Moderate
Investigation
Announced
Austria · Jun 4, 2024
noyb files complaints urging Austrian DSB to investigate Microsoft 365 Education for GDPR violations affecting children
noyb has lodged two complaints with Austria's data protection authority alleging that Microsoft 365 Education breaches GDPR rights of minors by shifting responsibility to schools, providing vague privacy information, and tracking users…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Data protection authority action
Published
DE-BAVARIA · Feb 5, 2024
Bavarian DPA declares CRIF‑Acxiom data trading illegal under GDPR
The Bavarian data protection authority ruled that credit reference agency CRIF illegally purchased personal data from address trader Acxiom and breached GDPR purpose‑limitation and information duties. The decision follows a similar…
Bavarian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jan 28, 2024
Survey finds 74% of insiders say authorities would find GDPR violations in average EU company
A noyb survey of over 1,000 data‑protection professionals reports that 74% believe authorities would discover relevant GDPR violations during on‑site inspections. Respondents cite lack of clear DPA decisions, fines, and public enforcement…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jan 11, 2024
Meta sued for charging users to withdraw consent in Austria
Noyb filed a complaint with the Austrian Data Protection Authority alleging that Meta forces users to pay up to €251.88 per year to withdraw consent for tracking. The complaint cites Article 7 of the GDPR, which requires withdrawal to be…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Netherlands · Dec 14, 2023
noyb files GDPR and DSA complaint against X (Twitter) over illegal political micro‑targeting
noyb lodged a complaint with the Dutch Data Protection Authority alleging that X (Twitter) used users' political views and religious beliefs for targeted advertising on behalf of the EU Commission. The complaint asserts violations of the…
Dutch Data Protection Authority · Digital Services Act
Moderate
Enforcement
Filed
Austria · Nov 28, 2023
noyb files GDPR complaint against Meta over “Pay or Okay” tracking fee
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Meta’s practice of charging users up to €251.88 a year to avoid personalized advertising violates GDPR consent requirements. The complaint references the…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Nov 16, 2023
noyb files complaint with EDPS over EU Commission’s political micro‑targeting ads on X
noyb lodged a complaint with the European Data Protection Supervisor alleging the EU Commission used unlawful micro‑targeting on X to promote its chat‑control proposal. The ads targeted users based on political views and religious beliefs…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Fine
Decided
Norway (EEA) · Sep 29, 2023
Norwegian Privacy Appeals Board upholds €5.8 million fine against Grindr
The Norwegian Privacy Appeals Board confirmed the Norwegian Data Protection Authority's fine of NOK 65 million against the dating app Grindr for sharing sensitive personal data with third parties. The fine, approximately €5.8 million…
Norwegian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
France · Sep 14, 2023
noyb files three complaints in France alleging illegal data sharing by Fnac, SeLoger, MyFitnessPal apps
noyb lodged complaints with the French data protection authority (CNIL) against the mobile apps of Fnac, SeLoger and MyFitnessPal, alleging they collect and share personal data without user consent. The complaints cite violations of the…
CNIL · ePrivacy Directive
Moderate
Enforcement
Announced
European Union · Aug 1, 2023
Meta to switch to consent for behavioral ads after EU litigation
Meta announced it will seek user consent before showing behavioral ads in the EU and Switzerland, changing its legal basis from legitimate interest to consent. The move follows litigation by noyb, decisions by the EDPB and the CJEU, and a…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
In effect
Norway (EEA) · Jul 17, 2023 · effective Aug 4, 2023
Norwegian DPA temporarily bans Meta’s behavioral advertising on Facebook and Instagram
The Norwegian Data Protection Authority (Datatilsynet) issued a temporary ban on Meta's use of behavioral advertising on Facebook and Instagram, effective from August 4 for at least three months. The ban remains until Meta can demonstrate…
Datatilsynet · General Data Protection Regulation
Moderate
Enforcement
Filed
Belgium · Jun 23, 2023
noyb files complaint against TeleSign for unlawful profiling of mobile users
noyb filed a complaint with the Belgian Data Protection Authority alleging that TeleSign receives phone data from BICS and creates reputation scores without consent, violating the GDPR. The complaint cites the use of AI-generated trust…
Belgian Data Protection Authority · General Data Protection Regulation
Moderate
Data protection authority action
Announced
Malta · May 17, 2023
Maltese DPA orders C-PLANET to disclose data source within 20 days or face fine
The Maltese Data Protection Authority (IDPC) ordered IT company C-PLANET to provide details on the source of personal data collected on voters within 20 days. Failure to comply will result in a proportionate and dissuasive fine under the…
Maltese Data Protection Authority (IDPC) · General Data Protection Regulation
Low
Enforcement
In effect
European Union · Mar 30, 2023
Meta to rely on 'legitimate interest' for ads after EDPB decision
noyb won a series of complaints against Meta before the European Data Protection Board in December 2022. The EDPB decision required Meta to stop using the "necessary under contract" legal basis for advertising. Meta now plans to rely on…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Data protection authority action
Decided
Austria · Mar 27, 2023
Austrian DPA rules CRIF's processing of Austrian citizens' personal data illegal
The Austrian Data Protection Authority found that CRIF GmbH illegally processed addresses, dates of birth, names and other personal data of millions of Austrians obtained from AZ Direkt without consent or legal basis, ordering the deletion…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Mar 21, 2023
noyb files GDPR complaints against German parties for political microtargeting on Facebook
noyb filed a series of complaints against several German political parties alleging unlawful political microtargeting on Facebook during the 2021 federal election. The complaints claim violations of the GDPR because the parties and…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Feb 28, 2023
noyb files complaints against data brokers for refusing cookie‑based authentication of GDPR access requests
noyb lodged a series of complaints against websites and data brokers that denied or complicated GDPR access requests by requiring additional identification beyond cookies. The complaints argue that, under GDPR and EDPB guidance, users…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Published
Ireland · Jan 11, 2023
Irish DPC fines Meta €60m for unlawful processing and €150m for transparency breaches
The Irish Data Protection Commission (DPC) issued a final decision imposing a €150 million fine on Facebook for transparency failures and a €60 million fine on Meta for lacking a legal basis to process personal data. The decision also…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Jan 4, 2023
EU EDPB bans Meta from using personal data for personalized ads, imposes €390 million fine
The European Data Protection Board (EDPB) decided that Meta (Facebook and Instagram) may not use personal data for personalized advertising and must obtain opt‑in consent. The decision also imposes a total fine of €390 million on Meta.…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Dec 6, 2022
EU Data Protection Board rules Meta's consent bypass for personalized ads illegal
The European Data Protection Board (EDPB) decided that Meta cannot force users to accept personalized ads and must obtain a yes/no consent option. The decision overturns a previous draft decision by the Irish Data Protection Commission and…
European Data Protection Board (EDPB) · General Data Protection Regulation
