| Case | Logded | CSA | LSA | Company | Status | Duration | Summary | Links |
| C001 | 5/25/2018 | France | Google Ireland Limited | Partly Decided | 4 years 8 months 26 days | The complaint is one of four complaints on "forced consent" (see C001 to C004). The issue is that the user is forced to consent to the processing of their personal data to use the service. | https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook | |
| C002 | 5/25/2018 | Austria | Ireland | Meta Ireland Limited | Waiting for DPA | 4 years 8 months 26 days | https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook | |
| C003 | 5/25/2018 | Belgium | Ireland | Waiting for DPA | 4 years 8 months 26 days | The complaint is one of four complaints on "forced consent" (see C001).). It was filed in Belgium and forwarded to the Irish DPA (Irish DPA) as the lead supervisory authority. |
https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook | |
| C004 | 5/25/2018 | Germany | Ireland | WhatsApp Ireland Limited | Waiting for DPA | 4 years 8 months 26 days | The complaint is one of four complaints on "forced consent". It was filed in Hamburg and forwarded to the Federal German DPA (BfDI) and then Irish DPA (DPC) as the lead supervisory authority. |
https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook |
| C005 | 12/3/2018 | France | Criteo | Waiting for DPA | 4 years 1 month 14 days | This case concerns the freedom to choose any form (like email or letters) to exercise GDPR rights, while companies often require to use very complicated online forms, plugins or other obscure methods. | https://noyb.eu/en/test-cases-freedom-exercise-gdpr-rights-any-format | |
| C006 | 12/11/2018 | Austria | Ireland | Google Ireland Limited | Waiting for DPA | 4 years 1 month 6 days | This case concerns the freedom to choose any form (like email or letters) to exercise GDPR rights, while companies often require very complicated online forms, plugins or other obscure methods. | https://noyb.eu/en/test-cases-freedom-exercise-gdpr-rights-any-format |
| C007 | 1/18/2019 | Austria | Netherlands | Netflix | Waiting for DPA | 4 years 8 days | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far not a single case have been decided. | https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C008 | 1/18/2019 | Austria | Netherlands | Netflix | Waiting for DPA | 4 years 8 days | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far not a single case have been decided. | https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C009 | 1/18/2019 | Austria | United Kingdom | DAZN - Perform Investment Ltd. | Open | 4 years 8 days | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided. | https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C010 | 1/18/2019 | Austria | United Kingdom | DAZN - Perform Investment Ltd. | Open | 4 years 8 days | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided. | https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C011 | 1/18/2019 | Austria, Austria | Germany | Soundcloud | Waiting for DPA | 4 years 8 days | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided. | https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C012 | 11/11/2021 | Austria | Grindr LLC | Waiting for DPA | 1 year 2 months 20 days | This case is very recent and concerns the way Grindr authenticated users who tried to exercised their rights. It seems to be followed-up swiftly by the Austrian DPA, as there is no need for cooperation with other DPAs. So far, we have no concern about the | https://noyb.eu/en/want-your-grindr-data-show-your-id-and-take-selfie | |
| C014 | 1/18/2019 | Austria | Ireland | YouTube LLC (USA) | Waiting for DPA | 4 years 8 days | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided. | https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C015 | 1/18/2019 | Austria | Sweden | Spotify | Waiting for DPA | 4 years 8 days | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far not a single case have been decided. | https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C016 | 1/18/2019 | Austria | Luxembourg | Amazon (Luxemburg) | Waiting for DPA | 4 years 8 days | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. | https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C017 | 1/18/2019 | Austria | Ireland | Apple Ireland | Waiting for DPA | 4 years 8 days | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been | https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C018 | 12/10/2019 | France | Webedia | Waiting for DPA | 3 years 1 month 2 days | Given the experiance with the "cooperation mechanism" this case was filed directly with the lead authority (the French CNIL). | https://noyb.eu/en/say-no-cookies-yet-see-your-privacy-crumble | |
