Low
Lawsuit filed
Filed
United States (federal) · Sep 15, 2026
EPIC sues DHS over expansion of SAVE voter eligibility program
The Electronic Privacy Information Center (EPIC) and the League of Women Voters filed a lawsuit challenging DHS’s attempt to expand the SAVE system to check voter eligibility, alleging violations of the U.S. Constitution and federal…
U.S. Constitution
Low
Court ruling
Decided
United States (federal) · Sep 9, 2026
2015 court ruling requires warrant for police use of stingray devices
A Baltimore judge concluded that law enforcement hid its use of a Stingray device by using a pen register order, violating disclosure obligations. The decision resulted in a landmark 2015 privacy ruling that police must obtain a warrant to…
Moderate
Lawsuit filed
Filed
United States (federal) · Sep 8, 2026
EFF releases 1,000 pages of CMS records on AI-driven Medicare WISeR prior‑authorization program
EFF obtained about 1,000 pages of CMS documents through its FOIA lawsuit filed in March, revealing delays, denials, and financial incentives in the WISeR AI model. The records show requests sometimes waited up to 83 days and vendors denied…
Centers for Medicare & Medicaid Services (CMS)
Low
Court ruling
Decided
United States (federal) · Sep 2, 2026
Federal judge rules DoD illegally retaliated against Anthropic for refusing mass surveillance use
Anthropic sued the Department of Defense after being labeled a “supply chain risk” for refusing to let its AI be used for mass surveillance of U.S. persons. A federal judge held that the designation was unlawful retaliation in violation of…
First Amendment
Moderate
Court ruling
Decided
Austria · Sep 1, 2026
Austrian Supreme Court rules CRIF’s use of address‑publisher data for credit scoring violates GDPR purpose limitation
The Austrian Supreme Court (OGH) held that credit reference agencies may not collect personal data from address publishers that process the data for marketing purposes, confirming a GDPR purpose‑limitation breach. The ruling supports…
EDPB · General Data Protection Regulation
Low
Lawsuit filed
Filed
California · Aug 26, 2026
EFF and ACLU sue San Jose Police over warrantless ALPR searches
The Electronic Frontier Foundation and the ACLU of Northern California have filed a lawsuit in California state court challenging the San Jose Police Department's practice of searching stored license‑plate data without a warrant. The suit…
California Constitution
Moderate
Court ruling
Decided
France · Aug 26, 2026
French Constitutional Council strikes down law banning social media for under‑15s
France’s top court invalidated the legislation that prohibited people under 15 from using social media. The Council found the ban infringed freedom of expression and the right to private life by imposing mandatory age verification. The…
Moderate
Court ruling
Decided
France · Aug 14, 2026
French Constitutional Council strikes down law banning under‑15s from social media
On 14 August 2026 the French Constitutional Council invalidated Article 1 of the Act that would have barred minors under 15 from accessing online social media. The Council found the ban disproportionate, lacking individual assessment, and…
European Commission · Digital Services Act
Moderate
Court ruling
Decided
United States (federal) · Jun 29, 2026
US Supreme Court decision undermines EU‑US Data Privacy Framework
The US Supreme Court ruled in Trump v. Slaughter that the FTC cannot be an independent agency. The decision calls into question the independence requirement for the EU‑US Data Privacy Framework, effectively collapsing the adequacy…
EDPB · General Data Protection Regulation
Moderate
Lawsuit filed
Filed
Germany · Apr 30, 2026
noyb files lawsuit against Hamburg DPA over inaction on PimEyes biometric data case
noyb has filed a lawsuit against the Hamburg Data Protection Authority, alleging that the authority has failed to act on illegal biometric data processing by PimEyes. The DPA considers PimEyes' facial recognition practices illegal but…
Hamburg Data Protection Authority · General Data Protection Regulation
Low
Lawsuit filed
Filed
Germany · Jan 28, 2026
noyb files lawsuit against Hamburg DPA over Pay or Okay case involving SPIEGEL
In 2024, privacy advocacy group noyb sued the Hamburg Data Protection Authority concerning a Pay or Okay implementation dispute with the German news magazine SPIEGEL. The case highlights concerns about DPA impartiality and enforcement…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Dec 18, 2025 · deadline Dec 31, 2025
Austrian Supreme Court orders Meta to give users full data access within 14 days
The Austrian Supreme Court ruled that Meta must provide a complete copy of all personal data to any user request within 14 days, including source, recipient and purpose information. The court also required Meta to obtain explicit opt‑in…
EDPB · General Data Protection Regulation
Low
Court ruling
Decided
European Union · Sep 3, 2025
EU General Court rejects Latombe challenge to EU‑US data transfer framework
French MP Philippe Latombe filed an action for annulment of the Transatlantic Data Protection Framework before the EU General Court. The General Court dismissed the narrow challenge, finding it unconvincing. The decision leaves the…
Transatlantic Data Protection Framework
Moderate
Court ruling
Decided
Austria · Aug 18, 2025
Austrian Federal Administrative Court rules DerStandard's "pay or okay" consent model illegal
The Austrian Federal Administrative Court (BVwG) confirmed the Data Protection Authority's finding that DerStandard violated the GDPR by offering a "pay or okay" choice. The court held that the newspaper did not obtain valid, granular…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Jul 31, 2025
CJEU ruling C‑446/21 limits use of personal data for online advertising and repurposing publicly available data
The European Court of Justice issued ruling C‑446/21, fully backing a lawsuit against Meta's Facebook service. The court massively limits the use of personal data for online advertising and restricts the reuse of publicly available…
EDPB · General Data Protection Regulation
Low
Lawsuit filed
Filed
Germany · Jun 17, 2025
noyb sues German DPAs over inactivity on ‘Pay or OK’ GDPR complaints
noyb filed complaints in August 2021 against news sites using ‘Pay or OK’ consent mechanisms, alleging they violate the GDPR’s freely given consent requirement. After nearly four years of inaction, the North Rhine‑Westphalia and Hesse data…
EDPB · General Data Protection Regulation
Moderate
Class action
Announced
Austria · Jun 3, 2025
noyb seeks participants for potential GDPR class action against Austrian credit agency CRIF
noyb alleges that CRIF processes personal data of millions of Austrians to calculate credit scores based on age, gender and address, potentially violating the GDPR. The organization plans a scientific review and, if evidence supports it…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Germany · May 23, 2025
German Higher Regional Court denies interim injunction against Meta AI training
The Higher Regional Court of Cologne refused the interim injunction sought by Verbraucherzentrale NRW, which alleged Meta's AI training violates the GDPR by using user data without consent. The court's decision is limited to the interim…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Jan 29, 2025
EU General Court rules Irish DPC acted unlawfully for refusing to investigate noyb complaint
The EU General Court held that the Irish Data Protection Commission unlawfully refused to investigate a complaint filed by noyb. The court dismissed the DPC's claims against the European Data Protection Board. The case can now be appealed…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jan 9, 2025
CJEU rules Austrian DPA cannot limit data subject complaints to two per month
The Court of Justice of the EU (CJEU) in case C-416/23 held that the Austrian Data Protection Authority (DSB) may not cap the number of complaints a data subject can file. The judgment confirms that users have the right to have any GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
