Key points
- noyb has secured administrative fines totalling €2 billion through its legal actions to date.
- The organisation is preparing its first collective redress case against the Austrian credit agency CRIF.
- A second GDPR complaint against OpenAI has been filed, alongside a cease-and-desist letter to Meta.
The European privacy advocacy group noyb has published its 2025 annual report, detailing a significant expansion in its enforcement strategies. The organisation announced it is preparing for its first collective redress case against the Austrian credit agency CRIF, a project that will occupy its resources into 2026. This marks a strategic shift from individual complaints to broader legal actions, according to the report.
In addition to the CRIF case, noyb has intensified its scrutiny of artificial intelligence systems. The group filed its second GDPR complaint against OpenAI and sent a cease-and-desist letter to Meta regarding its AI training practices. These actions reflect noyb’s view that collective redress is becoming the primary new approach to enforcement, with plans to expand in this area as more details emerge.
Regulatory wins and policy influence
The 2025 report highlights several major regulatory victories and ongoing policy engagements. The French data protection authority fined Google €325 million for sending spam emails via Gmail, while Condé Nast was fined €750,000 for placing cookies without user consent. Additionally, the Austrian data protection authority ruled that Microsoft 365 Education’s use of tracking cookies without consent was illegal.
On the policy front, noyb dedicated significant resources to the European Commission’s Digital Omnibus package. As the only non-profit organisation working exclusively on the GDPR for many years, the group shared its legal expertise with policymakers. This involvement limited resources for other matters but was deemed crucial for its mission to influence European data protection standards.
Court rulings and institutional pressure
Two major court rulings in noyb’s favour were also reported. In January 2025, the EU’s General Court ruled that the Irish Data Protection Commission must investigate a noyb complaint against Meta originally filed in 2018. The case reached the General Court after the European Data Protection Board determined the Irish authority should have investigated the use of sensitive data under Article 9 of the GDPR. The Irish commission had sued the Board, claiming it overreached, but the court dismissed those claims.
Our take on the response
The move towards collective redress suggests a maturing enforcement landscape in Europe. By targeting credit agencies and AI developers, noyb is testing the boundaries of group litigation under GDPR. This approach could lead to larger financial penalties and broader compliance requirements for companies handling sensitive data. The dismissal of the Irish DPC’s claims against the EDPB further strengthens the mechanism for cross-border enforcement.
Background: GDPR
The GDPR in Germany operates as the primary framework for personal data protection. German authorities enforce strict consent requirements and maintain detailed accountability standards. Organisations must map data flows precisely and appoint local representatives where necessary to avoid significant penalties.
Read the full guide: GDPR in Germany: How Strict Enforcement Shapes Data Compliance
What to do and how to stay safe: noyb
- Monitor regulatory announcements from your local data protection authority for new fines or rulings.
- Review your organisation’s cookie consent mechanisms to ensure they meet current legal standards.
- Assess your AI training data sources for potential GDPR compliance risks, especially regarding sensitive data.
- Stay informed about developments in collective redress laws within the European Union.
Step-by-step guide: Detect Online Tracking: Signs in Logs, Browsers and Network Traffic
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much in fines has noyb helped secure?
To date, noyb’s legal work has resulted in administrative fines totalling €2 billion.
Who is the target of noyb’s first collective redress case?
The first collective redress case is being prepared against the Austrian credit agency CRIF.
Did noyb take action against any AI companies in 2025?
Yes, noyb filed a second complaint against OpenAI and sent a cease-and-desist letter to Meta.