{ "schemaVersion": "1.0", "corpus": "precedent", "title": "ConsentMark precedent corpus v2", "version": "v2", "canonicalUrl": "https://www.consentmark.com/precedent/registry.v2.json", "humanUrl": "https://www.consentmark.com/precedent", "publisher": { "name": "Obscurity Ltd", "cro": "622475", "jurisdiction": "Ireland", "url": "https://obscurity.ie" }, "licence": { "name": "ConsentMark corpus compilation licence 1.0", "summary": "You may quote, cite and redistribute this corpus, in whole or in part, for any purpose, provided you attribute it to Obscurity Ltd and cite the canonical URL and the asOf date. You may not re-characterise it: presenting a value, a grade band, a gate or a consent state as saying something this corpus does not say, or presenting a derived work as the published corpus, is outside these terms.", "attributionRequired": true, "derivativeReCharacterisation": "not permitted" }, "citeAs": "ConsentMark. (2026, August 27). ConsentMark precedent corpus v2. Obscurity Ltd (CRO 622475). https://www.consentmark.com/precedent", "asOf": "2026-08-27", "generatedAt": "2026-09-20T15:53:28.366Z", "frozenAtPublication": "Frozen at publication. This corpus is the record as it stood on its asOf date. Corrections are published as new dated versions at their own URL, and nothing here is edited in place.", "methodologyVersion": "v7.9", "count": 57, "relevanceSplit": { "gate": 19, "context": 38, "rule": "A decision is labelled gate only when its own text names an ePrivacy prior-consent provision or the subject matter the gates test - storage or access on terminal equipment, cookies, trackers, a consent string. The label is refused at build time otherwise, so it cannot be claimed for a decision that does not earn it. Everything else is context: real enforcement about something a browser check does not observe." }, "appealCoverage": { "checked": 3, "notChecked": 54, "sourced": 1, "statement": "Appeal status has been checked for 3 of 57 entries, 1 of which cite a source - a decision found to be unappealed has no document to link to. The remaining 54 carry a status of not_checked, which means we have not looked - it is not a finding that no appeal exists." }, "appealStatusVocabulary": { "not_checked": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists.", "none": "We checked and found no appeal on the public record.", "final": "A preliminary ruling of the Court of Justice is final. No appeal lies from it.", "appealed": "An appeal is pending, or its outcome is not on the public record. Not final.", "overturned": "Annulled or materially reduced on appeal. The entry's note says which and cites the source.", "upheld": "The decision survived appeal." }, "rights": { "compilation": "The compilation licence in this envelope covers our compilation: the selection of decisions, their arrangement, the gate and context split, the appeal-status field and our notes. Cite it with attribution and the canonical URL.", "regulatorText": "It does not cover the authorities' own decision texts, which are not ours to license. Each entry links the primary source and, where one exists, a Wayback snapshot of it. Take the text from there and under whatever terms the authority sets.", "findingAndNotes": "A finding or a notes line may be quoted as written. It may not be re-characterised: restating either as holding something it does not hold, or presenting a derived summary as this corpus, falls outside these terms." }, "supersedes": { "version": "v1", "url": "https://www.consentmark.com/precedent/registry.v1.json", "note": "v1 stays at its own URL in its original nine-field shape. It is not edited to carry the fields added here, because a consumer who pinned it pinned a contract." }, "decisions": [ { "slug": "ico-reddit-2026-02", "url": "https://www.consentmark.com/precedent/ico-reddit-2026-02", "regulator": "ico", "regulatorLabel": "ICO (United Kingdom)", "caseRef": "reddit-2026-02", "date": "2026-02-23", "respondent": "Reddit, Inc.", "respondentAnonymised": false, "finding": "Reddit did not apply any robust age-assurance mechanism on its UK service and therefore had no lawful basis under Article 6 or Article 8 UK GDPR for processing the personal data of UK children under 13; the lawfulness and fairness principle in Article 5(1)(a) was breached and Reddit had not carried out a data protection impact assessment to assess and mitigate risks to children, in breach of Article 35 UK GDPR, before January 2025.", "notes": "Cite when a scanner finds an online service with under-13 reach and no age-assurance signal beyond a self-declared birth-date - the ICO has now ruled explicitly that self-declaration without verification is not lawful basis under Article 8.", "relevance": "context", "fineEur": 16500000, "fineNative": { "currency": "GBP", "amount": 14470000 }, "fineApproximate": true, "primarySourceUrl": "https://ico.org.uk/media2/hrlmvj14/reddit-mpn-20260223.