Moderate
Court ruling
Pending
United States (federal) · Sep 23, 2026
Supreme Court hears digital‑privacy case involving Paramount and targeted advertising
The Electronic Privacy Information Center argued before the Supreme Court that Paramount and other online‑video companies are not obligated to use targeted advertising systems and can adopt privacy‑protective techniques. The case could set…
Moderate
Court ruling
Pending
United States (federal) · Sep 21, 2026
Supreme Court to decide VPPA consumer definition in Salazar v. Paramount Global
The Supreme Court will hear Salazar v. Paramount Global in the October 2026 term to resolve a circuit split on the definition of “consumer” under the Video Privacy Protection Act. The case arises from a class action alleging Paramount…
Video Privacy Protection Act
Moderate
Lawsuit filed
Filed
European Union · Jan 28, 2026
noyb debunks 5 GDPR misconceptions on Data Protection Day
The article clarifies that the GDPR does not mandate cookie banners, that DPAs rarely impose fines, and that companies must obtain explicit consent for tracking. It also explains the limited scope of the right of access and counters claims…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Dec 18, 2025 · deadline Dec 31, 2025
Austrian Supreme Court orders Meta to give users full data access within 14 days
The Austrian Supreme Court ruled that Meta must provide a complete copy of all personal data to any user request within 14 days, including source, recipient and purpose information. The court also required Meta to obtain explicit opt‑in…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Aug 18, 2025
Austrian Federal Administrative Court rules DerStandard's "pay or okay" consent model illegal
The Austrian Federal Administrative Court (BVwG) confirmed the Data Protection Authority's finding that DerStandard violated the GDPR by offering a "pay or okay" choice. The court held that the newspaper did not obtain valid, granular…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Jul 31, 2025
CJEU ruling C‑446/21 limits use of personal data for online advertising and repurposing publicly available data
The European Court of Justice issued ruling C‑446/21, fully backing a lawsuit against Meta's Facebook service. The court massively limits the use of personal data for online advertising and restricts the reuse of publicly available…
EDPB · General Data Protection Regulation
Moderate
Class action
Announced
Austria · Jun 3, 2025
noyb seeks participants for potential GDPR class action against Austrian credit agency CRIF
noyb alleges that CRIF processes personal data of millions of Austrians to calculate credit scores based on age, gender and address, potentially violating the GDPR. The organization plans a scientific review and, if evidence supports it…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Germany · May 23, 2025
German Higher Regional Court denies interim injunction against Meta AI training
The Higher Regional Court of Cologne refused the interim injunction sought by Verbraucherzentrale NRW, which alleged Meta's AI training violates the GDPR by using user data without consent. The court's decision is limited to the interim…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Jan 29, 2025
EU General Court rules Irish DPC acted unlawfully for refusing to investigate noyb complaint
The EU General Court held that the Irish Data Protection Commission unlawfully refused to investigate a complaint filed by noyb. The court dismissed the DPC's claims against the European Data Protection Board. The case can now be appealed…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jan 9, 2025
CJEU rules Austrian DPA cannot limit data subject complaints to two per month
The Court of Justice of the EU (CJEU) in case C-416/23 held that the Austrian Data Protection Authority (DSB) may not cap the number of complaints a data subject can file. The judgment confirms that users have the right to have any GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Oct 4, 2024
CJEU rules Meta must minimise use of personal data for ads
The Court of Justice of the European Union (CJEU) held that Meta must limit the processing of personal data for online advertising to what is strictly necessary, applying the GDPR data‑minimisation principle regardless of consent. It also…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Dec 7, 2023
CJEU rules automated credit scoring violates GDPR and expands judicial review of DPAs
The Court of Justice of the European Union issued two judgments: one confirming national courts can fully review DPA decisions, and another finding that automatically calculated credit scores breach Article 22 GDPR. The rulings require…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Germany · Jul 4, 2023
CJEU rules Meta must rely on consent for advertising, limiting GDPR bypass attempts
The Court of Justice of the EU held that Meta may only process personal data for core services and must obtain freely given consent for advertising and data sharing. The judgment rejects Meta's reliance on contractual necessity and…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jul 20, 2021
Austrian Supreme Court refers Facebook case to CJEU over consent vs contract and awards €500 symbolic damages
The Austrian Supreme Court (OGH) referred four questions to the Court of Justice of the EU concerning Facebook's reliance on contract instead of consent under the GDPR. In a partial judgment, the court awarded Max Schrems €500 for lack of…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Pending
Austria · Mar 14, 2021
Austrian Supreme Court to consider referral of Facebook GDPR consent bypass case
The Austrian Supreme Court (OGH) has been asked to refer a case concerning Facebook's alleged bypass of GDPR consent rules to the CJEU. The dispute centers on Facebook's claim that a contractual duty to provide personalized advertising…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Dec 29, 2020
Vienna Superior Court orders Facebook to pay €500 and grant full data access
The Viennese Superior Court ruled that Facebook must pay Mr. Schrems €500 in emotional damages and provide him full access to all personal data the company holds about him. The court held that Facebook does not need user consent under GDPR…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Pending
Austria · Feb 26, 2020
Vienna Regional Court closes oral hearing in GDPR case against Facebook, judgment pending
The Vienna Regional Court for Civil Matters (LGfZRS) ended a nine‑hour oral hearing in a data‑protection lawsuit against Facebook. The court will issue a written judgment in the coming months and the case is expected to be appealed to…
EDPB · General Data Protection Regulation
