Moderate
Enforcement
Announced
European Union · Aug 1, 2023
Meta to switch to consent for behavioral ads after EU litigation
Meta announced it will seek user consent before showing behavioral ads in the EU and Switzerland, changing its legal basis from legitimate interest to consent. The move follows litigation by noyb, decisions by the EDPB and the CJEU, and a…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
In effect
Norway (EEA) · Jul 17, 2023 · effective Aug 4, 2023
Norwegian DPA temporarily bans Meta’s behavioral advertising on Facebook and Instagram
The Norwegian Data Protection Authority (Datatilsynet) issued a temporary ban on Meta's use of behavioral advertising on Facebook and Instagram, effective from August 4 for at least three months. The ban remains until Meta can demonstrate…
Datatilsynet · General Data Protection Regulation
Moderate
Court ruling
Decided
Germany · Jul 4, 2023
CJEU rules Meta must rely on consent for advertising, limiting GDPR bypass attempts
The Court of Justice of the EU held that Meta may only process personal data for core services and must obtain freely given consent for advertising and data sharing. The judgment rejects Meta's reliance on contractual necessity and…
EDPB · General Data Protection Regulation
Moderate
Fine
In effect
France · Jun 22, 2023
French CNIL fines Criteo €40 million for GDPR violations
The French Data Protection Authority (CNIL) fined Criteo €40 million for violating the GDPR, including lack of valid consent, transparency, and failure to respect the right to erasure and access. The enforcement followed complaints filed…
CNIL · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Apr 4, 2023
noyb launches free tool for broad Facebook opt‑out under GDPR
The privacy NGO noyb released an online tool that lets users submit a broad objection to Meta’s processing of personal data for targeted advertising, which Meta bases on “legitimate interest”. The tool simplifies the GDPR right to object…
EDPB · General Data Protection Regulation
Low
Enforcement
In effect
European Union · Mar 30, 2023
Meta to rely on 'legitimate interest' for ads after EDPB decision
noyb won a series of complaints against Meta before the European Data Protection Board in December 2022. The EDPB decision required Meta to stop using the "necessary under contract" legal basis for advertising. Meta now plans to rely on…
European Data Protection Board (EDPB) · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Mar 21, 2023
noyb files GDPR complaints against German parties for political microtargeting on Facebook
noyb filed a series of complaints against several German political parties alleging unlawful political microtargeting on Facebook during the 2021 federal election. The complaints claim violations of the GDPR because the parties and…
EDPB · General Data Protection Regulation
Low
Enforcement
Published
Austria · Mar 16, 2023
Austrian DSB declares Meta tracking tools illegal under GDPR
The Austrian Data Protection Authority ruled that Meta's tracking pixel, Facebook Login and Meta Pixel violate the GDPR and the Schrems II decision on transatlantic data transfers. The decision advises EU website operators not to use any…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Feb 28, 2023
noyb files complaints against data brokers for refusing cookie‑based authentication of GDPR access requests
noyb lodged a series of complaints against websites and data brokers that denied or complicated GDPR access requests by requiring additional identification beyond cookies. The complaints argue that, under GDPR and EDPB guidance, users…
EDPB · General Data Protection Regulation
Moderate
Fine
Announced
Ireland · Jan 27, 2023
Irish DPC announces €390 million fine on Meta for GDPR consent breach
The Irish Data Protection Commission announced a €390 million fine against Meta, ordering it to obtain valid consent for personalized advertising after the European Data Protection Board issued a binding decision. The fine illustrates…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Published
Ireland · Jan 11, 2023
Irish DPC fines Meta €60m for unlawful processing and €150m for transparency breaches
The Irish Data Protection Commission (DPC) issued a final decision imposing a €150 million fine on Facebook for transparency failures and a €60 million fine on Meta for lacking a legal basis to process personal data. The decision also…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Jan 4, 2023
EU EDPB bans Meta from using personal data for personalized ads, imposes €390 million fine
The European Data Protection Board (EDPB) decided that Meta (Facebook and Instagram) may not use personal data for personalized advertising and must obtain opt‑in consent. The decision also imposes a total fine of €390 million on Meta.…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Fine
In effect
Ireland · Jan 4, 2023 · effective Jan 4, 2023
EU data protection board fines Meta €390 million and bans personalized ads
The European Data Protection Board, following the Irish Data Protection Commission, ruled that Meta's use of personal data for personalized advertising violated the GDPR and imposed a €390 million fine. Meta must obtain opt‑in consent and…
European Data Protection Board · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Dec 6, 2022
EU Data Protection Board rules Meta's consent bypass for personalized ads illegal
The European Data Protection Board (EDPB) decided that Meta cannot force users to accept personalized ads and must obtain a yes/no consent option. The decision overturns a previous draft decision by the Irish Data Protection Commission and…
European Data Protection Board (EDPB) · General Data Protection Regulation
Low
Enforcement
Decided
Austria · Oct 20, 2022
Austrian DSB orders Profil.at to fix forced cookie banners after GDPR complaint
noyb filed a GDPR complaint against Profil.at for using a forced two‑step cookie consent mechanism. The Austrian Data Protection Authority issued a decision on 10 August 2023, confirming the violations and giving the site an eight‑week…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Published
European Union · Oct 13, 2022
CJEU Advocate General opinion may limit GDPR non‑material damages compensation
The Advocate General of the Court of Justice of the EU issued an opinion that could restrict the right to claim non‑material damages under the GDPR. The opinion questions whether Article 82 allows damages without material loss and suggests…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
France · Aug 24, 2022
noyb files complaint with CNIL over Gmail's unsolicited advertising emails
noyb.eu lodged a complaint with the French Data Protection Authority (CNIL) alleging that Google’s Gmail sends unsolicited advertising emails without user consent, contrary to the ePrivacy Directive and a CJEU ruling. The complaint cites…
CNIL · ePrivacy Directive
Moderate
Fine
In effect
Norway (EEA) · Dec 15, 2021 · effective Dec 15, 2021
Norwegian DPA fines Grindr €6.3 M for illegal sharing of sensitive data
The Norwegian Data Protection Authority imposed a fine of 65 Mio NOK on Grindr for sharing sensitive personal data without valid consent. The authority found the consent mechanism invalid and highlighted the lack of a genuine opt‑out. The…
Norwegian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Announced
Germany · Dec 10, 2021
noyb and ZDF Magazin Royale seek data donors to enforce GDPR micro‑targeting ban
noyb and ZDF Magazin Royale are asking users of the "Who Targets Me" browser extension from the 2021 German federal election to donate their data. The aim is to find a case to enforce the GDPR prohibition on political micro‑targeting under…
EDPB · General Data Protection Regulation
Moderate
Guidance
Published
Ireland · Dec 4, 2021
Irish DPC tried to embed Facebook consent bypass into EDPB Guidelines, but final 2019 guidelines omitted it
A letter shows the Irish DPC held ten meetings with Facebook and agreed on a GDPR bypass by moving consent into terms and conditions. The DPC then drafted EDPB guideline language to allow this approach, but other DPAs criticised it…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