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "ICO (United Kingdom). (2026, February 23). reddit-2026-02 - Reddit, Inc.. Primary source: https://ico.org.uk/media2/hrlmvj14/reddit-mpn-20260223.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/ico-reddit-2026-02" }, { "slug": "cnil-san-2025-017", "url": "https://www.consentmark.com/precedent/cnil-san-2025-017", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2025-017", "date": "2025-12-30", "respondent": "Undisclosed loyalty-programme operator (anonymised by CNIL)", "respondentAnonymised": true, "finding": "A loyalty-programme operator transmitted members' email addresses and phone numbers to a social network for custom-audience advertising from 2018 without valid consent for that transmission - the sign-up form gave no information about it, so the consent collected for prospecting could not extend to matching the list against an advertising platform - breaching Articles 6, 12-13, 32 and 35 GDPR and Article 82 of the French Data Protection Act.", "notes": "The on-point authority for CRM-list upload governance (Google Customer Match, Meta Custom Audiences): consent to email/SMS prospecting does not cover matching the list against an ad platform - that transmission needs specific, explicitly-worded consent naming it and its purpose. Pairs with SAN-2023-009 (Criteo) on upstream consent never being assumable.", "relevance": "gate", "fineEur": 3500000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.cnil.fr/fr/transmission-de-donnees-un-reseau-social-des-fins-publicitaires-sanction", "archiveUrl": "https://web.archive.org/web/20260403223236/https://www.cnil.fr/fr/transmission-de-donnees-un-reseau-social-des-fins-publicitaires-sanction", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-08-16", "reviewDue": "2027-02-16", "citeAs": "CNIL (France). (2025, December 30). SAN-2025-017 - Undisclosed loyalty-programme operator (anonymised by CNIL). Primary source: https://www.cnil.fr/fr/transmission-de-donnees-un-reseau-social-des-fins-publicitaires-sanction. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2025-017" }, { "slug": "cnil-san-2025-011", "url": "https://www.consentmark.com/precedent/cnil-san-2025-011", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2025-011", "date": "2025-11-27", "respondent": "AMERICAN EXPRESS CARTE FRANCE", "respondentAnonymised": false, "finding": "American Express recorded the content of customer-service calls without demonstrating necessity for the processing, breaching the data-minimisation principle in Article 5(1)(c) GDPR; and the cookie-consent-withdrawal mechanism on its website did not effectively stop the reading of previously-set cookies, breaching the consent-withdrawal limb of Article 82 of the French Data Protection Act.", "notes": "Financial-services precedent. Cite when the scanner narrative needs the principle that withdrawal of consent must stop downstream reads (not only future writes), alongside SAN-2024-019 (Orange) and SAN-2025-010 (Condé Nast).", "relevance": "gate", "fineEur": 1500000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052981827", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2025, November 27). SAN-2025-011 - AMERICAN EXPRESS CARTE FRANCE. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052981827. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2025-011" }, { "slug": "cnil-san-2025-010", "url": "https://www.consentmark.com/precedent/cnil-san-2025-010", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2025-010", "date": "2025-11-20", "respondent": "LES PUBLICATIONS CONDE NAST", "respondentAnonymised": false, "finding": "Trackers were deposited on users' terminals before any consent action, in breach of Article 82 of the French Data Protection Act; the information presented in the banner did not describe the purposes of the trackers accurately; and trackers continued to be read after users had refused or withdrawn consent. The asymmetry between the ease of acceptance and the difficulty of refusal also undermined the freely-given character of any consent obtained.", "notes": "Media-publisher precedent (Vogue, Vanity Fair, GQ France). Cite when the scanner narrative covers an ad-supported editorial site where tag fires precede the CMP interaction or where refusal does not stop downstream reads. Comparable in pattern to SAN-2024-019 (Orange) but in the editorial-publisher sector rather than telco webmail.", "relevance": "gate", "fineEur": 750000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052851847", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2025, November 20). SAN-2025-010 - LES PUBLICATIONS CONDE NAST. