Moderate
Court ruling
Decided
France · Aug 26, 2026
French Constitutional Council strikes down law banning social media for under‑15s
France’s top court invalidated the legislation that prohibited people under 15 from using social media. The Council found the ban infringed freedom of expression and the right to private life by imposing mandatory age verification. The…
Moderate
Court ruling
Decided
France · Aug 14, 2026
French Constitutional Council strikes down law banning under‑15s from social media
On 14 August 2026 the French Constitutional Council invalidated Article 1 of the Act that would have barred minors under 15 from accessing online social media. The Council found the ban disproportionate, lacking individual assessment, and…
European Commission · Digital Services Act
Moderate
Proposed bill
In committee
United States (federal) · Aug 5, 2026
Senate Commerce Committee to vote on four privacy‑invasive bills (KOSA, SCREEN Act, Youth AI Privacy Act, CHATBOT Act)
The Senate Commerce Committee will vote this week on four bills: KOSA, the SCREEN Act, the Youth AI Privacy Act, and the CHATBOT Act. The bills are presented as child‑protection measures but are criticized for creating new privacy and…
U.S. Senate Commerce Committee · KOSA
Moderate
Guidance
Announced
Spain · Jul 27, 2026
AEPD announces 2026 Data Protection Awards to recognize privacy promotion
The Spanish Data Protection Agency (AEPD) has launched the ‘Premios Protección de Datos 2026’ with nine categories covering research, vulnerable groups, communication, education, best practices, legal research, social media diffusion, DPO…
Agencia Española de Protección de Datos (AEPD) · RGPD
Moderate
Data protection authority action
Decided
Austria · Jan 27, 2026
Austrian DSB orders Microsoft to stop tracking school children with cookies
The Austrian Data Protection Authority ruled that Microsoft illegally installed tracking cookies on a pupil's device without consent. The authority ordered Microsoft to cease the use of those cookies within four weeks. The decision follows…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Data protection authority action
Decided
Austria · Oct 9, 2025
Austrian DSB rules Microsoft 365 Education illegally tracks students and orders data deletion
The Austrian Data Protection Authority found Microsoft 365 Education used tracking cookies without consent and denied a data‑access request, violating GDPR. The DSB ordered Microsoft to delete the data, provide full access, and disclose…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Data protection authority action
Decided
Ireland · Jul 16, 2025
DPC issues final decision reprimanding Children’s Health Ireland for GDPR security breaches
The Irish Data Protection Commission concluded that Children’s Health Ireland (CHI) at Tallaght University Hospital breached GDPR security and confidentiality obligations. CHI was reprimanded and ordered to bring its processing into…
Data Protection Commission (Ireland) · General Data Protection Regulation
Moderate
Enforcement
Filed
Norway (EEA) · Mar 20, 2025
noyb files second GDPR complaint against OpenAI over defamatory AI hallucinations in Norway
noyb filed a second complaint with the Norwegian Data Protection Authority alleging that OpenAI's ChatGPT generated false, defamatory personal data about a Norwegian user. The complaint cites violations of GDPR Article 5(1)(d) on data…
Norwegian Datatilsynet · General Data Protection Regulation
Moderate
Investigation
Announced
Austria · Jun 4, 2024
noyb files complaints urging Austrian DSB to investigate Microsoft 365 Education for GDPR violations affecting children
noyb has lodged two complaints with Austria's data protection authority alleging that Microsoft 365 Education breaches GDPR rights of minors by shifting responsibility to schools, providing vague privacy information, and tracking users…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Nov 16, 2023
noyb files complaint with EDPS over EU Commission’s political micro‑targeting ads on X
noyb lodged a complaint with the European Data Protection Supervisor alleging the EU Commission used unlawful micro‑targeting on X to promote its chat‑control proposal. The ads targeted users based on political views and religious beliefs…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Enforcement
Filed
Belgium · Jun 23, 2023
noyb files complaint against TeleSign for unlawful profiling of mobile users
noyb filed a complaint with the Belgian Data Protection Authority alleging that TeleSign receives phone data from BICS and creates reputation scores without consent, violating the GDPR. The complaint cites the use of AI-generated trust…
Belgian Data Protection Authority · General Data Protection Regulation
Moderate
Data protection authority action
Published
Ireland · Jul 7, 2022
Irish DPC issues Draft Decision on Facebook EU-US data transfers, starts one-month comment period
The Irish Data Protection Commission issued a Draft Decision under Article 60 GDPR concerning Meta's Facebook EU‑US data transfers. The draft triggers a one‑month comment period for other European DPAs and does not immediately halt the…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Interpretation
Announced
European Union · May 22, 2022
Open Letter warns EU‑US data transfer deal lacks material US law changes
The open letter published on 2022‑05‑22 criticises the announced Trans‑Atlantic Data Privacy Framework for relying on US executive orders without substantive changes to US surveillance law. It argues that the framework repeats the…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · May 26, 2021 · effective May 25, 2018
Digital Rights alliance files legal complaints across Europe against facial recognition company Clearview AI
Noyb and other EU digital‑rights groups submitted complaints to data‑protection authorities in France, Austria, Italy, Greece and the United Kingdom to halt Clearview AI's mass facial‑recognition surveillance. The regulators have three…
EDPB · General Data Protection Regulation
Moderate
Guidance
Published
European Union · Apr 2, 2020
Noyb reports video conferencing tools' privacy policies fall short of GDPR obligations
The report examined the privacy policies of six video‑conferencing services (Zoom, Webex Meetings, Meeting, Skype, Teams, Wire) and found they lack clear GDPR information, such as basic rights and recipient details. An update on…
EDPB · General Data Protection Regulation
