Moderate
Enforcement
Filed
European Union · Aug 10, 2021
noyb files 422 GDPR complaints over deceptive cookie banners
noyb filed 422 formal GDPR complaints with data protection authorities in ten EU countries concerning dark‑pattern cookie banners. After a warning phase, 42% of identified violations were remedied, but 82% of the 516 sites still breach the…
Data Protection Authorities · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jul 19, 2021
noyb reports 2.5‑year delay in GDPR access‑request complaints against streaming services
In January 2019 noyb filed complaints against eight streaming services for failing to comply with the GDPR right of access. After two and a half years only one complaint was resolved after noyb took the responsible authority to court. The…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · May 31, 2021
noyb launches automated system, sends 500 draft GDPR cookie‑banner complaints across Europe
noyb sent more than 500 draft GDPR complaints to companies using unlawful cookie banners, offering a one‑month grace period before filing formal complaints. The NGO developed software to detect violations and generate complaints…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
France · Apr 6, 2021
noyb files complaint to French CNIL over Google’s Android Advertising ID tracking without consent
noyb lodged a complaint with the French Data Protection Authority (CNIL) alleging that Google’s Android Advertising Identifier (AAID) is installed on Android phones without user consent. The complaint cites the e‑Privacy Directive’s…
CNIL · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Mar 18, 2021
noyb files GDPR complaint against CRIF and AZ Direct over illegal data exchange
noyb lodged a GDPR complaint on 18 March 2021 against credit scoring firm CRIF GmbH and address publisher AZ Direct for exchanging personal data without a legal basis. The complaint alleges violations of the GDPR purpose‑limitation…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Fine
In effect
Norway (EEA) · Jan 26, 2021
Norwegian DPA fines Grindr €9.63 million for illegal sharing of sensitive data
The Norwegian Data Protection Authority imposed a fine of 100 Mio NOK on Grindr for sharing personal and sensitive data without valid consent. The authority found Grindr's consent mechanism invalid and highlighted the company's lack of…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Jan 22, 2021
noyb files complaint against European Parliament over US data transfers and deceptive cookie banners
noyb filed a complaint with the European Data Protection Supervisor on behalf of six MEPs alleging illegal transfers of personal data to US providers Google and Stripe and misleading cookie banners on the Parliament's COVID‑19 testing…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Nov 16, 2020
noyb files complaints against Apple's IDFA tracking code
The privacy NGO noyb filed two complaints with the German and Spanish data protection authorities alleging that Apple's Identifier for Advertisers (IDFA) tracks users without consent, violating the EU e‑Privacy Directive. The complaints…
EDPB · General Data Protection Regulation
Low
Enforcement
Decided
Austria · Sep 16, 2020
Austrian DSB decides on Flimmit streaming complaint after 1.5 years
In September 2020 the Austrian Data Protection Authority (DSB) issued a decision on the complaint against Vienna streaming service Flimmit filed by noyb. The DSB rejected the complaint because Flimmit provided the missing information about…
Datenschutzbehörde (DSB) · General Data Protection Regulation
Moderate
Fine
In effect
France · Jun 19, 2020
French court upholds €50 million CNIL fine against Google
The French Data Protection Authority (CNIL) imposed a €50 million fine on Google for insufficient information and lack of valid consent for personalized ads. The Conseil d’État confirmed the CNIL's decision and affirmed its jurisdiction…
CNIL · General Data Protection Regulation
Low
Enforcement
Pending
Ireland · May 24, 2020
noyb files GDPR complaints against Facebook Group, warns of potential €2.5bn fine
Within hours of the GDPR becoming applicable on 25 May 2018, the non‑profit noyb filed three complaints against Facebook, Instagram and WhatsApp. The Irish DPC has kept the investigation confidential but may issue a fine of up to…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · May 20, 2020
noyb announces plan to file GDPR complaints over Apple Siri recordings
A former Apple employee alleges Siri records conversations without user activation. noyb says the practice may breach the GDPR and ePrivacy rules. noyb announces it will file complaints under Article 66 GDPR urgency procedure.
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · May 13, 2020
noyb files GDPR complaint against Google over Android Advertising ID tracking
noyb filed a formal GDPR complaint against Google for tracking users via the Android Advertising ID without a valid legal basis. The complaint was submitted on behalf of an Austrian citizen to the Austrian Data Protection Authority. GDPR…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Announced
Austria · Mar 31, 2020
Streaming services fail GDPR transparency requirements, report finds
A joint investigation by the Austrian Chamber of Labour and noyb evaluated eight streaming platforms against GDPR transparency obligations. The study found that most services provide insufficient information on data handling, retention…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
France · Dec 10, 2019
noyb files three GDPR complaints with CNIL over fake consent cookie banners on French sites
The privacy NGO noyb filed three formal complaints with the French Data Protection Authority (CNIL) alleging that CDiscount, Allocine.fr and Vanity Fair turn user rejections of cookies into "fake consent". The sites use the IAB…
CNIL · General Data Protection Regulation
Moderate
Fine
Announced
France · Jun 21, 2019
CNIL fines Google €50 million for GDPR ‘forced consent’ violations
The French data protection authority (CNIL) announced a €50 million fine against Google for GDPR violations related to forced consent. The penalty stems from complaints filed by noyb.eu and La Quadrature du Net. The announcement was made…
CNIL · General Data Protection Regulation
Low
Enforcement
Published
Austria · Dec 10, 2018
Austrian DSB decision on DerStandard.at ‘pay or okay’ subscription model
The Austrian Data Protection Authority (DSB) ruled that DerStandard.at’s subscription option requiring users to pay €6 per month for privacy instead of giving free consent is not voluntary under the GDPR. The decision sparked criticism…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · May 25, 2018 · effective May 25, 2018
noyb files GDPR complaints against Google, Instagram, WhatsApp and Facebook for forced consent
On 25 May 2018, the privacy NGO noyb filed four complaints with DPAs in France, Belgium, Germany and Austria alleging that Google, Instagram, WhatsApp and Facebook use forced consent that violates GDPR Article 7(4). The complaints argue…
EDPB · General Data Protection Regulation