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052851847. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2025-010" }, { "slug": "ico-lastpass-2025-11", "url": "https://www.consentmark.com/precedent/ico-lastpass-2025-11", "regulator": "ico", "regulatorLabel": "ICO (United Kingdom)", "caseRef": "lastpass-2025-11", "date": "2025-11-20", "respondent": "LastPass UK Limited", "respondentAnonymised": false, "finding": "In August 2022 an attacker compromised the corporate laptop of an EU-based LastPass employee and then a US-based employee's personal laptop used for work, capturing a master credential and accessing the LastPass backup database to take customer names, email addresses, phone numbers and stored website URLs of up to 1.6 million UK customers; LastPass had not implemented appropriate controls around BYOD device usage, breaching Article 5(1)(f) and Article 32(1) UK GDPR.", "notes": "The ICO highlighted BYOD-on-personal-devices as the central control failure - LastPass's zero-knowledge vault encryption prevented full credential extraction, but metadata loss alone was sufficient for an Article 32 breach. Cite when a scanner finds analytics or operations administered from personal devices outside a managed endpoint estate.", "relevance": "context", "fineEur": 1430000, "fineNative": { "currency": "GBP", "amount": 1228283 }, "fineApproximate": true, "primarySourceUrl": "https://ico.org.uk/media2/xfbl1uaa/lastpass-uk-ltd-penalty-notice.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "ICO (United Kingdom). (2025, November 20). lastpass-2025-11 - LastPass UK Limited. Primary source: https://ico.org.uk/media2/xfbl1uaa/lastpass-uk-ltd-penalty-notice.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/ico-lastpass-2025-11" }, { "slug": "ico-capita-2025-10", "url": "https://www.consentmark.com/precedent/ico-capita-2025-10", "regulator": "ico", "regulatorLabel": "ICO (United Kingdom)", "caseRef": "capita-2025-10", "date": "2025-10-15", "respondent": "Capita plc and Capita Pension Services Limited", "respondentAnonymised": false, "finding": "In March 2023 a ransomware actor obtained access to Capita's corporate environment via a malware-bearing download on a Capita employee laptop and exfiltrated personal data of approximately 6.6 million people, including pension members of 325 client schemes; Capita had been aware of the underlying vulnerabilities, did not treat the early indicators as a security incident, and lacked adequate technical and organisational measures, breaching Article 5(1)(f) and Article 32 UK GDPR.", "notes": "Fine split: GBP 8M against Capita plc as controller + GBP 6M against Capita Pension Services Limited as processor. The initial starting point was GBP 58M; settlement-and-no-appeal plus group-double- punishment adjustments reduced the final to GBP 14M. Cite as a recent precedent that the ICO will fine a processor directly under Article 32, not only the controller.", "relevance": "context", "fineEur": 16100000, "fineNative": { "currency": "GBP", "amount": 14000000 }, "fineApproximate": true, "primarySourceUrl": "https://ico.org.uk/media2/pv5nhks4/capita-plc-and-cpsl-monetary-penalty-notice.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "ICO (United Kingdom). (2025, October 15). capita-2025-10 - Capita plc and Capita Pension Services Limited. Primary source: https://ico.org.uk/media2/pv5nhks4/capita-plc-and-cpsl-monetary-penalty-notice.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/ico-capita-2025-10" }, { "slug": "cnil-san-2025-004", "url": "https://www.consentmark.com/precedent/cnil-san-2025-004", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2025-004", "date": "2025-09-01", "respondent": "GOOGLE LLC and GOOGLE IRELAND LIMITED", "respondentAnonymised": false, "finding": "During Google-account creation, advertising cookies were deposited on users' terminals without freely-given consent because the implications of the proposed \"cookie wall\" were not explained sufficiently for an informed choice; and inserting advertisements between messages in the Gmail inbox amounts to electronic prospecting under Article L. 34-5 CPCE, requiring prior consent that Google did not obtain.", "notes": "Fine split: EUR 200M against Google LLC + EUR 125M against Google Ireland Limited. Six-month compliance deadline with EUR 100k/day astreinte for non-compliance. Cite when the scanner narrative covers a \"you must accept tracking to create the account\" pattern or when advertising units in a transactional surface trigger Article L. 34-5 prospecting obligations.", "relevance": "gate", "fineEur": 325000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052182222", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2025, September 1). SAN-2025-004 - GOOGLE LLC and GOOGLE IRELAND LIMITED. