Low
Enforcement
Filed
Austria · Jun 13, 2024
noyb files complaint with Austrian DPA over Google Chrome consent pop‑up
noyb alleges that Google Chrome’s “Privacy Sandbox” pop‑up misleads users into consenting to first‑party tracking for targeted advertising. The complaint asks the Austrian data protection authority to require Google to cease processing…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jun 5, 2024
noyb files GDPR complaint against Austrian newspaper Kurier over forced consent
noyb lodged a GDPR complaint against Kurier for forcing users to accept tracking cookies. The Austrian DSB had previously banned the same practice at Profil and ordered compliance, which was not implemented. On 20 August 2024 the DSB…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Investigation
Announced
Austria · Jun 4, 2024
noyb files complaints urging Austrian DSB to investigate Microsoft 365 Education for GDPR violations affecting children
noyb has lodged two complaints with Austria's data protection authority alleging that Microsoft 365 Education breaches GDPR rights of minors by shifting responsibility to schools, providing vague privacy information, and tracking users…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
High
Fine
In effect
Ireland · May 24, 2024 · effective Aug 25, 2026
Irish Data Protection Commission fines HSE €645,000 for GDPR breaches over paper record storage
The Data Protection Commission (DPC) issued a final decision on 25 August 2026, fining the Health Service Executive (HSE) €645,000 for multiple GDPR infringements related to the storage and security of paper medical records. The DPC also…
Data Protection Commission (Ireland) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Apr 29, 2024
noyb files complaint with Austrian DPA over OpenAI's ChatGPT inaccurate personal data
noyb filed a complaint with the Austrian Data Protection Authority alleging that OpenAI cannot correct inaccurate personal data generated by ChatGPT, violating GDPR Articles 5, 15 and 16. The complaint seeks an investigation, compliance…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Sweden · Mar 14, 2024
noyb files complaint against Swedish data broker MrKoll over media licence GDPR exemption
noyb has filed a complaint with the Swedish Data Protection Authority (IMY) challenging the use of a media licence that exempts data broker MrKoll from GDPR obligations. The complaint requests deletion of the complainant’s data…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Feb 16, 2024
28 NGOs urge EU Data Protection Board to reject Meta's 'Pay or Okay' consent model
A coalition of 28 NGOs, including Wikimedia Europe, Bits of Freedom and the Norwegian Consumer Council, sent a joint letter to the European Data Protection Board requesting a binding opinion on Meta's "Pay or Okay" system, which forces…
European Data Protection Board (EDPB) · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Feb 16, 2024
noyb files complaint against German credit agency SCHUFA for GDPR access violations
noyb has lodged a complaint and report with the Hessian data protection authority alleging that SCHUFA blocks free access to personal data required under Article 15 GDPR. The agency allegedly uses manipulative designs to push paid products…
Hessian data protection authority · General Data Protection Regulation
Moderate
Data protection authority action
Published
DE-BAVARIA · Feb 5, 2024
Bavarian DPA declares CRIF‑Acxiom data trading illegal under GDPR
The Bavarian data protection authority ruled that credit reference agency CRIF illegally purchased personal data from address trader Acxiom and breached GDPR purpose‑limitation and information duties. The decision follows a similar…
Bavarian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jan 28, 2024
Survey finds 74% of insiders say authorities would find GDPR violations in average EU company
A noyb survey of over 1,000 data‑protection professionals reports that 74% believe authorities would discover relevant GDPR violations during on‑site inspections. Respondents cite lack of clear DPA decisions, fines, and public enforcement…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jan 11, 2024
Meta sued for charging users to withdraw consent in Austria
Noyb filed a complaint with the Austrian Data Protection Authority alleging that Meta forces users to pay up to €251.88 per year to withdraw consent for tracking. The complaint cites Article 7 of the GDPR, which requires withdrawal to be…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jan 4, 2024
noyb files complaint against Austrian creditors’ association KSV1870 for charging for GDPR Article 15 access
noyb lodged a complaint with the Austrian data protection authority alleging that KSV1870 charges €43 for a data‑access service that must be provided free of charge under Article 15 GDPR. The organization allegedly uses misleading website…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Netherlands · Dec 14, 2023
noyb files GDPR and DSA complaint against X (Twitter) over illegal political micro‑targeting
noyb lodged a complaint with the Dutch Data Protection Authority alleging that X (Twitter) used users' political views and religious beliefs for targeted advertising on behalf of the EU Commission. The complaint asserts violations of the…
Dutch Data Protection Authority · Digital Services Act
Low
Lawsuit filed
Filed
Austria · Dec 4, 2023
noyb sues CRIF and AZ Direct for illegal secret data processing in Austria
noyb filed a lawsuit in the Vienna Regional Court on behalf of seven individuals alleging that CRIF GmbH and address trader AZ Direct secretly trade personal data of millions of Austrians for credit scoring. The Austrian Data Protection…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · Nov 28, 2023
noyb files GDPR complaint against Meta over “Pay or Okay” tracking fee
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Meta’s practice of charging users up to €251.88 a year to avoid personalized advertising violates GDPR consent requirements. The complaint references the…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Nov 16, 2023
noyb files complaint with EDPS over EU Commission’s political micro‑targeting ads on X
noyb lodged a complaint with the European Data Protection Supervisor alleging the EU Commission used unlawful micro‑targeting on X to promote its chat‑control proposal. The ads targeted users based on political views and religious beliefs…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Low
Lawsuit filed
Filed
DE-HE · Oct 24, 2023
Acxiom sues German DPA to block noyb’s access to GDPR complaint files
Acxiom filed an interim injunction request with the Wiesbaden Administrative Court to prevent the Hessian data protection authority from granting noyb access to the case file concerning its alleged illegal sale of personal data to CRIF.…
Hessian Data Protection Authority · General Data Protection Regulation
Low
Court ruling
Decided
Austria · Oct 9, 2023
Austrian court orders streaming service DAZN to comply with GDPR access request after 5 years
The Austrian Federal Administrative Court ruled on 6 September 2023 that DAZN must provide the missing information requested under the GDPR right of access. DAZN complied with the court order on 13 September 2023, completing the request…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Interpretation
Announced
European Union · Oct 3, 2023
Meta proposes 'Pay for your Rights' model charging EU users €160/year for non‑consent
Meta plans to charge EU users €160 per year if they do not consent to the processing of their personal data on Facebook and Instagram. The proposal references an obiter dictum from the CJEU case C‑252/21 that an alternative to ads may be…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Fine
Decided
Norway (EEA) · Sep 29, 2023
Norwegian Privacy Appeals Board upholds €5.8 million fine against Grindr
The Norwegian Privacy Appeals Board confirmed the Norwegian Data Protection Authority's fine of NOK 65 million against the dating app Grindr for sharing sensitive personal data with third parties. The fine, approximately €5.8 million…
Norwegian Data Protection Authority · General Data Protection Regulation
