Moderate
Court ruling
Decided
Germany · May 23, 2025
German Higher Regional Court denies interim injunction against Meta AI training
The Higher Regional Court of Cologne refused the interim injunction sought by Verbraucherzentrale NRW, which alleged Meta's AI training violates the GDPR by using user data without consent. The court's decision is limited to the interim…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Jan 29, 2025
EU General Court rules Irish DPC acted unlawfully for refusing to investigate noyb complaint
The EU General Court held that the Irish Data Protection Commission unlawfully refused to investigate a complaint filed by noyb. The court dismissed the DPC's claims against the European Data Protection Board. The case can now be appealed…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jan 9, 2025
CJEU rules Austrian DPA cannot limit data subject complaints to two per month
The Court of Justice of the EU (CJEU) in case C-416/23 held that the Austrian Data Protection Authority (DSB) may not cap the number of complaints a data subject can file. The judgment confirms that users have the right to have any GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
Italy · Dec 19, 2024
noyb files GDPR complaint against Ryanair over mandatory biometric face scans
noyb has filed a complaint with the Italian Data Protection Authority alleging that Ryanair forces new customers to create permanent accounts and undergo a biometric facial‑recognition verification to book flights. The complaint says this…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
Moderate
Enforcement
Decided
European Union · Dec 13, 2024
EDPS finds European Commission illegally used political micro‑targeting
The European Data Protection Supervisor issued a decision that the European Commission illegally targeted ads using sensitive political data. The EDPS issued only a reprimand, noting no fine was needed as the practice stopped. The decision…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Interpretation
In effect
European Union · Dec 2, 2024 · effective Dec 2, 2024
noyb qualified as EU 'Qualified Entity' to bring collective GDPR redress actions
noyb has been approved as a Qualified Entity under Directive (EU) 2020/1828, allowing it to bring collective injunctions and redress actions across the EU. Approvals were issued by Austria's Bundeskartellamt on 2 December 2024 and…
Bundeskartellamt; Irish Ministry for Justice · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Oct 4, 2024
CJEU rules Meta must minimise use of personal data for ads
The Court of Justice of the European Union (CJEU) held that Meta must limit the processing of personal data for online advertising to what is strictly necessary, applying the GDPR data‑minimisation principle regardless of consent. It also…
EDPB · General Data Protection Regulation
Moderate
Enforcement
In effect
Belgium · Sep 12, 2024
Belgian DPA orders Mediahuis news sites to add reject button to cookie banners, imposes daily penalty
The Belgian Data Protection Authority ordered four Mediahuis news sites to add a “reject” button on the first layer of their cookie banners and to change misleading button colours. Non‑compliance triggers a penalty of €50,000 per day per…
Belgian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 12, 2024
noyb files nine GDPR complaints against X over AI training of 60 million EU users
noyb has lodged GDPR complaints in Austria, Belgium, France, Greece, Ireland, Italy, the Netherlands, Spain and Poland alleging that X used personal data of over 60 million EU/EEA users to train its AI system without consent. The Irish…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Jun 6, 2024 · effective Jun 26, 2024
noyb files complaints in 11 EU DPAs to halt Meta's AI data use
noyb has lodged complaints with data protection authorities in Austria, Belgium, France, Germany, Greece, Italy, Ireland, the Netherlands, Norway, Poland and Spain, requesting an urgency procedure to stop Meta's planned use of personal…
EDPB · General Data Protection Regulation
Moderate
Investigation
Announced
Austria · Jun 4, 2024
noyb files complaints urging Austrian DSB to investigate Microsoft 365 Education for GDPR violations affecting children
noyb has lodged two complaints with Austria's data protection authority alleging that Microsoft 365 Education breaches GDPR rights of minors by shifting responsibility to schools, providing vague privacy information, and tracking users…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Apr 25, 2024
CJEU Advocate General says Facebook must limit personal data for ads under GDPR data‑minimisation
The Advocate General’s opinion interprets Article 5(1)(c) GDPR to require Meta to restrict the use of personal data for targeted advertising by time, type and source. It also addresses purpose‑limitation, stating that publicly disclosed…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Apr 17, 2024
EDPB opinion bars Meta from using 'Pay or Okay' consent model
The European Data Protection Board issued an opinion stating that Meta may not rely on a pay‑or‑consent scheme to process personal data for behavioural advertising. The decision requires Meta to offer a genuine opt‑in choice rather than a…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Mar 19, 2024
EDPB to issue binding opinion on Meta's 'Pay or Okay' consent model
The European Data Protection Board (EDPB) plans to issue a binding opinion on the legality of Meta's "Pay or Okay" system that charges users to refuse tracking. The opinion could legitimize the practice across the EU, threatening the GDPR…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Feb 16, 2024
28 NGOs urge EU Data Protection Board to reject Meta's 'Pay or Okay' consent model
A coalition of 28 NGOs, including Wikimedia Europe, Bits of Freedom and the Norwegian Consumer Council, sent a joint letter to the European Data Protection Board requesting a binding opinion on Meta's "Pay or Okay" system, which forces…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Data protection authority action
Published
DE-BAVARIA · Feb 5, 2024
Bavarian DPA declares CRIF‑Acxiom data trading illegal under GDPR
The Bavarian data protection authority ruled that credit reference agency CRIF illegally purchased personal data from address trader Acxiom and breached GDPR purpose‑limitation and information duties. The decision follows a similar…
Bavarian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jan 28, 2024
Survey finds 74% of insiders say authorities would find GDPR violations in average EU company
A noyb survey of over 1,000 data‑protection professionals reports that 74% believe authorities would discover relevant GDPR violations during on‑site inspections. Respondents cite lack of clear DPA decisions, fines, and public enforcement…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Dec 7, 2023
CJEU rules automated credit scoring violates GDPR and expands judicial review of DPAs
The Court of Justice of the European Union issued two judgments: one confirming national courts can fully review DPA decisions, and another finding that automatically calculated credit scores breach Article 22 GDPR. The rulings require…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · Nov 28, 2023
noyb files GDPR complaint against Meta over “Pay or Okay” tracking fee
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Meta’s practice of charging users up to €251.88 a year to avoid personalized advertising violates GDPR consent requirements. The complaint references the…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Nov 16, 2023
noyb files complaint with EDPS over EU Commission’s political micro‑targeting ads on X
noyb lodged a complaint with the European Data Protection Supervisor alleging the EU Commission used unlawful micro‑targeting on X to promote its chat‑control proposal. The ads targeted users based on political views and religious beliefs…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