| C019 | 12/10/2019 | France | Conde Nast | Waiting for DPA | 3 years 1 month 2 days | Given the experience with the "cooperation mechanism" this case was filed direclty with the lead supervisory authority (the French CNIL). | https://noyb.eu/en/say-no-cookies-yet-see-your-privacy-crumble | |
| C020 | 12/10/2019 | France | Cdiscount | Waiting for DPA | 3 years 1 month 2 days | Given the experiance with the "cooperation mechanism" this case was filed directly with the lead authority (the French CNIL). | https://noyb.eu/en/say-no-cookies-yet-see-your-privacy-crumble | |
| C021 | 1/14/2020 | Ireland, Norway | Grindr LLC, Twitter MoPub, AppNexus (now Xandr), OpenX | Appeal Pending | 3 years 12 days | This complaint is connected to the complaints on Grindr and online advertisment. In this case there is no lead supervisory authority as Grindr does not have a main office in the EU. noyb worked together with the Norwegian Consumer Council (NCC) who submi |
https://noyb.eu/en/three-gdpr-complaints-filed-against-grindr-twitter-and-adtech-companies-smaato-openx-adcolony-and | |
| C022 | 1/14/2020 | Norway | Grindr LLC, AdColony | Waiting for DPA | 3 years 12 days | This complaint is connected to the complaints on Grindr and online advertisment. In this case there is no lead supervisory authority as Grindr does not have a main office in the EU. noyb worked together with the Norwegian Consumer Council (NCC) who submi |
https://noyb.eu/en/three-gdpr-complaints-filed-against-grindr-twitter-and-adtech-companies-smaato-openx-adcolony-and | |
| C023 | 1/14/2020 | Norway | Germany | Grindr LLC, Smaato, Inc. | Waiting for DPA | 3 years 12 days | This complaint is connected to the complaints on Grindr and online advertisment. | https://noyb.eu/en/three-gdpr-complaints-filed-against-grindr-twitter-and-adtech-companies-smaato-openx-adcolony-and |
| C024 | 2/3/2020 | Germany | Luxembourg | Amazon (Luxemburg) | Waiting for DPA | 2 years 11 months 7 days | This case concerned problematic email server settings by Amazon. It was filed with the Hessen DPA, then assigned to the Bavarian DPA under German procedural rules and then forwarded to the Luxembourg DPA, being the lead supervisory authority for Amazon in Europe. | https://noyb.eu/en/project/encryption-privacy-design |
| C026 | 5/13/2020 | Austria | Google LLC | Open | 2 years 8 months 27 days | Google LLC argues that the Austrian DPA is not competent for the processing connected to the OS Android, but that this case should be decided by the Irish DPA (DPC), despite the fact that it is filed agains the US entitiy of Google (Google LLC). | https://noyb.eu/en/complaint-filed-against-google-tracking-id | |
| C027 | 10/2/2020 | Austria | A1 Telekom Austria | Appeal Pending | 2 years 3 months 5 days | This case is a purely national case, regarding incomplete access under Article 15 GDPR to traffic and geolocation data processed by A1, the national phone carrier of Austria. The practices of A1 were accepted by the Austrian DPA (DSB) even prior to GDPR and also in codes of conduct under Article 40 GDPR. In October 2021, the DSB issued a decision dismissing most parts of the complaint. It argued that the data subject could not prove that he was the sole user of his cell phone at all times and therefore would not be entitled to access on the geolocation data generated by his mobile phone. Regarding traffic data, the DSB held that the national rules implementing the e-Privacy Directive qualifies as lex specialis prevailing over Article 15 GDPR. noyb filed an appeal against the somewhat puzzling decision of the DSB. The appeal is currently pending with the Federal Administrative Court (BVwG). |
https://noyb.eu/en/a1-where-were-you-none-your-business | |
| C028 | 7/31/2020 | Austria | CRIF GmbH (Austria) | Appeal Pending | 2 years 5 months 8 days | This is a purely national case on unlawful processing operations by the credit reference agency CRIF. The decision of the Austrian DPA partially upheld and partially dismissed the complaint. | https://noyb.eu/en/credit-scoring-negative-credit-rating-generated-without-data | |
