GERMANY

Low Enforcement Announced Germany · Sep 10, 2026

noyb to file injunction against SCHUFA over shadow database

noyb sent a cease-and-desist letter to SCHUFA demanding the removal of its shadow database. SCHUFA's deadline to comply has expired and the agency has rejected the allegations. noyb announced it will now file an injunction and invites…

Low Enforcement Announced Germany · Aug 26, 2026 · effective Aug 26, 2026

noyb sends cease‑and‑desist letter to SCHUFA over alleged ‘shadow database’ GDPR violations

In July 2026, the NGO noyb issued a cease‑and‑desist letter to German credit agency SCHUFA demanding it stop storing data beyond retention periods and provide full historical data under Article 15 GDPR. The organization warned it will seek…

EDPB · General Data Protection Regulation

Moderate Lawsuit filed Filed Germany · Apr 30, 2026

noyb files lawsuit against Hamburg DPA over inaction on PimEyes biometric data case

noyb has filed a lawsuit against the Hamburg Data Protection Authority, alleging that the authority has failed to act on illegal biometric data processing by PimEyes. The DPA considers PimEyes' facial recognition practices illegal but…

Hamburg Data Protection Authority · General Data Protection Regulation

Low Lawsuit filed Filed Germany · Jan 28, 2026

noyb files lawsuit against Hamburg DPA over Pay or Okay case involving SPIEGEL

In 2024, privacy advocacy group noyb sued the Hamburg Data Protection Authority concerning a Pay or Okay implementation dispute with the German news magazine SPIEGEL. The case highlights concerns about DPA impartiality and enforcement…

Hamburg Data Protection Authority · General Data Protection Regulation

Low Enforcement Announced Germany · Aug 7, 2025

noyb sends cease‑and‑desist to Meta over AI training of EU users’ data

noyb commissioned a Gallup survey of 1,000 German Meta users, finding only 7% want their personal data used for AI training. Based on the results, noyb sent a cease‑and‑desist letter to Meta alleging GDPR violations and is assessing a…

EDPB · General Data Protection Regulation

Low Lawsuit filed Filed Germany · Jun 17, 2025

noyb sues German DPAs over inactivity on ‘Pay or OK’ GDPR complaints

noyb filed complaints in August 2021 against news sites using ‘Pay or OK’ consent mechanisms, alleging they violate the GDPR’s freely given consent requirement. After nearly four years of inaction, the North Rhine‑Westphalia and Hesse data…

EDPB · General Data Protection Regulation

Moderate Court ruling Decided Germany · May 23, 2025

German Higher Regional Court denies interim injunction against Meta AI training

The Higher Regional Court of Cologne refused the interim injunction sought by Verbraucherzentrale NRW, which alleged Meta's AI training violates the GDPR by using user data without consent. The court's decision is limited to the interim…

Hamburg Data Protection Authority · General Data Protection Regulation

Low Enforcement Filed Germany · Feb 21, 2025

noyb files GDPR complaints against six German parties for illegal political microtargeting

In March 2023, noyb filed complaints with the Berlin and Bavarian Data Protection Authorities alleging that six German political parties used political microtargeting on Facebook during the 2021 election, violating Article 9 GDPR. The DPAs…

Berlin Data Protection Authority; Bavarian Data Protection Authority · General Data Protection Regulation

Low Court ruling Decided Germany · Nov 19, 2024

German Federal Court rules loss of control over personal data is compensable under GDPR

The Bundesgerichtshof held that the mere loss of control over one's personal data can constitute damage under the GDPR. The court said this damage is compensable when it results from a GDPR violation, without needing additional negative…

EDPB · General Data Protection Regulation

Low Lawsuit filed Filed Germany · Aug 1, 2024

Complainant sues Hamburg DPA over ‘Pay or OK’ consent ruling

A GDPR complainant has filed a lawsuit with the Hamburg Administrative Court to overturn the Hamburg data protection authority's decision that the ‘Pay or OK’ consent model used by DER SPIEGEL is permissible. The complainant argues the…

Hamburg data protection authority · General Data Protection Regulation

Low Enforcement Filed Germany · Feb 16, 2024

noyb files complaint against German credit agency SCHUFA for GDPR access violations

noyb has lodged a complaint and report with the Hessian data protection authority alleging that SCHUFA blocks free access to personal data required under Article 15 GDPR. The agency allegedly uses manipulative designs to push paid products…

Hessian data protection authority · General Data Protection Regulation

Moderate Court ruling Decided Germany · Jul 4, 2023

CJEU rules Meta must rely on consent for advertising, limiting GDPR bypass attempts

The Court of Justice of the EU held that Meta may only process personal data for core services and must obtain freely given consent for advertising and data sharing. The judgment rejects Meta's reliance on contractual necessity and…

EDPB · General Data Protection Regulation

Low Enforcement Filed Germany · Mar 21, 2023

noyb files GDPR complaints against German parties for political microtargeting on Facebook

noyb filed a series of complaints against several German political parties alleging unlawful political microtargeting on Facebook during the 2021 federal election. The complaints claim violations of the GDPR because the parties and…

EDPB · General Data Protection Regulation

Low Enforcement Announced Germany · Dec 10, 2021

noyb and ZDF Magazin Royale seek data donors to enforce GDPR micro‑targeting ban

noyb and ZDF Magazin Royale are asking users of the "Who Targets Me" browser extension from the 2021 German federal election to donate their data. The aim is to find a case to enforce the GDPR prohibition on political micro‑targeting under…

EDPB · General Data Protection Regulation

Low Enforcement Filed Germany · Oct 18, 2021

noyb files GDPR complaint against Acxiom and CRIF Bürgel over illegal credit scores

noyb lodged a complaint in Germany alleging that address trader Acxiom and credit reference agency CRIF Bürgel illegally use personal data to calculate credit scores without consent, violating the GDPR and the German Federal Data…

EDPB · General Data Protection Regulation

Moderate Enforcement Announced Germany · Jan 28, 2021 · deadline Feb 12, 2021

Hamburg DPA preliminarily deems Clearview AI’s biometric profiling of EU residents illegal and orders partial deletion

The Hamburg Data Protection Authority preliminarily found that Clearview AI’s collection of biometric profiles of Europeans violates the GDPR and ordered the deletion of the mathematical hash values of the complainant’s biometric profile.…

Hamburg Data Protection Authority · General Data Protection Regulation

Low Enforcement Filed Germany · Nov 16, 2020

noyb files complaints against Apple's IDFA tracking code

The privacy NGO noyb filed two complaints with the German and Spanish data protection authorities alleging that Apple's Identifier for Advertisers (IDFA) tracks users without consent, violating the EU e‑Privacy Directive. The complaints…

EDPB · General Data Protection Regulation