Moderate
Guidance
Announced
European Union · Jul 24, 2025
Report flags 'Pay or Okay' consent‑bypass systems as violating GDPR free‑consent requirement
The noyb report documents the spread of “Pay or Okay” systems across Europe, where users must pay to refuse tracking, resulting in near‑universal consent rates that breach the GDPR’s freely‑given consent standard. It cites a July 2023 CJEU…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Jun 16, 2025
noyb warns Meta's planned WhatsApp ads may breach GDPR and DMA
noyb alleges that Meta's intention to serve ads on WhatsApp using personal data from Instagram and Facebook violates the GDPR and the EU Digital Markets Act. The organization says the proposed "Pay or Okay" model would not provide freely…
noyb · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Jan 29, 2025
EU General Court rules Irish DPC acted unlawfully for refusing to investigate noyb complaint
The EU General Court held that the Irish Data Protection Commission unlawfully refused to investigate a complaint filed by noyb. The court dismissed the DPC's claims against the European Data Protection Board. The case can now be appealed…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Decided
European Union · Dec 13, 2024
EDPS finds European Commission illegally used political micro‑targeting
The European Data Protection Supervisor issued a decision that the European Commission illegally targeted ads using sensitive political data. The EDPS issued only a reprimand, noting no fine was needed as the practice stopped. The decision…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Oct 4, 2024
CJEU rules Meta must minimise use of personal data for ads
The Court of Justice of the European Union (CJEU) held that Meta must limit the processing of personal data for online advertising to what is strictly necessary, applying the GDPR data‑minimisation principle regardless of consent. It also…
EDPB · General Data Protection Regulation
Moderate
Fine
Decided
Norway (EEA) · Jul 1, 2024 · effective Jul 1, 2024
Norwegian court confirms €5.7M fine for Grindr over GDPR breach
A Norwegian court upheld a fine of NOK 65 million (€5.7 million) against Grindr for violating the GDPR by sharing user data with advertisers. The ruling follows a complaint by the Norwegian Consumer Council, supported by noyb.
EDPB · General Data Protection Regulation
Moderate
Investigation
Announced
Austria · Jun 4, 2024
noyb files complaints urging Austrian DSB to investigate Microsoft 365 Education for GDPR violations affecting children
noyb has lodged two complaints with Austria's data protection authority alleging that Microsoft 365 Education breaches GDPR rights of minors by shifting responsibility to schools, providing vague privacy information, and tracking users…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Apr 25, 2024
CJEU Advocate General says Facebook must limit personal data for ads under GDPR data‑minimisation
The Advocate General’s opinion interprets Article 5(1)(c) GDPR to require Meta to restrict the use of personal data for targeted advertising by time, type and source. It also addresses purpose‑limitation, stating that publicly disclosed…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Apr 17, 2024
EDPB opinion bars Meta from using 'Pay or Okay' consent model
The European Data Protection Board issued an opinion stating that Meta may not rely on a pay‑or‑consent scheme to process personal data for behavioural advertising. The decision requires Meta to offer a genuine opt‑in choice rather than a…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Mar 19, 2024
EDPB to issue binding opinion on Meta's 'Pay or Okay' consent model
The European Data Protection Board (EDPB) plans to issue a binding opinion on the legality of Meta's "Pay or Okay" system that charges users to refuse tracking. The opinion could legitimize the practice across the EU, threatening the GDPR…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Feb 16, 2024
28 NGOs urge EU Data Protection Board to reject Meta's 'Pay or Okay' consent model
A coalition of 28 NGOs, including Wikimedia Europe, Bits of Freedom and the Norwegian Consumer Council, sent a joint letter to the European Data Protection Board requesting a binding opinion on Meta's "Pay or Okay" system, which forces…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · Nov 28, 2023
noyb files GDPR complaint against Meta over “Pay or Okay” tracking fee
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Meta’s practice of charging users up to €251.88 a year to avoid personalized advertising violates GDPR consent requirements. The complaint references the…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Nov 16, 2023
noyb files complaint with EDPS over EU Commission’s political micro‑targeting ads on X
noyb lodged a complaint with the European Data Protection Supervisor alleging the EU Commission used unlawful micro‑targeting on X to promote its chat‑control proposal. The ads targeted users based on political views and religious beliefs…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Interpretation
Announced
European Union · Oct 3, 2023
Meta proposes 'Pay for your Rights' model charging EU users €160/year for non‑consent
Meta plans to charge EU users €160 per year if they do not consent to the processing of their personal data on Facebook and Instagram. The proposal references an obiter dictum from the CJEU case C‑252/21 that an alternative to ads may be…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Fine
Decided
Norway (EEA) · Sep 29, 2023
Norwegian Privacy Appeals Board upholds €5.8 million fine against Grindr
The Norwegian Privacy Appeals Board confirmed the Norwegian Data Protection Authority's fine of NOK 65 million against the dating app Grindr for sharing sensitive personal data with third parties. The fine, approximately €5.8 million…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Aug 1, 2023
Meta to switch to consent for behavioral ads after EU litigation
Meta announced it will seek user consent before showing behavioral ads in the EU and Switzerland, changing its legal basis from legitimate interest to consent. The move follows litigation by noyb, decisions by the EDPB and the CJEU, and a…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
In effect
Norway (EEA) · Jul 17, 2023 · effective Aug 4, 2023
Norwegian DPA temporarily bans Meta’s behavioral advertising on Facebook and Instagram
The Norwegian Data Protection Authority (Datatilsynet) issued a temporary ban on Meta's use of behavioral advertising on Facebook and Instagram, effective from August 4 for at least three months. The ban remains until Meta can demonstrate…
Datatilsynet · General Data Protection Regulation
Moderate
Court ruling
Decided
Germany · Jul 4, 2023
CJEU rules Meta must rely on consent for advertising, limiting GDPR bypass attempts
The Court of Justice of the EU held that Meta may only process personal data for core services and must obtain freely given consent for advertising and data sharing. The judgment rejects Meta's reliance on contractual necessity and…
EDPB · General Data Protection Regulation
Moderate
Fine
In effect
France · Jun 22, 2023
French CNIL fines Criteo €40 million for GDPR violations
The French Data Protection Authority (CNIL) fined Criteo €40 million for violating the GDPR, including lack of valid consent, transparency, and failure to respect the right to erasure and access. The enforcement followed complaints filed…
CNIL · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Apr 4, 2023
noyb launches free tool for broad Facebook opt‑out under GDPR
The privacy NGO noyb released an online tool that lets users submit a broad objection to Meta’s processing of personal data for targeted advertising, which Meta bases on “legitimate interest”. The tool simplifies the GDPR right to object…
EDPB · General Data Protection Regulation
