Commission proposes changes to EU cookie consent obligations
The European Commission proposes simplifying cookie consent rules by revising the e-Privacy framework, prompting industry support and privacy-focused opposition ahead of new ad regulation.
GDPR
Court of Appeal upholds GDPR fine against Grindr
Norwegian court upheld a major GDPR fine against Grindr for improper processing and sharing of sensitive and location data, stressing stricter requirements for consent, minimization and safeguards.
Dutch regulator fines Experian Netherlands €2.7M for unlawful data use
The Dutch regulator fined Experian Netherlands €2.7M for unlawfully collecting and processing personal data for credit assessments without proper transparency, lawful basis, or data subject rights.
NOYB files criminal complaint over Clearview AI’s GDPR violations
Criminal complaint in Austria seeks prosecution of Clearview AI for mass biometric data scraping after multiple EU GDPR fines and bans exposed enforcement limitations against a U.S. company.
EDPB and European Commission Publish Joint Guidelines on DMA and GDPR
EDPB and European Commission issued joint guidelines clarifying how gatekeepers must apply GDPR obligations when complying with the Digital Markets Act; public consultation open until 4 Dec 2025.
EDPB launches coordinated enforcement action on GDPR transparency obligations
The EDPB will coordinate an EU-wide enforcement action on GDPR transparency and information obligations, with national DPAs participating voluntarily and the action launching in 2026.
Austria finds Microsoft illegally tracked students
Austrian regulator found Microsoft 365 Education illegally tracked students via cookies; Microsoft must grant data access and faces scrutiny over transparency and GDPR compliance.
EU delays Chat Control plans after member states fail to agree
EU plans to force scanning of encrypted messages were postponed after Germany opposed Chat Control; critics say it would weaken encryption, harm security and push users to risky alternatives.
CJEU confirms GDPR compensation cannot be replaced by prohibitory injunctions
The CJEU rules prohibitory injunctions cannot reduce or replace GDPR compensation for past non‑material damage from unlawful data disclosures, reaffirming a distinct compensatory right.
EU considers changes to cookie consent rules
EU plans to simplify cookie consent rules to reduce repetitive banners, propose browser-level preferences and possible GDPR alignment, drawing industry support and privacy concerns.
Advocate General: Legal recognition of gender identity must not be conditioned on surgery
EU law may bar national rules requiring surgery to change gender markers in civil documents, protecting free movement, privacy and accurate identity data.
CJEU clarifies GDPR remedies and compensation for moral harm
The CJEU ruled GDPR does not create a mandatory right to a preventive injunction but allows compensation for moral harm even for non‑serious distress, and injunctions cannot replace damages.