| C029 | 8/17/2020 | n/a | n/a | 101 complaints | Partly Decided | 2 years 5 months 21 days | These cases concern 101 websites that transfers personal data to the United States after the "Schrems II" judgment via Google Analytics and Facebook. The first final decision was issued by the Austrian Austrian DPA in January 2022, upholding noyb's complaint against the website provider. The other 100 cases were forwared to almost every DPA in the European Union. Many are currently processed, including submissions by the repondents and submissions by noyb. For some, there was no information or submissions about 1.5 years into the complaints procedure. In detail, as of January 2022 - 1 case has been decided on the merits - 1 case has been dismissed, as the website provider seems to not have used the relevant website tools - 4 cases have been withdrawn by noyb - 3 cases appear to have been "lost" as the Bulgarian DPA persistently denies to have received them, despite noyb resubmitting them several times - the status of almost 60 complaints is entirely unclear as noyb has received no more than confirmations of receipt or a notice, that the case has been passen on to the respective lead supervisory authority - as for the rest, there has been at least some exchange of submissions with the respondents or update reports from the DPA. However, the last communication often dates back over a year, and most request for updates are are ignored by the DPAs so far, so it seems unclear when a decision is to be expected. |
https://noyb.eu/en/101-complaints-eu-us-transfers-filed |
| C030 | 10/13/2020 | Austria | AZ Direct | Appeal Pending | 2 years 3 months 24 days | This is a case on an address broker ("AZ Direct") that refused to provide information on the origin and recipients of the data processed. | https://noyb.eu/en/address-broker-gdpr-compliance-too-burdensome | |
| C031 | 4/28/2022 | Malta | C-Planet | Deadline Pending | 9 months 2 days | https://noyb.eu/en/maltese-voter-data-leaked-online-noyb-files-complaint | ||
| C032 | 10/21/2020 | Austria | Hungary | Wizz Air | Waiting for DPA | 2 years 3 months 16 days | The complaint concerns the right to rectification of a passenger name for free, as provided for under Article 16 GDPR. |
https://noyb.eu/en/wizz-air-eu1-flight-eu35-your-gdpr-right |
| C034 | 11/24/2020 | Germany | Apple Ireland | Waiting for DPA | 2 years 2 months 12 days | The complaint concerns the unauthorized creation of an "Ad ID" by Apple. The case was brought under the national implementation of the ePrivacy Directive (not the GDPR) in Germany. | https://noyb.eu/en/noyb-files-complaints-against-apples-tracking-code-idfa | |
| C037 | 8/10/2021 | Austria | n/a | Cookie Banners | Waiting for DPA | 1 year 5 months 23 days | noyb filed a total number of 463 complaints with 20 different DPAs in August 2021. The European Data Protection Board (EDPB) set up a taskforce to coordinate the response to noyb's complaints. noyb withdrew three complaints as the controllers remedied all violations after the filing of the complaints. | https://noyb.eu/en/where-did-all-reject-buttons-come |
| C038 | 3/18/2021 | Austria | CRIF, AZ Direct | Waiting for DPA | 1 year 10 months 18 days | The case concerns data sharing between address publishers and credit ranking agencies. It does not involve the one-stop-shop and is treated as a national case by the Austrian DPA. Complaint is directed against both CRIF and AZ Direct. | https://noyb.eu/en/illegal-data-exchange-between-address-publisher-and-credit-ranking-agency | |
| C039 | 2/8/2021 | Austria | KSV 1870 | Waiting for DPA | 1 year 11 months 26 days | The case concerns the credit referency agency KSV 1870 which feeds data from access request int their creditworthiness database (purpose limitation issue). The case does not involve the one-stop-shop and is treated as a national case by the Austrian DPA. | https://noyb.eu/en/right-access-data-protection-boomerang | |
| C040 | 10/22/2021 | Austria | Luxembourg | Amazon (Luxemburg) | Waiting for DPA | 1 year 3 months 10 days | The case concerns the automatic decision when trying to pay using to Amazon Monthly Invoice" service. In December 2021, the Austrian DPA informed us that the case has been forwarded to Luxembourg as the lead supervisory authority. We are waiting for an update by the Austrian DPA which so far does not reply to our emails and does not pick up the phone. |
https://noyb.eu/en/black-box-amazon-algorithm-discriminates-customers |
| C041 | 7/4/2021 | France | Google Ireland Limited | Waiting for DPA | 1 year 6 months 0 days | The case concerns the unauthorized creation of an Ad ID on Google Andorid devices. In July 2021, the French DPA (CNIL) confirmed that the investigation was still ongoing. Since then, we did not receive any updates. |
https://noyb.eu/en/buy-phone-get-tracker-unauthorized-tracking-code-illegally-installed-android-phones | |