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052182222. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2025-004" }, { "slug": "cnil-san-2025-005", "url": "https://www.consentmark.com/precedent/cnil-san-2025-005", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2025-005", "date": "2025-09-01", "respondent": "INFINITE STYLES SERVICES CO. LIMITED", "respondentAnonymised": false, "finding": "Advertising and measurement cookies were deposited on users' terminals as soon as they arrived on shein.com, before any consent action was taken; this breached the prior-consent requirement of Article 82 of the French Data Protection Act (the national transposition of Article 5(3) ePrivacy), as the user had no opportunity to express or refuse consent before the read/write operation.", "notes": "Cite for the finding that tags firing before consent on a retail site attracted a EUR 150M penalty under Article 82.", "relevance": "gate", "fineEur": 150000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052182271", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2025, September 1). SAN-2025-005 - INFINITE STYLES SERVICES CO. LIMITED. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052182271. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2025-005" }, { "slug": "ico-23andme-2025-06", "url": "https://www.consentmark.com/precedent/ico-23andme-2025-06", "regulator": "ico", "regulatorLabel": "ICO (United Kingdom)", "caseRef": "23andme-2025-06", "date": "2025-06-05", "respondent": "23andMe, Inc.", "respondentAnonymised": false, "finding": "Credential-stuffing attackers reused passwords from unrelated breaches to log into 23andMe accounts and, via the DNA-Relatives feature, exfiltrated the genetic and personal data of around 155,592 UK users; 23andMe had not mandated multi-factor authentication, took four days to shut compromised accounts and force resets, and notified the ICO ten days late, breaching Articles 5(1)(f), 32(1) and 33(1) UK GDPR.", "notes": "Joint enforcement with the Office of the Privacy Commissioner of Canada. Cite when a scanner finds a high-sensitivity service (genetics, health, financial) without mandatory MFA and without compromised-credential checking - the ICO frames optional MFA on a high-risk service as a 32(1) breach.", "relevance": "context", "fineEur": 2700000, "fineNative": { "currency": "GBP", "amount": 2310000 }, "fineApproximate": true, "primarySourceUrl": "https://ico.org.uk/media2/kclbljpo/23andme-penalty-notice.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "ICO (United Kingdom). (2025, June 5). 23andme-2025-06 - 23andMe, Inc.. Primary source: https://ico.org.uk/media2/kclbljpo/23andme-penalty-notice.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/ico-23andme-2025-06" }, { "slug": "cnil-san-2025-001", "url": "https://www.consentmark.com/precedent/cnil-san-2025-001", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2025-001", "date": "2025-05-15", "respondent": "SOLOCAL MARKETING SERVICES", "respondentAnonymised": false, "finding": "Solocal Marketing Services carried out electronic prospecting campaigns directed at several million recipients without a freely- given, specific, informed and unambiguous consent for those communications, breaching Article L. 34-5 CPCE and Articles 6(1)(a) and 7 GDPR; the company also transferred the contacts to commercial partners without a documented legal basis for the onward processing.", "notes": "Data-broker precedent. Cite when the scanner narrative needs the principle that a data broker cannot rely on the consent collected by an upstream form without evidence the form satisfied the freely-given and specific limbs. Pairs with SAN-2023-009 (Criteo) for the upstream-consent-cannot-be-assumed point.", "relevance": "context", "fineEur": 900000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000051630617", "archiveUrl": "https://web.archive.org/web/20250520233425/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000051630617", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2025, May 15). SAN-2025-001 - SOLOCAL MARKETING SERVICES. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000051630617. