Low
Enforcement
Filed
Austria · Jun 5, 2024
noyb files GDPR complaint against Austrian newspaper Kurier over forced consent
noyb lodged a GDPR complaint against Kurier for forcing users to accept tracking cookies. The Austrian DSB had previously banned the same practice at Profil and ordered compliance, which was not implemented. On 20 August 2024 the DSB…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Investigation
Announced
Austria · Jun 4, 2024
noyb files complaints urging Austrian DSB to investigate Microsoft 365 Education for GDPR violations affecting children
noyb has lodged two complaints with Austria's data protection authority alleging that Microsoft 365 Education breaches GDPR rights of minors by shifting responsibility to schools, providing vague privacy information, and tracking users…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
High
Fine
In effect
Ireland · May 24, 2024 · effective Aug 25, 2026
Irish Data Protection Commission fines HSE €645,000 for GDPR breaches over paper record storage
The Data Protection Commission (DPC) issued a final decision on 25 August 2026, fining the Health Service Executive (HSE) €645,000 for multiple GDPR infringements related to the storage and security of paper medical records. The DPC also…
Data Protection Commission (Ireland) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Apr 29, 2024
noyb files complaint with Austrian DPA over OpenAI's ChatGPT inaccurate personal data
noyb filed a complaint with the Austrian Data Protection Authority alleging that OpenAI cannot correct inaccurate personal data generated by ChatGPT, violating GDPR Articles 5, 15 and 16. The complaint seeks an investigation, compliance…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Sweden · Mar 14, 2024
noyb files complaint against Swedish data broker MrKoll over media licence GDPR exemption
noyb has filed a complaint with the Swedish Data Protection Authority (IMY) challenging the use of a media licence that exempts data broker MrKoll from GDPR obligations. The complaint requests deletion of the complainant’s data…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Feb 16, 2024
noyb files complaint against German credit agency SCHUFA for GDPR access violations
noyb has lodged a complaint and report with the Hessian data protection authority alleging that SCHUFA blocks free access to personal data required under Article 15 GDPR. The agency allegedly uses manipulative designs to push paid products…
Hessian data protection authority · General Data Protection Regulation
Moderate
Data protection authority action
Published
DE-BAVARIA · Feb 5, 2024
Bavarian DPA declares CRIF‑Acxiom data trading illegal under GDPR
The Bavarian data protection authority ruled that credit reference agency CRIF illegally purchased personal data from address trader Acxiom and breached GDPR purpose‑limitation and information duties. The decision follows a similar…
Bavarian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jan 28, 2024
Survey finds 74% of insiders say authorities would find GDPR violations in average EU company
A noyb survey of over 1,000 data‑protection professionals reports that 74% believe authorities would discover relevant GDPR violations during on‑site inspections. Respondents cite lack of clear DPA decisions, fines, and public enforcement…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jan 11, 2024
Meta sued for charging users to withdraw consent in Austria
Noyb filed a complaint with the Austrian Data Protection Authority alleging that Meta forces users to pay up to €251.88 per year to withdraw consent for tracking. The complaint cites Article 7 of the GDPR, which requires withdrawal to be…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jan 4, 2024
noyb files complaint against Austrian creditors’ association KSV1870 for charging for GDPR Article 15 access
noyb lodged a complaint with the Austrian data protection authority alleging that KSV1870 charges €43 for a data‑access service that must be provided free of charge under Article 15 GDPR. The organization allegedly uses misleading website…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Netherlands · Dec 14, 2023
noyb files GDPR and DSA complaint against X (Twitter) over illegal political micro‑targeting
noyb lodged a complaint with the Dutch Data Protection Authority alleging that X (Twitter) used users' political views and religious beliefs for targeted advertising on behalf of the EU Commission. The complaint asserts violations of the…
Dutch Data Protection Authority · Digital Services Act
Moderate
Enforcement
Filed
Austria · Nov 28, 2023
noyb files GDPR complaint against Meta over “Pay or Okay” tracking fee
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Meta’s practice of charging users up to €251.88 a year to avoid personalized advertising violates GDPR consent requirements. The complaint references the…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Nov 16, 2023
noyb files complaint with EDPS over EU Commission’s political micro‑targeting ads on X
noyb lodged a complaint with the European Data Protection Supervisor alleging the EU Commission used unlawful micro‑targeting on X to promote its chat‑control proposal. The ads targeted users based on political views and religious beliefs…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Fine
Decided
Norway (EEA) · Sep 29, 2023
Norwegian Privacy Appeals Board upholds €5.8 million fine against Grindr
The Norwegian Privacy Appeals Board confirmed the Norwegian Data Protection Authority's fine of NOK 65 million against the dating app Grindr for sharing sensitive personal data with third parties. The fine, approximately €5.8 million…
Norwegian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
France · Sep 14, 2023
noyb files three complaints in France alleging illegal data sharing by Fnac, SeLoger, MyFitnessPal apps
noyb lodged complaints with the French data protection authority (CNIL) against the mobile apps of Fnac, SeLoger and MyFitnessPal, alleging they collect and share personal data without user consent. The complaints cite violations of the…
CNIL · ePrivacy Directive
Moderate
Enforcement
Filed
European Union · Aug 31, 2023
noyb files complaints against Fitbit in Austria, Netherlands, Italy over forced consent for data transfers
noyb lodged three complaints with the Austrian, Dutch and Italian data protection authorities alleging that Fitbit forces new EU users to consent to transfers of personal and health data to the United States and other countries. The…
Austrian Data Protection Authority, Dutch Data Protection Authority, Italian Data Protection Authority · General Data Protection Regulation
High
Penalty
Published
European Union · Aug 23, 2023
EU data protection board draft decision imposes €390 million fine on Meta for forced consent
In December 2022, the European Data Protection Board (EDPB) published a draft decision in the “forced consent” case against Meta, finding the company's practices violated the GDPR. The decision resulted in a €390 million fine. The case…
European Data Protection Board · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Aug 14, 2023
noyb reports 23 years of illegal EU‑US data transfers and limited enforcement actions
The EU Court of Justice invalidated the Safe Harbor and Privacy Shield deals in 2015 and 2020, making all EU‑US data transfers since 2000 illegal. Despite this, most DPAs have not acted on 101 complaints filed by noyb, with only Sweden…
European Commission · EU-U.S. Data Privacy Framework
Moderate
Enforcement
Announced
European Union · Aug 1, 2023
Meta to switch to consent for behavioral ads after EU litigation
Meta announced it will seek user consent before showing behavioral ads in the EU and Switzerland, changing its legal basis from legitimate interest to consent. The move follows litigation by noyb, decisions by the EDPB and the CJEU, and a…
Irish Data Protection Commission · General Data Protection Regulation
High
Data protection authority action
Filed
Spain · Jul 27, 2023
noyb files complaint with Spanish DPA over Ryanair’s facial‑recognition verification for travel‑agent bookings
noyb lodged a complaint with Spain's Data Protection Authority (AEPD) alleging that Ryanair forces customers who book via online travel agents to undergo a facial‑recognition verification process. The complaint argues that Ryanair lacks a…
Spanish Data Protection Authority (AEPD) · General Data Protection Regulation