| C042 | 7/31/2020 | Germany | PimEyes | Waiting for DPA | 2 years 5 months 8 days | This case is about the collection and use of publicly available photos of faces from websites by Pimeyes. | None | |
| C043 | 5/27/2021 | Austria | Clearview AI | Waiting for DPA | 1 year 8 months 8 days | This case is about the collection and use of publicly available photos of faces from websites by Clearview. Clearview uses the images to create a biometric database of faces and their photos. Its customers can use a photo of a face to search the database. | https://noyb.eu/en/digital-rights-alliance-file-legal-complaints-against-facial-recognition-company-clearview-ai | |
| C044 | 10/18/2021 | Germany, Germany | CRIF Bürgel (Germany) | Waiting for DPA | 1 year 3 months 14 days | The case concerns the German credit reference agency CRIF Bürgel and it's data supplier Acxiom (an address trader). It does not involve the one-stop-shop and was directly filed with the Bavarian DPA. | https://noyb.eu/en/illegal-credit-scores-noyb-amplify-pressure | |
| C045 | 8/13/2021 | Germany | Spiegel | Waiting for DPA | 1 year 5 months 20 days | This case concerns the "pay or okay" approach by various news outlets. | https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price | |
| C046 | 8/13/2021 | Austria | DerStandard | Waiting for DPA | 1 year 5 months 20 days | This case concerns the "pay or okay" approach by various news outlets. | https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price | |
| C047 | 8/13/2021 | Germany | ZEIT | Waiting for DPA | 1 year 5 months 20 days | This case concerns the "pay or okay" approach by various news outlets. | https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price | |
| C048 | 8/13/2021 | Germany | heise | Waiting for DPA | 1 year 5 months 20 days | This case concerns the "pay or okay" approach by various news outlets. | https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price | |
| C049 | 8/13/2021 | Austria | Krone | Waiting for DPA | 1 year 5 months 20 days | This case concerns the "pay or okay" approach by various news outlets. | https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price | |
| C050 | 8/13/2021 | Germany | t-online | Waiting for DPA | 1 year 5 months 20 days | This case concerns the "pay or okay" approach by various news outlets. | https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price | |
| C051 | 8/13/2021 | Germany | FAZ | Waiting for DPA | 1 year 5 months 20 days | This case concerns the "pay or okay" approach by various news outlets. | https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price | |
| C052 | 11/22/2021 | Ireland | Airbnb | Waiting for DPA | 1 year 2 months 9 days | This case concerns automated decisons on Airbnb host ratings. The Rheinland-Pfalz DPA confirmed receipt of the complaint in December 2021. |
https://noyb.eu/en/gdpr-complaint-airbnb-hosts-mercy-algorithms | |
| C053 | 12/22/2021 | Luxembourg | Amazon (Luxemburg) | Waiting for DPA | 1 year 1 month 9 days | This case concerns automated decision making when signing up to become an "Amazon Turk". The Luxemburg DPA acknowledged receiving the complaint on 29/12/2021. Waiting for the next steps and udpates. |
https://noyb.eu/en/complaint-filed-help-my-recruiter-algorithm | |
| C054 | 12/15/2021 | Austria | Google LLC | Waiting for DPA | 1 year 1 month 16 days | None | ||
| C055 | 2/25/2022 | Germany | paydirekt / giropay | Appeal Pending | 11 months 4 days | A payment processor for webshops processes special catgeory data as a controller. | https://noyb.eu/en/giropay-knows-what-you-bought-last-summer | |
| C056 | 3/2/2022 | Austria | Estonia | Bolt | Waiting for DPA | 10 months 29 days | None | |
| C057 | 3/24/2022 | Austria | AZ Direct | Waiting for DPA | 10 months 7 days | None | ||
| C058 | 10/20/2022 | Austria | Profil Redaktion GmbH | Waiting for DPA | 3 months 7 days | The website profil.at does not accept users' refusal to certain tracking/advertising tools. If a user tries to reject everything in the 1st layer of the cookie banner, a 2nd layer appears telling the user that their "consent is mandatory". Users are forced to accept in order to be able to use the website. Furthermore it is impossible to withdraw this unlawful consent. | https://noyb.eu/en/two-are-better-one-profilat-strikes-back-forced-banner-when-users-make-wrong-choice | |
| C059 | 8/24/2022 | Google Ireland Limited, Google LLC | Waiting for DPA | 5 months 4 days | We filed a complaint against Google for sending marketing emails without consent. | https://noyb.eu/en/gmail-creates-spam-emails-despite-cjeu-judgment |