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2025-001" }, { "slug": "dpc-in-21-9-2", "url": "https://www.consentmark.com/precedent/dpc-in-21-9-2", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-21-9-2", "date": "2025-04-30", "respondent": "TikTok Technology Limited", "respondentAnonymised": false, "finding": "TikTok transferred EEA user data to the People's Republic of China without verifying that the protections offered by Chinese law were essentially equivalent to those under EU law, breaching Article 46(1) GDPR; and failed to inform users about the transfers and the remote access by personnel in China, breaching the transparency obligation in Article 13(1)(f) GDPR.", "notes": "Distinct from IN-21-9-1 (the September 2023 children's design-patterns case). Composite fine is EUR 485M (Art 46(1)) plus EUR 45M (Art 13(1)(f)). Cite when the scanner narrative needs the precedent for transparency about international transfers and remote access by third-country personnel.", "relevance": "context", "fineEur": 530000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2025-10/Inquiry%20into%20TikTok%20Technology%20Limited%20April%202025.pdf", "archiveUrl": "https://web.archive.org/web/20260506173624/https://www.dataprotection.ie/sites/default/files/uploads/2025-10/Inquiry%20into%20TikTok%20Technology%20Limited%20April%202025.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "DPC (Ireland). (2025, April 30). IN-21-9-2 - TikTok Technology Limited. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2025-10/Inquiry%20into%20TikTok%20Technology%20Limited%20April%202025.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-21-9-2" }, { "slug": "ico-advanced-2025-03", "url": "https://www.consentmark.com/precedent/ico-advanced-2025-03", "regulator": "ico", "regulatorLabel": "ICO (United Kingdom)", "caseRef": "advanced-2025-03", "date": "2025-03-27", "respondent": "Advanced Computer Software Group Limited", "respondentAnonymised": false, "finding": "In August 2022 ransomware actors gained access to Advanced's systems through a customer-portal account that did not require multi-factor authentication, and exfiltrated personal information including sensitive health and care data of 79,404 UK individuals, causing widespread disruption to NHS services; Advanced failed to implement appropriate technical and organisational measures to ensure security of processing under Article 32(1) UK GDPR.", "notes": "The original notice of intent in August 2024 was GBP 6.09M; reduced to GBP 3.07M via voluntary settlement. First ICO penalty issued to a processor-only entity under UK GDPR. Cite when a scanner finds a vendor or sub-processor without MFA on an admin or service account - the precedent is that this is itself a 32(1) breach independent of any subsequent compromise.", "relevance": "context", "fineEur": 3700000, "fineNative": { "currency": "GBP", "amount": 3076320 }, "fineApproximate": true, "primarySourceUrl": "https://ico.org.uk/media2/gdlfddgc/advanced-penalty-notice-20250327.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "ICO (United Kingdom). (2025, March 27). advanced-2025-03 - Advanced Computer Software Group Limited. Primary source: https://ico.org.uk/media2/gdlfddgc/advanced-penalty-notice-20250327.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/ico-advanced-2025-03" }, { "slug": "edpb-gl-01-2025", "url": "https://www.consentmark.com/precedent/edpb-gl-01-2025", "regulator": "edpb", "regulatorLabel": "EDPB (European Data Protection Board)", "caseRef": "GL-01-2025", "date": "2025-01-16", "respondent": "European Data Protection Board", "respondentAnonymised": false, "finding": "Pseudonymised data which could be attributed to an individual by the use of additional information remains information relating to an identifiable natural person and is therefore personal data within the meaning of Article 4(1) GDPR. Pseudonymisation can support Article 5, Article 25 and Article 32 compliance but does not, by itself, take the data outside the GDPR's material scope.", "notes": "[Type: guidance] Non-enforcement guideline (public consultation draft). Cite when the scanner narrative covers a controller arguing that a hashed-email join key or pseudonymous device-ID is not personal data - the EDPB's position is unambiguously that pseudonymous data is personal data so long as re-identification is reasonably feasible. Companion to DPC Apple IN-20-39-1.", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "EDPB (European Data Protection Board). (2025, January 16). GL-01-2025 - European Data Protection Board. Primary source: