Moderate
Enforcement
Announced
European Union · Jun 16, 2025
noyb warns Meta's planned WhatsApp ads may breach GDPR and DMA
noyb alleges that Meta's intention to serve ads on WhatsApp using personal data from Instagram and Facebook violates the GDPR and the EU Digital Markets Act. The organization says the proposed "Pay or Okay" model would not provide freely…
noyb · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · May 14, 2025
noyb sends cease and desist letter to Meta over AI training using EU personal data
noyb has issued a cease and desist letter to Meta, alleging that the company will use EU personal data from Instagram and Facebook for AI training without opt‑in consent. The letter relies on the EU Collective Redress Directive, which…
EDPB · General Data Protection Regulation
Low
Enforcement
Announced
DE-NRW · May 6, 2025
Consumer group asks Meta to stop AI training on EU user data
The Verbraucherzentrale North Rhine-Westphalia sent Meta a cease‑and‑desist letter on 30 April 2025 demanding it halt the use of Instagram and Facebook posts for AI training, citing GDPR consent requirements. Noyb supports the request…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Apr 24, 2025
noyb files GDPR complaint against Ubisoft for forced online tracking of offline games
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Ubisoft requires players to be online for single‑player games, collecting personal data such as start time, duration and quit time. The complaint argues the…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
Italy · Dec 19, 2024
noyb files GDPR complaint against Ryanair over mandatory biometric face scans
noyb has filed a complaint with the Italian Data Protection Authority alleging that Ryanair forces new customers to create permanent accounts and undergo a biometric facial‑recognition verification to book flights. The complaint says this…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
Moderate
Enforcement
Decided
European Union · Dec 13, 2024
EDPS finds European Commission illegally used political micro‑targeting
The European Data Protection Supervisor issued a decision that the European Commission illegally targeted ads using sensitive political data. The EDPS issued only a reprimand, noting no fine was needed as the practice stopped. The decision…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Low
Enforcement
Filed
France · Dec 12, 2024
noyb files complaint against BeReal for forced consent dark pattern in France
noyb has lodged a complaint with the French data protection authority (CNIL) alleging that BeReal uses a dark‑pattern consent banner that forces users to accept tracking for advertising. The complaint argues the consent is not freely…
CNIL · General Data Protection Regulation
Low
Enforcement
Pending
Ireland · Nov 12, 2024
Meta proposes "less personalized" ads that use location and age without consent, sparking GDPR enforcement concerns
Meta announced a new ad option that will still use personal data such as location and date of birth without obtaining consent, which noyb says violates the GDPR. The organization has filed pending litigation against Meta for this and…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Filed
France · Oct 22, 2024
noyb files complaint against Pinterest for unlawful tracking without consent
noyb lodged a complaint with the French data protection authority (CNIL) alleging that Pinterest tracks EU users for personalised advertising without obtaining opt‑in consent. The complaint cites a CJEU ruling that legitimate interest…
CNIL · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Sep 25, 2024
noyb files complaint against Mozilla over default ‘Privacy Preserving Attribution’ feature in Firefox
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Mozilla enabled a ‘Privacy Preserving Attribution’ feature in Firefox by default without informing users or obtaining consent. The feature allows Firefox to…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
In effect
Belgium · Sep 12, 2024
Belgian DPA orders Mediahuis news sites to add reject button to cookie banners, imposes daily penalty
The Belgian Data Protection Authority ordered four Mediahuis news sites to add a “reject” button on the first layer of their cookie banners and to change misleading button colours. Non‑compliance triggers a penalty of €50,000 per day per…
Belgian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Greece · Aug 13, 2024
Greek supermarket Alfa Vita faces GDPR complaint over incomplete data access
noyb filed a complaint with the Greek Data Protection Authority alleging that Alfa Vita's loyalty‑card program fails to provide full data‑subject access, omitting personal data and recipient information. The complaint cites a Court of…
Greek Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 12, 2024
noyb files nine GDPR complaints against X over AI training of 60 million EU users
noyb has lodged GDPR complaints in Austria, Belgium, France, Greece, Ireland, Italy, the Netherlands, Spain and Poland alleging that X used personal data of over 60 million EU/EEA users to train its AI system without consent. The Irish…
Irish Data Protection Commission · General Data Protection Regulation
High
Fine
In effect
European Union · Jul 29, 2024
European data protection authorities fined Meta, Spotify, Criteo and others in 2023 for GDPR violations
In 2023, the Irish DPC ordered Meta to pay €390 million and later €1.2 billion, the Swedish DPA fined Spotify €58 million SEK, and the French CNIL fined Criteo €40 million for breaches of consent and data‑subject rights under EU law.
EDPB · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · Jun 14, 2024 · effective Jun 14, 2024
Meta pauses AI training on EU/EEA user data after DPC intervention
The Irish Data Protection Commission announced that Meta has committed to stop processing EU/EEA user data for undefined AI techniques following 11 noyb complaints. Meta had previously relied on a "legitimate interest" argument. The…
Data Protection Commission (DPC) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jun 13, 2024
noyb files complaint with Austrian DPA over Google Chrome consent pop‑up
noyb alleges that Google Chrome’s “Privacy Sandbox” pop‑up misleads users into consenting to first‑party tracking for targeted advertising. The complaint asks the Austrian data protection authority to require Google to cease processing…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Jun 6, 2024 · effective Jun 26, 2024
noyb files complaints in 11 EU DPAs to halt Meta's AI data use
noyb has lodged complaints with data protection authorities in Austria, Belgium, France, Germany, Greece, Italy, Ireland, the Netherlands, Norway, Poland and Spain, requesting an urgency procedure to stop Meta's planned use of personal…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jun 5, 2024
noyb files GDPR complaint against Austrian newspaper Kurier over forced consent
noyb lodged a GDPR complaint against Kurier for forcing users to accept tracking cookies. The Austrian DSB had previously banned the same practice at Profil and ordered compliance, which was not implemented. On 20 August 2024 the DSB…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Investigation
Announced
Austria · Jun 4, 2024
noyb files complaints urging Austrian DSB to investigate Microsoft 365 Education for GDPR violations affecting children
noyb has lodged two complaints with Austria's data protection authority alleging that Microsoft 365 Education breaches GDPR rights of minors by shifting responsibility to schools, providing vague privacy information, and tracking users…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Data protection authority action
Published
DE-BAVARIA · Feb 5, 2024
Bavarian DPA declares CRIF‑Acxiom data trading illegal under GDPR
The Bavarian data protection authority ruled that credit reference agency CRIF illegally purchased personal data from address trader Acxiom and breached GDPR purpose‑limitation and information duties. The decision follows a similar…
Bavarian Data Protection Authority · General Data Protection Regulation
