unsolicited advertising emails to Gmail users without consent. The authority also ordered Google to stop…
CNIL · ePrivacy Directive
Moderate
Data protection authority action
Decided
Austria · Aug 29, 2025
Austrian DPA orders YouTube to comply with GDPR Article 15 access request
The Austrian Data Protection Authority issued a decision ordering YouTube (Google) to provide the complainant with full access to his personal data, including purpose, storage periods, recipients and tracking cookies, under Article 15…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Jul 17, 2025
noyb files GDPR complaints against TikTok, AliExpress and WeChat for denying data access
noyb has lodged complaints with the data protection authorities in Belgium, Greece and the Netherlands alleging that TikTok, AliExpress and WeChat violated Articles 12 and 15 of the GDPR by failing to provide full data access. The…
Data Protection Authorities (Belgium, Greece, Netherlands) · General Data Protection Regulation
Moderate
Data protection authority action
Decided
Ireland · Jul 16, 2025
DPC issues final decision reprimanding Children’s Health Ireland for GDPR security breaches
The Irish Data Protection Commission concluded that Children’s Health Ireland (CHI) at Tallaght University Hospital breached GDPR security and confidentiality obligations. CHI was reprimanded and ordered to bring its processing into…
Data Protection Commission (Ireland) · General Data Protection Regulation
Moderate
Data protection authority action
Filed
Austria · Jun 26, 2025
noyb files complaint against Bumble for unlawful AI Icebreakers in Austria
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Bumble's AI Icebreakers process personal data without valid consent and rely on an invalid legitimate‑interest claim. The complaint cites violations of GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Jun 16, 2025
noyb warns Meta's planned WhatsApp ads may breach GDPR and DMA
noyb alleges that Meta's intention to serve ads on WhatsApp using personal data from Instagram and Facebook violates the GDPR and the EU Digital Markets Act. The organization says the proposed "Pay or Okay" model would not provide freely…
noyb · General Data Protection Regulation
Moderate
Enforcement
In effect
United States (federal) · May 15, 2025 · effective May 15, 2025
CFPB Amends Wise Consent Order, Reducing Fine to $45,000
The Consumer Financial Protection Bureau issued an amended consent order on May 15, 2025, superseding its January 30, 2025 order against Wise. The amendment requires Wise to pay a revised civil penalty of approximately $45,000 and to…
Consumer Financial Protection Bureau · Consumer Financial Protection Act
Moderate
Consent order
Amended
United States (federal) · May 15, 2025
CFPB amends Wise consent order over inaccurate fee disclosures
The Consumer Financial Protection Bureau amended its January 30, 2025 consent order with Wise, an international remittance company. The amendment resolves claims that Wise advertised inaccurate fees and failed to properly disclose exchange…
Consumer Financial Protection Bureau
Moderate
Enforcement
Filed
Norway (EEA) · Mar 20, 2025
noyb files second GDPR complaint against OpenAI over defamatory AI hallucinations in Norway
noyb filed a second complaint with the Norwegian Data Protection Authority alleging that OpenAI's ChatGPT generated false, defamatory personal data about a Norwegian user. The complaint cites violations of GDPR Article 5(1)(d) on data…
Norwegian Datatilsynet · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Jan 16, 2025
noyb files GDPR complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi over transfers to China
noyb has lodged six GDPR complaints in five EU countries alleging unlawful transfers of Europeans' personal data to China by TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi. The complaints request that DPAs suspend the transfers under…
European Commission · Standard Contractual Clauses
Moderate
Enforcement
Filed
Italy · Dec 19, 2024
noyb files GDPR complaint against Ryanair over mandatory biometric face scans
noyb has filed a complaint with the Italian Data Protection Authority alleging that Ryanair forces new customers to create permanent accounts and undergo a biometric facial‑recognition verification to book flights. The complaint says this…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