https://www.edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/edpb-gl-01-2025" }, { "slug": "dpc-in-18-10-1", "url": "https://www.consentmark.com/precedent/dpc-in-18-10-1", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-18-10-1", "date": "2024-12-12", "respondent": "Meta Platforms Ireland Limited", "respondentAnonymised": false, "finding": "After the September 2018 incident in which user access tokens granted attackers entry to circa 29 million Facebook accounts, Meta omitted required information from its breach notification (Article 33(3)), failed to document the breach adequately (Article 33(5)), and failed to ensure data protection by design and by default (Articles 25(1) and 25(2)) - the tokens granted broader access than necessary, contrary to the minimisation-by-default obligation.", "notes": "Companion decision IN-18-11-1 was issued the same day; the combined EUR 251M fine spans both inquiries. Cite when the scanner narrative needs to argue that an over-scoped credential or token is itself an Article 25 by-design breach, independent of whether attackers later exploited it.", "relevance": "context", "fineEur": 251000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/241212_IN-18-10-1_Redacted.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "DPC (Ireland). (2024, December 12). IN-18-10-1 - Meta Platforms Ireland Limited. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/241212_IN-18-10-1_Redacted.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-18-10-1" }, { "slug": "cnil-san-2024-019", "url": "https://www.consentmark.com/precedent/cnil-san-2024-019", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2024-019", "date": "2024-11-14", "respondent": "ORANGE SA", "respondentAnonymised": false, "finding": "Orange displayed commercial advertisements between users' email messages in its webmail interface, a form of electronic prospecting requiring prior consent under Article L. 34-5 CPCE that Orange did not obtain; and continued to read information stored on users' terminals through cookies after the user had withdrawn consent, in breach of Article 82 of the French Data Protection Act.", "notes": "Anchors two distinct principles in one decision: ad units in a webmail inbox are prospecting under Article L. 34-5; and a consent-withdrawal signal must stop downstream reads as well as future writes. The consent-withdrawal limb is the more novel of the two, because it reaches the post-CMP-update flow.", "relevance": "gate", "fineEur": 50000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000050760620", "archiveUrl": "https://web.archive.org/web/20250115153852/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000050760620", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2024, November 14). SAN-2024-019 - ORANGE SA. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000050760620. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2024-019" }, { "slug": "dpc-in-18-08-3", "url": "https://www.consentmark.com/precedent/dpc-in-18-08-3", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-18-08-3", "date": "2024-10-22", "respondent": "LinkedIn Ireland Unlimited Company", "respondentAnonymised": false, "finding": "LinkedIn unlawfully processed the personal data of its MEMBERS - including data obtained via its third-party partners relating to those members (\"third-party data\") - for behavioural analysis and targeted advertising; consent was not valid, legitimate interests did not apply, and contractual necessity was not satisfied - infringing Articles 6(1), 5(1)(a) and the transparency duties in Articles 13 and 14 GDPR.", "notes": "DPC press release (24 Oct 2024) is the public summary; the redacted decision PDF is the citable source. CORRECTED 2026-08-17 (company_tools-op0v3.2): this previously read \"third-party (non-member) and member personal data\". Non-members were never in scope - the inquiry examined \"users who have created LinkedIn profiles (members)\", and \"third-party data\" means data \"obtained via its third-party partners relating to its members\". If you widen this text again, quote the decision.", "relevance": "context", "fineEur": 310000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://dataprotection.ie/sites/default/files/uploads/2024-12/LinkedIn-Final-Decision-IN-18-08-3-Redacted.pdf", "archiveUrl": "https://web.archive.org/web/20250312220407/https://dataprotection.ie/sites/default/files/uploads/2024-12/LinkedIn-Final-Decision-IN-18-08-3-Redacted.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-08-17", "reviewDue": "2026-11-17", "citeAs": "DPC (Ireland). (2024, October 22). IN-18-08-3 - LinkedIn Ireland Unlimited Company. Primary source: https://dataprotection.ie/sites/default/files/uploads/2024-12/LinkedIn-Final-Decision-IN-18-08-3-Redacted.