Moderate
Consent order
Amended
United States (federal) · May 15, 2025
CFPB amends Wise consent order over inaccurate fee disclosures
The Consumer Financial Protection Bureau amended its January 30, 2025 consent order with Wise, an international remittance company. The amendment resolves claims that Wise advertised inaccurate fees and failed to properly disclose exchange…
Consumer Financial Protection Bureau
Low
Enforcement
Announced
Ireland · May 14, 2025
noyb sends cease and desist letter to Meta over AI training using EU personal data
noyb has issued a cease and desist letter to Meta, alleging that the company will use EU personal data from Instagram and Facebook for AI training without opt‑in consent. The letter relies on the EU Collective Redress Directive, which…
EDPB · General Data Protection Regulation
Low
Enforcement
Announced
DE-NRW · May 6, 2025
Consumer group asks Meta to stop AI training on EU user data
The Verbraucherzentrale North Rhine-Westphalia sent Meta a cease‑and‑desist letter on 30 April 2025 demanding it halt the use of Instagram and Facebook posts for AI training, citing GDPR consent requirements. Noyb supports the request…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Apr 24, 2025
noyb files GDPR complaint against Ubisoft for forced online tracking of offline games
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Ubisoft requires players to be online for single‑player games, collecting personal data such as start time, duration and quit time. The complaint argues the…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Apr 17, 2025
EU's draft GDPR Procedural Regulation faces criticism for increasing complexity
The European Commission has introduced a draft GDPR Procedural Regulation to improve cross‑border DPA cooperation. The proposal is currently in trilogue negotiations with the European Parliament and the Council. Critics argue the draft…
European Commission · General Data Protection Regulation
Low
Enforcement
Filed
Sweden · Apr 3, 2025
noyb files appeal against Swedish Tax Authority for selling personal data
noyb has filed an appeal with the Stockholm Administrative Court seeking to stop the Swedish Tax Authority from selling personal data to data brokers. The appeal follows a Swedish Supreme Court ruling that data likely to be processed in…
EDPB · General Data Protection Regulation
Moderate
Guidance
Published
United States (federal) · Mar 31, 2025
2024 HMDA Modified LAR Data Now Available on FFIEC Platform
The Home Mortgage Disclosure Act (HMDA) Modified Loan Application Register data for 2024 have been released on the FFIEC HMDA Platform for about 4,898 filers. The loan‑level data are modified to protect consumer privacy and are now…
Consumer Financial Protection Bureau · Home Mortgage Disclosure Act
Moderate
Enforcement
Filed
Norway (EEA) · Mar 20, 2025
noyb files second GDPR complaint against OpenAI over defamatory AI hallucinations in Norway
noyb filed a second complaint with the Norwegian Data Protection Authority alleging that OpenAI's ChatGPT generated false, defamatory personal data about a Norwegian user. The complaint cites violations of GDPR Article 5(1)(d) on data…
Norwegian Datatilsynet · General Data Protection Regulation
Low
Enforcement
Filed
Sweden · Feb 27, 2025
Swedbank denies data subject access to mortgage rate logic, noyb files complaint with Swedish DPA
Swedbank rejected a Swedish citizen's request for information on how its automated mortgage interest rate is calculated, citing a trade‑secret claim. The refusal appears to breach Article 15(1)(h) of the GDPR, which requires meaningful…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Feb 21, 2025
noyb files GDPR complaints against six German parties for illegal political microtargeting
In March 2023, noyb filed complaints with the Berlin and Bavarian Data Protection Authorities alleging that six German political parties used political microtargeting on Facebook during the 2021 election, violating Article 9 GDPR. The DPAs…
Berlin Data Protection Authority; Bavarian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
DE-NRW · Feb 12, 2025
noyb files complaint against WetterOnline for refusing GDPR access request
WetterOnline shares precise location data with more than 300 third‑party advertising companies and rejected a data‑subject access request, citing a "disproportionate effort". noyb filed a complaint with the North Rhine‑Westphalia data…
Data protection authority of North Rhine-Westphalia · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Jan 29, 2025
EU General Court rules Irish DPC acted unlawfully for refusing to investigate noyb complaint
The EU General Court held that the Irish Data Protection Commission unlawfully refused to investigate a complaint filed by noyb. The court dismissed the DPC's claims against the European Data Protection Board. The case can now be appealed…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Published
European Union · Jan 28, 2025
Only 1.3% of GDPR cases before EU DPAs result in a fine, analysis shows
A noyb analysis of EDPB statistics finds that, on average, just 1.3% of cases before national data protection authorities end in a fine. Between 2018 and 2023 EU DPAs imposed €4.29 billion in fines, with almost 40% stemming from noyb…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Executive order
Signed
United States (federal) · Jan 23, 2025
Trump signs executive order that could dismantle EU-US Transatlantic Data Privacy Framework
The US President signed an executive order stating that all Biden-era national security decisions, including those underpinning the EU‑US data transfer framework, will be reviewed and possibly revoked within 45 days. The Transatlantic Data…
European Commission · EU-U.S. Data Privacy Framework
Moderate
Enforcement
Filed
European Union · Jan 16, 2025
noyb files GDPR complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi over transfers to China
noyb has lodged six GDPR complaints in five EU countries alleging unlawful transfers of Europeans' personal data to China by TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi. The complaints request that DPAs suspend the transfers under…
European Commission · Standard Contractual Clauses
Moderate
Court ruling
Decided
Austria · Jan 9, 2025
CJEU rules Austrian DPA cannot limit data subject complaints to two per month
The Court of Justice of the EU (CJEU) in case C-416/23 held that the Austrian Data Protection Authority (DSB) may not cap the number of complaints a data subject can file. The judgment confirms that users have the right to have any GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
Italy · Dec 19, 2024
noyb files GDPR complaint against Ryanair over mandatory biometric face scans
noyb has filed a complaint with the Italian Data Protection Authority alleging that Ryanair forces new customers to create permanent accounts and undergo a biometric facial‑recognition verification to book flights. The complaint says this…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
Moderate
Fine
Decided
Netherlands · Dec 18, 2024
Dutch DPA fines Netflix €4.75 million for inadequate data‑subject information
The Dutch Data Protection Authority issued a decision imposing a €4.75 million fine on Netflix for not adequately informing customers about its data processing. The authority found Netflix failed to provide clear information and a full…
Dutch Data Protection Authority (Autoriteit Persoonsgegevens) · General Data Protection Regulation
Moderate
Enforcement
Decided
European Union · Dec 13, 2024
EDPS finds European Commission illegally used political micro‑targeting
The European Data Protection Supervisor issued a decision that the European Commission illegally targeted ads using sensitive political data. The EDPS issued only a reprimand, noting no fine was needed as the practice stopped. The decision…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Low
Enforcement
Filed
France · Dec 12, 2024
noyb files complaint against BeReal for forced consent dark pattern in France
noyb has lodged a complaint with the French data protection authority (CNIL) alleging that BeReal uses a dark‑pattern consent banner that forces users to accept tracking for advertising. The complaint argues the consent is not freely…
CNIL · General Data Protection Regulation
