noyb remains one of the leading European forces pushing for the fundamental right to data protection for all users. To date, our legal work has resulted in administrative fines totalling €2 billion. In 2025, we not only filed several new GDPR complaints, but also began preparations for our first first collective redress case and dedicated significant resources to the EU Commission's Digital Omnibus package.
Our biggest projects in 2025. In 2025, noyb has started preparations for its first collective redress case against the Austrian credit agency CRIF. This project will keep us busy in 2026. We’ve also kept up the pressure against unlawful AI systems: noyb has filed its second complaint against OpenAI and has sent a cease-and-desist letter to Meta over AI training. While many details are still unclear, we see collective redress as the primary new approach to enforcement and intend to expand in this area.
Policy work. In addition, the EU Commission’s plans for the Digital Omnibus required us to increasingly share our legal expertise and litigation experience with policy makers and stakeholders on the European level. As the only non-profit organisation working exclusively on the GDPR for many years, noyb needs to take an active role in the policy space. This has limited our resources for other matters, but seems to have been crucial for our mission.
Court decisions and fines. We also obtained a number of new decisions from authorities and courts. Among other things, the French DPA fined Google €325 million for "spam emails" in Gmail, while Conde Nast was fined €750,000 for placing cookies without consent. In the meantime, the Austrian DPA decided that Microsoft 365 Education used tracking cookies without consent, which was found to be illegal.
In addition, we also received two major court rulings in our favour. In January 2025, the EU's General Court ruled that the Irish Data Protection Commission (DPC) must investigate a noyb complaint against Meta that had already been filed in 2018. The case ended up before the General Court after the EDPB decided that the DPC should have also investigated the use of sensitive data (Article 9 GDPR). Instead of following the EDPB's guidance, the DPC sued it before the European Courts, claiming that the EDPB had overreached. The EU’s General Court has dismissed the DPC’s claims.
Then, in December 2025, the Austrian Supreme Court ruled that Meta must disclose all personal data it has on its users and also provide specific information on all data, such as the source, recipient or purpose of processing. The ruling is based on a case brought by Max Schrems in 2014, which hit the Austrian Supreme Court three times and the European Court of Justice two times.
Thank you! None of our work would have been possible without our 5,400 supporting members, institutional members and every individual person who donates to noyb. We deeply appreciate this support, especially in these difficult economic times. Your generosity and dedication enable us to continue our work and make a meaningful impact on digital rights.
Read all about our new and ongoing projects, financials and plans for 2026 in noyb’s Annual Report 2025!
