Low
Enforcement
Filed
France · Oct 22, 2024
noyb files complaint against Pinterest for unlawful tracking without consent
noyb lodged a complaint with the French data protection authority (CNIL) alleging that Pinterest tracks EU users for personalised advertising without obtaining opt‑in consent. The complaint cites a CJEU ruling that legitimate interest…
CNIL · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Oct 4, 2024
CJEU rules Meta must minimise use of personal data for ads
The Court of Justice of the European Union (CJEU) held that Meta must limit the processing of personal data for online advertising to what is strictly necessary, applying the GDPR data‑minimisation principle regardless of consent. It also…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Sep 25, 2024
noyb files complaint against Mozilla over default ‘Privacy Preserving Attribution’ feature in Firefox
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Mozilla enabled a ‘Privacy Preserving Attribution’ feature in Firefox by default without informing users or obtaining consent. The feature allows Firefox to…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
High
Fine
In effect
European Union · Jul 29, 2024
European data protection authorities fined Meta, Spotify, Criteo and others in 2023 for GDPR violations
In 2023, the Irish DPC ordered Meta to pay €390 million and later €1.2 billion, the Swedish DPA fined Spotify €58 million SEK, and the French CNIL fined Criteo €40 million for breaches of consent and data‑subject rights under EU law.
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Italy · Jul 9, 2024
noyb files GDPR complaint against Microsoft’s Xandr for 0% compliance with data subject rights
Xandr, a Microsoft subsidiary, collects and shares personal data of millions of Europeans for targeted advertising, including sensitive categories. noyb filed a GDPR complaint with Italy’s Garante alleging breaches of Articles 5, 12, 15…
Italian data protection authority (Garante) · General Data Protection Regulation
Moderate
Fine
Decided
Norway (EEA) · Jul 1, 2024 · effective Jul 1, 2024
Norwegian court confirms €5.7M fine for Grindr over GDPR breach
A Norwegian court upheld a fine of NOK 65 million (€5.7 million) against Grindr for violating the GDPR by sharing user data with advertisers. The ruling follows a complaint by the Norwegian Consumer Council, supported by noyb.
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jun 13, 2024
noyb files complaint with Austrian DPA over Google Chrome consent pop‑up
noyb alleges that Google Chrome’s “Privacy Sandbox” pop‑up misleads users into consenting to first‑party tracking for targeted advertising. The complaint asks the Austrian data protection authority to require Google to cease processing…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Investigation
Announced
Austria · Jun 4, 2024
noyb files complaints urging Austrian DSB to investigate Microsoft 365 Education for GDPR violations affecting children
noyb has lodged two complaints with Austria's data protection authority alleging that Microsoft 365 Education breaches GDPR rights of minors by shifting responsibility to schools, providing vague privacy information, and tracking users…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Apr 25, 2024
CJEU Advocate General says Facebook must limit personal data for ads under GDPR data‑minimisation
The Advocate General’s opinion interprets Article 5(1)(c) GDPR to require Meta to restrict the use of personal data for targeted advertising by time, type and source. It also addresses purpose‑limitation, stating that publicly disclosed…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Apr 17, 2024
EDPB opinion bars Meta from using 'Pay or Okay' consent model
The European Data Protection Board issued an opinion stating that Meta may not rely on a pay‑or‑consent scheme to process personal data for behavioural advertising. The decision requires Meta to offer a genuine opt‑in choice rather than a…
European Data Protection Board · General Data Protection Regulation
Low
Court ruling
Decided
European Union · Apr 9, 2024
CJEU ruling in July 2023 declares Meta's data handling illegal, prompting pay‑or‑consent model
A Court of Justice of the European Union ruling in July 2023 found Meta's handling of user data illegal. In response, Meta introduced a paid subscription in November 2023 that forces users to either pay or consent to tracking for targeted…
Moderate
Guidance
Announced
European Union · Mar 19, 2024
EDPB to issue binding opinion on Meta's 'Pay or Okay' consent model
The European Data Protection Board (EDPB) plans to issue a binding opinion on the legality of Meta's "Pay or Okay" system that charges users to refuse tracking. The opinion could legitimize the practice across the EU, threatening the GDPR…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Feb 16, 2024
28 NGOs urge EU Data Protection Board to reject Meta's 'Pay or Okay' consent model
A coalition of 28 NGOs, including Wikimedia Europe, Bits of Freedom and the Norwegian Consumer Council, sent a joint letter to the European Data Protection Board requesting a binding opinion on Meta's "Pay or Okay" system, which forces…
European Data Protection Board (EDPB) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jan 11, 2024
Meta sued for charging users to withdraw consent in Austria
Noyb filed a complaint with the Austrian Data Protection Authority alleging that Meta forces users to pay up to €251.88 per year to withdraw consent for tracking. The complaint cites Article 7 of the GDPR, which requires withdrawal to be…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Netherlands · Dec 14, 2023
noyb files GDPR and DSA complaint against X (Twitter) over illegal political micro‑targeting
noyb lodged a complaint with the Dutch Data Protection Authority alleging that X (Twitter) used users' political views and religious beliefs for targeted advertising on behalf of the EU Commission. The complaint asserts violations of the…
Dutch Data Protection Authority · Digital Services Act
Moderate
Enforcement
Filed
Austria · Nov 28, 2023
noyb files GDPR complaint against Meta over “Pay or Okay” tracking fee
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Meta’s practice of charging users up to €251.88 a year to avoid personalized advertising violates GDPR consent requirements. The complaint references the…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Nov 16, 2023
noyb files complaint with EDPS over EU Commission’s political micro‑targeting ads on X
noyb lodged a complaint with the European Data Protection Supervisor alleging the EU Commission used unlawful micro‑targeting on X to promote its chat‑control proposal. The ads targeted users based on political views and religious beliefs…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Interpretation
Announced
European Union · Oct 3, 2023
Meta proposes 'Pay for your Rights' model charging EU users €160/year for non‑consent
Meta plans to charge EU users €160 per year if they do not consent to the processing of their personal data on Facebook and Instagram. The proposal references an obiter dictum from the CJEU case C‑252/21 that an alternative to ads may be…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Fine
Decided
Norway (EEA) · Sep 29, 2023
Norwegian Privacy Appeals Board upholds €5.8 million fine against Grindr
The Norwegian Privacy Appeals Board confirmed the Norwegian Data Protection Authority's fine of NOK 65 million against the dating app Grindr for sharing sensitive personal data with third parties. The fine, approximately €5.8 million…
Norwegian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
France · Sep 14, 2023
noyb files three complaints in France alleging illegal data sharing by Fnac, SeLoger, MyFitnessPal apps
noyb lodged complaints with the French data protection authority (CNIL) against the mobile apps of Fnac, SeLoger and MyFitnessPal, alleging they collect and share personal data without user consent. The complaints cite violations of the…
CNIL · ePrivacy Directive
