Precedent corpus / EDPB (European Data Protection Board)
European Data Protection Board
EDPB (European Data Protection Board) case GL-01-2025, decided . No monetary penalty.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.
Regulator guidance (positive exemplar)
What the regulator decided
Pseudonymised data which could be attributed to an individual by the use of additional information remains information relating to an identifiable natural person and is therefore personal data within the meaning of Article 4(1) GDPR. Pseudonymisation can support Article 5, Article 25 and Article 32 compliance but does not, by itself, take the data outside the GDPR's material scope.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://www.edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdfConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
Non-enforcement guideline (public consultation draft). Cite when the scanner narrative covers a controller arguing that a hashed-email join key or pseudonymous device-ID is not personal data - the EDPB's position is unambiguously that pseudonymous data is personal data so long as re-identification is reasonably feasible. Companion to DPC Apple IN-20-39-1.
Verification trail
Checked against the primary source on 27th May 2026. Next review 27th November 2026.
Cite this case
@misc{consentmark-precedent-edpb-gl-01-2025,
author = {{ConsentMark}},
year = {2025},
title = {EDPB (European Data Protection Board) GL-01-2025 - European Data Protection Board},
howpublished = {\url{https://www.consentmark.com/precedent/edpb-gl-01-2025}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2025, January 16). EDPB (European Data Protection Board) GL-01-2025 - European Data Protection Board. Methodology v7.8.1. https://www.consentmark.com/precedent/edpb-gl-01-2025[EDPB (European Data Protection Board) GL-01-2025 - European Data Protection Board - ConsentMark](https://www.consentmark.com/precedent/edpb-gl-01-2025)EDPB (European Data Protection Board) GL-01-2025 - European Data Protection Board - ConsentMark, 2025-01-16, methodology v7.8.1, https://www.consentmark.com/precedent/edpb-gl-01-2025