Low
Lawsuit filed
Filed
Germany · Jan 28, 2026
noyb files lawsuit against Hamburg DPA over Pay or Okay case involving SPIEGEL
In 2024, privacy advocacy group noyb sued the Hamburg Data Protection Authority concerning a Pay or Okay implementation dispute with the German news magazine SPIEGEL. The case highlights concerns about DPA impartiality and enforcement…
Hamburg Data Protection Authority · General Data Protection Regulation
Low
Investigation
Announced
Austria · Jan 20, 2026
noyb investigation reveals Austrian credit agency CRIF uses public registers for mass address data collection
noyb’s investigation of CRIF shows that most address data comes from brokers who scrape public registers, violating GDPR purpose‑limitation. The Austrian DSB has already ruled that further processing for advertising breaches the GDPR.
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Dec 18, 2025 · deadline Dec 31, 2025
Austrian Supreme Court orders Meta to give users full data access within 14 days
The Austrian Supreme Court ruled that Meta must provide a complete copy of all personal data to any user request within 14 days, including source, recipient and purpose information. The court also required Meta to obtain explicit opt‑in…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Dec 17, 2025
noyb files complaints against TikTok, AppsFlyer and Grindr with Austrian DSB over unlawful tracking
noyb has lodged two complaints with Austria's data protection authority alleging that TikTok tracks users across other apps and fails to provide a complete copy of personal data. The complaints also target AppsFlyer and Grindr for sharing…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Dec 10, 2025
EU‑US data transfers face imminent risk as US legal changes could undermine TAFPF and SCCs
The blog notes that most EU‑US transfers rely on the Transatlantic Data Privacy Framework (TAFPF) or Standard Contract Clauses (SCCs), which depend on fragile US laws and executive orders. It warns that upcoming US Supreme Court decisions…
EDPB · General Data Protection Regulation
Low
Guidance
Published
European Union · Dec 4, 2025
EDPB publishes first opinion on Pay or Okay, urging a three‑option consent model
In April 2024 the European Data Protection Board released its first opinion on Pay or Okay systems, recommending a third choice of "advertising, but no tracking" alongside pay and consent options. A noyb‑commissioned study shows that users…
European Data Protection Board
Moderate
Proposed regulation
Proposed
European Union · Nov 22, 2025
EU Commission proposes Digital Omnibus package with new personal data definition and research exemption
The European Commission has released the Digital Omnibus proposal, introducing a narrower definition of personal data (Art. 4(1)), a broader research exemption (Arts. 4(38), 5(1)(b), 13, 89), and new AI‑related rules (Arts. 9(2)(k), 9(5)…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Nov 11, 2025
Open letter warns EU Commission's Digital Omnibus draft could deregulate GDPR
Noyb, EDRi and the Irish Council for Civil Liberties sent an open letter to the European Commission criticizing a draft Digital Omnibus that would amend core GDPR provisions. The draft proposes redefining personal data, weakening data…
European Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · Oct 28, 2025
noyb files criminal complaint against Clearview AI in Austria
noyb filed a criminal complaint with Austrian public prosecutors against Clearview AI and its managers for alleged GDPR violations. The complaint relies on Article 84 GDPR and Austria's § 63 Data Protection Act, which allow criminal…
Austrian public prosecutors · General Data Protection Regulation
Low
Enforcement
Filed
Lithuania · Sep 29, 2025
noyb files complaint with Lithuanian DPA against Whitebridge AI for unlawful data processing
noyb has lodged a complaint with Lithuania's data protection authority alleging that Whitebridge AI unlawfully scrapes and sells AI‑generated reputation reports containing personal and sensitive data. The complaint cites violations of…
Lithuanian Data Protection Authority · General Data Protection Regulation
Low
Investigation
Announced
Austria · Sep 25, 2025
noyb uncovers over 40,000 CRIF credit queries linking Austrian banks, telecoms and retailers
noyb obtained data requests from 2,440 individuals and analyzed more than 40,000 CRIF credit queries, finding that banks, telecoms and other firms provide personal address data to the credit agency. The analysis shows gender and geographic…
EDPB · General Data Protection Regulation
Moderate
Data protection authority action
Announced
Ireland · Sep 18, 2025
Former Meta lobbyist Niamh Sweeney appointed Irish DPC commissioner
Niamh Sweeney, a former senior Meta lobbyist, is set to join the Irish Data Protection Commission (DPC) as a commissioner in October. The DPC is the EU lead privacy regulator for major US tech firms. The appointment raises concerns about…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Announced
Austria · Sep 18, 2025
NGOs file EU Commission complaint over Austrian DPA budget cuts
The Austrian Data Protection Authority (DSB) announced further restrictions due to significant budget cuts. NGOs epicenter.works and noyb plan to file a complaint with the European Commission alleging violation of Article 52(4) GDPR. The…
European Commission · General Data Protection Regulation
Moderate
Fine
In effect
France · Sep 4, 2025
CNIL fines Google €325 million for unsolicited Gmail advertising
The French data protection authority CNIL has issued a decision siding with privacy NGO noyb and fined Google €325 million for sending unsolicited advertising emails to Gmail users without consent. The authority also ordered Google to stop…
CNIL · ePrivacy Directive
Low
Court ruling
Decided
European Union · Sep 3, 2025
EU General Court rejects Latombe challenge to EU‑US data transfer framework
French MP Philippe Latombe filed an action for annulment of the Transatlantic Data Protection Framework before the EU General Court. The General Court dismissed the narrow challenge, finding it unconvincing. The decision leaves the…
Transatlantic Data Protection Framework
Moderate
Data protection authority action
Decided
Austria · Aug 29, 2025
Austrian DPA orders YouTube to comply with GDPR Article 15 access request
The Austrian Data Protection Authority issued a decision ordering YouTube (Google) to provide the complainant with full access to his personal data, including purpose, storage periods, recipients and tracking cookies, under Article 15…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Aug 18, 2025
Austrian Federal Administrative Court rules DerStandard's "pay or okay" consent model illegal
The Austrian Federal Administrative Court (BVwG) confirmed the Data Protection Authority's finding that DerStandard violated the GDPR by offering a "pay or okay" choice. The court held that the newspaper did not obtain valid, granular…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Announced
Germany · Aug 7, 2025
noyb sends cease‑and‑desist to Meta over AI training of EU users’ data
noyb commissioned a Gallup survey of 1,000 German Meta users, finding only 7% want their personal data used for AI training. Based on the results, noyb sent a cease‑and‑desist letter to Meta alleging GDPR violations and is assessing a…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Jul 31, 2025
CJEU ruling C‑446/21 limits use of personal data for online advertising and repurposing publicly available data
The European Court of Justice issued ruling C‑446/21, fully backing a lawsuit against Meta's Facebook service. The court massively limits the use of personal data for online advertising and restricts the reuse of publicly available…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Jul 17, 2025
noyb files GDPR complaints against TikTok, AliExpress and WeChat for denying data access
noyb has lodged complaints with the data protection authorities in Belgium, Greece and the Netherlands alleging that TikTok, AliExpress and WeChat violated Articles 12 and 15 of the GDPR by failing to provide full data access. The…
Data Protection Authorities (Belgium, Greece, Netherlands) · General Data Protection Regulation
