Low
Appeal
Filed
Sweden · Aug 12, 2024
noyb appeals to Swedish court over IMY's refusal to investigate data subject complaints
noyb has filed an appeal with the Kammarrätten i Stockholm challenging the Swedish Data Protection Authority's practice of forwarding complaints without investigation. The appeal follows a Supreme Administrative Court ruling that…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Low
Lawsuit filed
Filed
Germany · Aug 1, 2024
Complainant sues Hamburg DPA over ‘Pay or OK’ consent ruling
A GDPR complainant has filed a lawsuit with the Hamburg Administrative Court to overturn the Hamburg data protection authority's decision that the ‘Pay or OK’ consent model used by DER SPIEGEL is permissible. The complainant argues the…
Hamburg data protection authority · General Data Protection Regulation
High
Fine
In effect
European Union · Jul 29, 2024
European data protection authorities fined Meta, Spotify, Criteo and others in 2023 for GDPR violations
In 2023, the Irish DPC ordered Meta to pay €390 million and later €1.2 billion, the Swedish DPA fined Spotify €58 million SEK, and the French CNIL fined Criteo €40 million for breaches of consent and data‑subject rights under EU law.
EDPB · General Data Protection Regulation
Moderate
Proposed regulation
Published
European Union · Jul 16, 2024
EU Parliament and Council publish amendments to GDPR procedural regulation draft
The European Parliament and the Council of the EU have released their amended versions of the Commission's draft GDPR procedural regulation. The amendments aim to harmonise procedural cooperation among DPAs across member states. The next…
European Commission · General Data Protection Regulation
Low
Guidance
Published
European Union · Jul 11, 2024
noyb releases Consent Banner Report comparing EDPB taskforce findings with national DPA positions
noyb published a report that compares the European Data Protection Board's Cookie Banner Taskforce recommendations with guidance and decisions from national DPAs across Europe. The report highlights the minimum thresholds set by the EDPB…
Low
Guidance
Published
European Union · Jul 11, 2024
EDPB Cookie Banner Taskforce report (Jan 2023) and noyb analysis released
The European Data Protection Board set up a cookie‑banner taskforce in September 2021 and published its report in January 2023. noyb compared the taskforce’s findings with national DPA guidance and decisions in a new report dated…
European Data Protection Board
Low
Enforcement
Filed
Italy · Jul 9, 2024
noyb files GDPR complaint against Microsoft’s Xandr for 0% compliance with data subject rights
Xandr, a Microsoft subsidiary, collects and shares personal data of millions of Europeans for targeted advertising, including sensitive categories. noyb filed a GDPR complaint with Italy’s Garante alleging breaches of Articles 5, 12, 15…
Italian data protection authority (Garante) · General Data Protection Regulation
Moderate
Fine
Decided
Norway (EEA) · Jul 1, 2024 · effective Jul 1, 2024
Norwegian court confirms €5.7M fine for Grindr over GDPR breach
A Norwegian court upheld a fine of NOK 65 million (€5.7 million) against Grindr for violating the GDPR by sharing user data with advertisers. The ruling follows a complaint by the Norwegian Consumer Council, supported by noyb.
EDPB · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · Jun 14, 2024 · effective Jun 14, 2024
Meta pauses AI training on EU/EEA user data after DPC intervention
The Irish Data Protection Commission announced that Meta has committed to stop processing EU/EEA user data for undefined AI techniques following 11 noyb complaints. Meta had previously relied on a "legitimate interest" argument. The…
Data Protection Commission (DPC) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jun 13, 2024
noyb files complaint with Austrian DPA over Google Chrome consent pop‑up
noyb alleges that Google Chrome’s “Privacy Sandbox” pop‑up misleads users into consenting to first‑party tracking for targeted advertising. The complaint asks the Austrian data protection authority to require Google to cease processing…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Jun 6, 2024 · effective Jun 26, 2024
noyb files complaints in 11 EU DPAs to halt Meta's AI data use
noyb has lodged complaints with data protection authorities in Austria, Belgium, France, Germany, Greece, Italy, Ireland, the Netherlands, Norway, Poland and Spain, requesting an urgency procedure to stop Meta's planned use of personal…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jun 5, 2024
noyb files GDPR complaint against Austrian newspaper Kurier over forced consent
noyb lodged a GDPR complaint against Kurier for forcing users to accept tracking cookies. The Austrian DSB had previously banned the same practice at Profil and ordered compliance, which was not implemented. On 20 August 2024 the DSB…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Investigation
Announced
Austria · Jun 4, 2024
noyb files complaints urging Austrian DSB to investigate Microsoft 365 Education for GDPR violations affecting children
noyb has lodged two complaints with Austria's data protection authority alleging that Microsoft 365 Education breaches GDPR rights of minors by shifting responsibility to schools, providing vague privacy information, and tracking users…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
High
Fine
In effect
Ireland · May 24, 2024 · effective Aug 25, 2026
Irish Data Protection Commission fines HSE €645,000 for GDPR breaches over paper record storage
The Data Protection Commission (DPC) issued a final decision on 25 August 2026, fining the Health Service Executive (HSE) €645,000 for multiple GDPR infringements related to the storage and security of paper medical records. The DPC also…
Data Protection Commission (Ireland) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Apr 29, 2024
noyb files complaint with Austrian DPA over OpenAI's ChatGPT inaccurate personal data
noyb filed a complaint with the Austrian Data Protection Authority alleging that OpenAI cannot correct inaccurate personal data generated by ChatGPT, violating GDPR Articles 5, 15 and 16. The complaint seeks an investigation, compliance…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Apr 25, 2024
CJEU Advocate General says Facebook must limit personal data for ads under GDPR data‑minimisation
The Advocate General’s opinion interprets Article 5(1)(c) GDPR to require Meta to restrict the use of personal data for targeted advertising by time, type and source. It also addresses purpose‑limitation, stating that publicly disclosed…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Apr 17, 2024
EDPB opinion bars Meta from using 'Pay or Okay' consent model
The European Data Protection Board issued an opinion stating that Meta may not rely on a pay‑or‑consent scheme to process personal data for behavioural advertising. The decision requires Meta to offer a genuine opt‑in choice rather than a…
European Data Protection Board · General Data Protection Regulation
Low
Court ruling
Decided
European Union · Apr 9, 2024
CJEU ruling in July 2023 declares Meta's data handling illegal, prompting pay‑or‑consent model
A Court of Justice of the European Union ruling in July 2023 found Meta's handling of user data illegal. In response, Meta introduced a paid subscription in November 2023 that forces users to either pay or consent to tracking for targeted…
Moderate
Guidance
Announced
European Union · Mar 19, 2024
EDPB to issue binding opinion on Meta's 'Pay or Okay' consent model
The European Data Protection Board (EDPB) plans to issue a binding opinion on the legality of Meta's "Pay or Okay" system that charges users to refuse tracking. The opinion could legitimize the practice across the EU, threatening the GDPR…
European Data Protection Board · General Data Protection Regulation
Low
Enforcement
Filed
Sweden · Mar 14, 2024
noyb files complaint against Swedish data broker MrKoll over media licence GDPR exemption
noyb has filed a complaint with the Swedish Data Protection Authority (IMY) challenging the use of a media licence that exempts data broker MrKoll from GDPR obligations. The complaint requests deletion of the complainant’s data…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
