Moderate
Enforcement
Filed
European Union · Oct 27, 2022
noyb files 700+ GDPR complaints on cookie banners, prompting widespread addition of reject buttons
noyb scanned over 3,600 websites in March 2021 and filed more than 700 complaints across Europe for GDPR‑violating cookie banners lacking a clear reject option. Follow‑up scans in October 2022 showed that 41% of the sites added a reject…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 9, 2022
226 GDPR complaints lodged against deceptive OneTrust cookie banners
noyb filed 226 complaints with 18 data protection authorities over websites using OneTrust cookie banners that employ deceptive designs. The complaints allege violations of GDPR requirements for a fair yes/no consent choice. Some websites…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Malta · Apr 29, 2022
noyb files second complaint against C‑Planet for refusing data‑subject access to source of political data
noyb filed a second complaint with Malta's Information & Data Protection Commissioner (IDPC) demanding C‑Planet disclose the original source of illegally processed voter data. The company previously received a €65,000 fine for illegal…
Information & Data Protection Commissioner (IDPC) · General Data Protection Regulation
Moderate
Settlement
Settled
Ireland · Apr 28, 2022 · effective Apr 28, 2022
Irish DPC to pay tens of thousands in costs to noyb over 47‑month delay in WhatsApp and Instagram GDPR cases
The Irish Data Protection Commission settled with privacy group noyb, agreeing to cover tens of thousands of euros in legal costs after a 47‑month delay in drafting decisions on WhatsApp and Instagram cases. The delay contravenes GDPR…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Mar 14, 2022
Amazon workers file GDPR access requests to demand data transparency
Warehouse workers from Germany, UK, Italy, Poland and Slovakia filed data subject access requests under Article 15 GDPR to learn how Amazon processes their personal data. Amazon has one month to respond and disclose the processing…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Mar 4, 2022
noyb launches second wave of GDPR complaints against deceptive cookie banners
noyb sent 270 draft complaints to website operators whose cookie banners violate the GDPR, offering a 60‑day grace period before filing formal complaints. If companies do not fully comply, noyb will file complaints with DPAs, which may…
Data Protection Authorities · General Data Protection Regulation
Moderate
Enforcement
Published
European Union · Jan 11, 2022
EDPS reprimands European Parliament for illegal EU‑US data transfers via Google and Stripe
The European Data Protection Supervisor (EDPS) issued a decision reprimanding the European Parliament for violating data protection law on its COVID‑testing website. The use of Google Analytics and Stripe was found to breach the CJEU's…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Low
Enforcement
Filed
Luxembourg · Dec 22, 2021
noyb files complaint with Luxembourg CNPD over Amazon's automated e-recruiting decisions
noyb lodged a complaint with the Luxembourg data protection authority (CNPD) against Amazon for using automated decision‑making in its Mechanical Turk recruitment process. The complainant was denied access without explanation, and Amazon…
Commission Nationale pour la Protection des Données (CNPD) · General Data Protection Regulation
Low
Enforcement
Filed
DE-RP · Dec 22, 2021
noyb files GDPR complaint against Airbnb over automated review deletions
noyb filed a GDPR complaint with the Data Protection Authority of Rheinland‑Pfalz against Airbnb for automatically deleting a host's five‑star review. The complaint alleges violations of Article 22(3) GDPR, which requires the right to…
Data Protection Authority of Rheinland-Pfalz · General Data Protection Regulation
Low
Enforcement
Pending
Ireland · Dec 19, 2021
Facebook ignores EU Court rulings on data transfers, Irish DPC enforcement pending
noyb reports that Facebook's 86‑page Transfer Impact Assessment disregards the CJEU Schrems I and II rulings that require EU‑US data transfers to stop. The Irish Data Protection Commission has not yet issued a decision despite a complaint…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · Dec 12, 2021
Irish DPC sends threat letters to noyb over Facebook ROPA publication
noyb published Facebook's four‑page Record of Processing Activities (ROPA) required by Article 30 GDPR. The Irish Data Protection Commission, which received the ROPA on 27.9.2018, sent angry letters to noyb demanding the removal of the…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Announced
Austria · Nov 28, 2021
Austrian DPA rejects Facebook's confidentiality claim in GDPR data‑transfer dispute
The Austrian Data Protection Authority (DSB) rejected Facebook's claim that certain documents were confidential, providing all documents to the Irish DPC. The DSB also reminded Facebook that official Austrian procedures must be conducted…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
In effect
Ireland · Nov 23, 2021 · effective Nov 18, 2021
Irish DPC removes noyb from GDPR procedure after demanding NDA
The Irish Data Protection Commission (DPC) demanded that privacy activist group noyb sign a non‑disclosure agreement to continue hearing its complaint against Facebook. After noyb refused, the DPC removed the organization from the GDPR…
Irish Data Protection Commission · General Data Protection Regulation
Low
Appeal
Filed
Austria · Nov 15, 2021
noyb appeals Austrian DPA decision on cell‑phone location and traffic data to Federal Administrative Court
noyb filed a notice of appeal with Austria's Federal Administrative Court against the DSB's decision that A1 may refuse to provide location and traffic data to a user. The DSB argued the data are not personal because a third party could…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Luxembourg · Oct 21, 2021
noyb files GDPR complaint against Amazon Europe over opaque automated payment decisions
noyb lodged a complaint with Luxembourg's data protection authority alleging that Amazon Europe's automated "Monthly Invoice" payment rejections violate GDPR transparency and access requirements. The complaint cites the lack of explanation…
Luxembourg National Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Announced
Ireland · Oct 15, 2021
Irish DPC orders noyb to remove draft decision from website
The Irish Data Protection Commission sent a take‑down request to privacy activist group noyb on 14 Oct 2021, ordering removal of a draft decision that allegedly strips Facebook users of GDPR rights. noyb refused, citing Austrian law and…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 10, 2021
noyb files 422 GDPR complaints over deceptive cookie banners
noyb filed 422 formal GDPR complaints with data protection authorities in ten EU countries concerning dark‑pattern cookie banners. After a warning phase, 42% of identified violations were remedied, but 82% of the 516 sites still breach the…
Data Protection Authorities · General Data Protection Regulation
Low
Enforcement
Decided
Austria · Aug 4, 2021
Austrian DPA orders credit agency CRIF to disclose scoring logic after GDPR complaint
The Austrian Data Protection Authority ruled that CRIF's credit assessment constitutes profiling under the GDPR and must disclose that the creditworthiness score was calculated only from address, gender, name and date of birth. CRIF must…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jul 19, 2021
noyb reports 2.5‑year delay in GDPR access‑request complaints against streaming services
In January 2019 noyb filed complaints against eight streaming services for failing to comply with the GDPR right of access. After two and a half years only one complaint was resolved after noyb took the responsible authority to court. The…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · May 31, 2021
noyb launches automated system, sends 500 draft GDPR cookie‑banner complaints across Europe
noyb sent more than 500 draft GDPR complaints to companies using unlawful cookie banners, offering a one‑month grace period before filing formal complaints. The NGO developed software to detect violations and generate complaints…
EDPB · General Data Protection Regulation
