Moderate
Court ruling
Decided
Austria · Sep 1, 2026
Austrian Supreme Court rules CRIF’s use of address‑publisher data for credit scoring violates GDPR purpose limitation
The Austrian Supreme Court (OGH) held that credit reference agencies may not collect personal data from address publishers that process the data for marketing purposes, confirming a GDPR purpose‑limitation breach. The ruling supports…
EDPB · General Data Protection Regulation
Low
Lawsuit filed
Pending
United States (federal) · Aug 31, 2026
EFF urges courts to resist AI-driven copyright expansions in ongoing litigation
The EFF argues that courts should not broaden copyright protections in response to generative AI, citing historical parallels with VTR technology. It references ongoing cases such as Concord Music Group, Inc. v. Anthropic PBC and In re…
Low
Lawsuit filed
Filed
California · Aug 26, 2026
EFF and ACLU sue San Jose Police over warrantless ALPR searches
The Electronic Frontier Foundation and the ACLU of Northern California have filed a lawsuit in California state court challenging the San Jose Police Department's practice of searching stored license‑plate data without a warrant. The suit…
California Constitution
Moderate
Court ruling
Decided
France · Aug 26, 2026
French Constitutional Council strikes down law banning social media for under‑15s
France’s top court invalidated the legislation that prohibited people under 15 from using social media. The Council found the ban infringed freedom of expression and the right to private life by imposing mandatory age verification. The…
Moderate
Court ruling
Decided
France · Aug 14, 2026
French Constitutional Council strikes down law banning under‑15s from social media
On 14 August 2026 the French Constitutional Council invalidated Article 1 of the Act that would have barred minors under 15 from accessing online social media. The Council found the ban disproportionate, lacking individual assessment, and…
European Commission · Digital Services Act
Low
Court ruling
Decided
United States (federal) · Aug 4, 2026
Ninth Circuit rules Perplexity AI’s Comet browser not liable under CFAA
The Ninth Circuit Court of Appeals held that Perplexity AI’s Comet browser does not violate the Computer Fraud and Abuse Act because the tool itself does not access Amazon’s servers; users do. The court rejected Amazon’s claim that…
Computer Fraud and Abuse Act
Moderate
Court ruling
Decided
United States (federal) · Jun 29, 2026
US Supreme Court decision undermines EU‑US Data Privacy Framework
The US Supreme Court ruled in Trump v. Slaughter that the FTC cannot be an independent agency. The decision calls into question the independence requirement for the EU‑US Data Privacy Framework, effectively collapsing the adequacy…
EDPB · General Data Protection Regulation
Low
Court ruling
Decided
Austria · May 21, 2026
Austrian Federal Administrative Court orders ORF to redesign cookie banner for equal consent options
The Federal Administrative Court (BVwG) upheld the Austrian Data Protection Authority's 2024 decision that ORF.at's cookie banner violates the GDPR. The court ruled that the ‘Accept’ button must not be highlighted in colour and that…
EDPB · General Data Protection Regulation
Moderate
Lawsuit filed
Filed
Germany · Apr 30, 2026
noyb files lawsuit against Hamburg DPA over inaction on PimEyes biometric data case
noyb has filed a lawsuit against the Hamburg Data Protection Authority, alleging that the authority has failed to act on illegal biometric data processing by PimEyes. The DPA considers PimEyes' facial recognition practices illegal but…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Lawsuit filed
Filed
European Union · Jan 28, 2026
noyb debunks 5 GDPR misconceptions on Data Protection Day
The article clarifies that the GDPR does not mandate cookie banners, that DPAs rarely impose fines, and that companies must obtain explicit consent for tracking. It also explains the limited scope of the right of access and counters claims…
EDPB · General Data Protection Regulation
Low
Lawsuit filed
Filed
Germany · Jan 28, 2026
noyb files lawsuit against Hamburg DPA over Pay or Okay case involving SPIEGEL
In 2024, privacy advocacy group noyb sued the Hamburg Data Protection Authority concerning a Pay or Okay implementation dispute with the German news magazine SPIEGEL. The case highlights concerns about DPA impartiality and enforcement…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Dec 18, 2025 · deadline Dec 31, 2025
Austrian Supreme Court orders Meta to give users full data access within 14 days
The Austrian Supreme Court ruled that Meta must provide a complete copy of all personal data to any user request within 14 days, including source, recipient and purpose information. The court also required Meta to obtain explicit opt‑in…
EDPB · General Data Protection Regulation
Low
Court ruling
Decided
European Union · Sep 3, 2025
EU General Court rejects Latombe challenge to EU‑US data transfer framework
French MP Philippe Latombe filed an action for annulment of the Transatlantic Data Protection Framework before the EU General Court. The General Court dismissed the narrow challenge, finding it unconvincing. The decision leaves the…
Transatlantic Data Protection Framework
Moderate
Court ruling
Decided
Austria · Aug 18, 2025
Austrian Federal Administrative Court rules DerStandard's "pay or okay" consent model illegal
The Austrian Federal Administrative Court (BVwG) confirmed the Data Protection Authority's finding that DerStandard violated the GDPR by offering a "pay or okay" choice. The court held that the newspaper did not obtain valid, granular…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Jul 31, 2025
CJEU ruling C‑446/21 limits use of personal data for online advertising and repurposing publicly available data
The European Court of Justice issued ruling C‑446/21, fully backing a lawsuit against Meta's Facebook service. The court massively limits the use of personal data for online advertising and restricts the reuse of publicly available…
EDPB · General Data Protection Regulation
Low
Lawsuit filed
Filed
Germany · Jun 17, 2025
noyb sues German DPAs over inactivity on ‘Pay or OK’ GDPR complaints
noyb filed complaints in August 2021 against news sites using ‘Pay or OK’ consent mechanisms, alleging they violate the GDPR’s freely given consent requirement. After nearly four years of inaction, the North Rhine‑Westphalia and Hesse data…
EDPB · General Data Protection Regulation
Moderate
Class action
Announced
Austria · Jun 3, 2025
noyb seeks participants for potential GDPR class action against Austrian credit agency CRIF
noyb alleges that CRIF processes personal data of millions of Austrians to calculate credit scores based on age, gender and address, potentially violating the GDPR. The organization plans a scientific review and, if evidence supports it…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Germany · May 23, 2025
German Higher Regional Court denies interim injunction against Meta AI training
The Higher Regional Court of Cologne refused the interim injunction sought by Verbraucherzentrale NRW, which alleged Meta's AI training violates the GDPR by using user data without consent. The court's decision is limited to the interim…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Jan 29, 2025
EU General Court rules Irish DPC acted unlawfully for refusing to investigate noyb complaint
The EU General Court held that the Irish Data Protection Commission unlawfully refused to investigate a complaint filed by noyb. The court dismissed the DPC's claims against the European Data Protection Board. The case can now be appealed…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jan 9, 2025
CJEU rules Austrian DPA cannot limit data subject complaints to two per month
The Court of Justice of the EU (CJEU) in case C-416/23 held that the Austrian Data Protection Authority (DSB) may not cap the number of complaints a data subject can file. The judgment confirms that users have the right to have any GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
