Moderate
Enforcement
Announced
European Union · Jan 4, 2023
EU EDPB bans Meta from using personal data for personalized ads, imposes €390 million fine
The European Data Protection Board (EDPB) decided that Meta (Facebook and Instagram) may not use personal data for personalized advertising and must obtain opt‑in consent. The decision also imposes a total fine of €390 million on Meta.…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Fine
In effect
Ireland · Jan 4, 2023 · effective Jan 4, 2023
EU data protection board fines Meta €390 million and bans personalized ads
The European Data Protection Board, following the Irish Data Protection Commission, ruled that Meta's use of personal data for personalized advertising violated the GDPR and imposed a €390 million fine. Meta must obtain opt‑in consent and…
European Data Protection Board · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Dec 6, 2022
EU Data Protection Board rules Meta's consent bypass for personalized ads illegal
The European Data Protection Board (EDPB) decided that Meta cannot force users to accept personalized ads and must obtain a yes/no consent option. The decision overturns a previous draft decision by the Irish Data Protection Commission and…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Oct 27, 2022
noyb files 700+ GDPR complaints on cookie banners, prompting widespread addition of reject buttons
noyb scanned over 3,600 websites in March 2021 and filed more than 700 complaints across Europe for GDPR‑violating cookie banners lacking a clear reject option. Follow‑up scans in October 2022 showed that 41% of the sites added a reject…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 9, 2022
226 GDPR complaints lodged against deceptive OneTrust cookie banners
noyb filed 226 complaints with 18 data protection authorities over websites using OneTrust cookie banners that employ deceptive designs. The complaints allege violations of GDPR requirements for a fair yes/no consent choice. Some websites…
EDPB · General Data Protection Regulation
Moderate
Fine
Decided
European Union · Jul 21, 2022
6.3 million Euro fine imposed on Grindr for GDPR violations
noyb’s complaints resulted in a 6.3 million Euro fine against the gay dating app Grindr for breaching the GDPR. The fine was highlighted in noyb’s 2021 Annual Report.
EDPB · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · May 24, 2022
noyb warns of widespread GDPR non‑compliance and lack of enforcement after four years
The NGO noyb states that despite the GDPR becoming applicable on 25 May 2018, many companies continue to ignore users' rights and enforcement remains weak. It notes that about 50 cross‑country cases it filed have not yet received a final…
EDPB · General Data Protection Regulation
Moderate
Settlement
Settled
Ireland · Apr 28, 2022 · effective Apr 28, 2022
Irish DPC to pay tens of thousands in costs to noyb over 47‑month delay in WhatsApp and Instagram GDPR cases
The Irish Data Protection Commission settled with privacy group noyb, agreeing to cover tens of thousands of euros in legal costs after a 47‑month delay in drafting decisions on WhatsApp and Instagram cases. The delay contravenes GDPR…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Mar 4, 2022
noyb launches second wave of GDPR complaints against deceptive cookie banners
noyb sent 270 draft complaints to website operators whose cookie banners violate the GDPR, offering a 60‑day grace period before filing formal complaints. If companies do not fully comply, noyb will file complaints with DPAs, which may…
Data Protection Authorities · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Jan 23, 2022
noyb reports low GDPR enforcement rates on Data Protection Day
noyb disclosed that only 15% of its 51 GDPR complaints were decided within a year and no pan‑European case has been resolved under the one‑stop‑shop mechanism. The organization highlights delays across DPAs, including a three‑year‑plus…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Published
European Union · Jan 11, 2022
EDPS reprimands European Parliament for illegal EU‑US data transfers via Google and Stripe
The European Data Protection Supervisor (EDPS) issued a decision reprimanding the European Parliament for violating data protection law on its COVID‑testing website. The use of Google Analytics and Stripe was found to breach the CJEU's…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Fine
In effect
Norway (EEA) · Dec 15, 2021 · effective Dec 15, 2021
Norwegian DPA fines Grindr €6.3 M for illegal sharing of sensitive data
The Norwegian Data Protection Authority imposed a fine of 65 Mio NOK on Grindr for sharing sensitive personal data without valid consent. The authority found the consent mechanism invalid and highlighted the lack of a genuine opt‑out. The…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Guidance
Published
Ireland · Dec 4, 2021
Irish DPC tried to embed Facebook consent bypass into EDPB Guidelines, but final 2019 guidelines omitted it
A letter shows the Irish DPC held ten meetings with Facebook and agreed on a GDPR bypass by moving consent into terms and conditions. The DPC then drafted EDPB guideline language to allow this approach, but other DPAs criticised it…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Moderate
Enforcement
Announced
Ireland · Oct 15, 2021
Irish DPC orders noyb to remove draft decision from website
The Irish Data Protection Commission sent a take‑down request to privacy activist group noyb on 14 Oct 2021, ordering removal of a draft decision that allegedly strips Facebook users of GDPR rights. noyb refused, citing Austrian law and…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 13, 2021
noyb files complaints against cookie paywalls of seven German and Austrian news sites over unlawful consent
noyb filed complaints against the cookie paywalls of SPIEGEL.de, Zeit.de, heise.de, FAZ.net, derStandard.at, krone.at and t-online.de, arguing that the "pay or okay" model violates the GDPR's requirement for freely given consent. The…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 10, 2021
noyb files 422 GDPR complaints over deceptive cookie banners
noyb filed 422 formal GDPR complaints with data protection authorities in ten EU countries concerning dark‑pattern cookie banners. After a warning phase, 42% of identified violations were remedied, but 82% of the 516 sites still breach the…
Data Protection Authorities · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jul 20, 2021
Austrian Supreme Court refers Facebook case to CJEU over consent vs contract and awards €500 symbolic damages
The Austrian Supreme Court (OGH) referred four questions to the Court of Justice of the EU concerning Facebook's reliance on contract instead of consent under the GDPR. In a partial judgment, the court awarded Max Schrems €500 for lack of…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jul 19, 2021
noyb reports 2.5‑year delay in GDPR access‑request complaints against streaming services
In January 2019 noyb filed complaints against eight streaming services for failing to comply with the GDPR right of access. After two and a half years only one complaint was resolved after noyb took the responsible authority to court. The…
EDPB · General Data Protection Regulation
Moderate
Proposed regulation
Published
European Union · Jun 14, 2021
noyb and CSL propose Advanced Data Protection Control browser signal to replace cookie banners
noyb and the Sustainable Computing Lab released a technical proposal for an "Advanced Data Protection Control" (ADPC) browser signal. The signal would allow browsers to automatically convey user consent or opt‑in preferences to websites…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · May 31, 2021
noyb launches automated system, sends 500 draft GDPR cookie‑banner complaints across Europe
noyb sent more than 500 draft GDPR complaints to companies using unlawful cookie banners, offering a one‑month grace period before filing formal complaints. The NGO developed software to detect violations and generate complaints…
EDPB · General Data Protection Regulation