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-18-08-3" }, { "slug": "ico-psni-2024-10", "url": "https://www.consentmark.com/precedent/ico-psni-2024-10", "regulator": "ico", "regulatorLabel": "ICO (United Kingdom)", "caseRef": "psni-2024-10", "date": "2024-10-04", "respondent": "Chief Constable of the Police Service of Northern Ireland", "respondentAnonymised": false, "finding": "A spreadsheet released as part of a freedom-of-information response contained a hidden tab disclosing the surnames, initials, ranks and roles of all 9,483 PSNI officers and staff to the public internet; the controller had not implemented appropriate technical and organisational measures to identify the hidden data before release, breaching Articles 5(1)(f), 32(1) and 32(2) UK GDPR.", "notes": "The ICO public-sector approach reduced the indicative fine from GBP 5.6M to GBP 750k. Cite when the scanner narrative covers an inadvertent-disclosure-via-publication pattern - the hidden-tab issue is the data-protection equivalent of a spreadsheet-row-level-access misconfiguration.", "relevance": "context", "fineEur": 870000, "fineNative": { "currency": "GBP", "amount": 750000 }, "fineApproximate": true, "primarySourceUrl": "https://ico.org.uk/media2/migrated/4031177/psni-penalty-notice.pdf", "archiveUrl": "https://web.archive.org/web/20260105045413/https://ico.org.uk/media2/migrated/4031177/psni-penalty-notice.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "ICO (United Kingdom). (2024, October 4). psni-2024-10 - Chief Constable of the Police Service of Northern Ireland. Primary source: https://ico.org.uk/media2/migrated/4031177/psni-penalty-notice.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/ico-psni-2024-10" }, { "slug": "dpc-in-19-4-1", "url": "https://www.consentmark.com/precedent/dpc-in-19-4-1", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-19-4-1", "date": "2024-09-26", "respondent": "Meta Platforms Ireland Limited", "respondentAnonymised": false, "finding": "Meta inadvertently stored the passwords of \"hundreds of millions\" of Facebook users in plaintext on internal systems, breaching Articles 5(1)(f) and 32(1) GDPR for failing to ensure appropriate security of processing; and failed to notify the personal data breach within 72 hours and to document it adequately, breaching Articles 33(1) and 33(5) GDPR.", "notes": "Composite fine: EUR 8M (Art 33(1)) + EUR 8M (Art 33(5)) + EUR 75M (Art 5(1)(f) and 32(1)). The decision turns on the security of processing principle rather than on any external access to the passwords - relevant when arguing that an internal-only data flow still triggers Article 32 obligations.", "relevance": "context", "fineEur": 91000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2024-12/Meta-Final-Decision-IN-19-4-1-Redacted.pdf", "archiveUrl": "https://web.archive.org/web/20250519055655/https://www.dataprotection.ie/sites/default/files/uploads/2024-12/Meta-Final-Decision-IN-19-4-1-Redacted.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "DPC (Ireland). (2024, September 26). IN-19-4-1 - Meta Platforms Ireland Limited. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2024-12/Meta-Final-Decision-IN-19-4-1-Redacted.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-19-4-1" }, { "slug": "ico-bonne-terre-limited-2024-09", "url": "https://www.consentmark.com/precedent/ico-bonne-terre-limited-2024-09", "regulator": "ico", "regulatorLabel": "ICO (United Kingdom)", "caseRef": "bonne-terre-limited-2024-09", "date": "2024-09-02", "respondent": "Bonne Terre Limited (trading as Sky Betting and Gaming)", "respondentAnonymised": false, "finding": "Between 10 January and 3 March 2023, Sky Betting and Gaming shared users' personal data with advertising technology companies via cookies set the moment a user reached the SkyBet website, before any option to accept or reject advertising cookies was presented - breaching Articles 5(1)(a), 6(1)(a) and 7(1) UK GDPR.", "notes": "Reprimand only - no monetary penalty, so fine_eur is zero by design and this case is cited for the precedent that pre-consent ad-cookie firing is unlawful, not for a fine size. ICO reprimands carry no formal case reference; the case_ref is the ico.org.uk URL slug. Reprimand letter: ico.org.uk/media2/i15p1czl/bonne-terre-limited-reprimand.pdf.", "relevance": "gate", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://ico.org.uk/action-weve-taken/enforcement/2024/09/bonne-terre-limited/", "archiveUrl": "https://web.archive.org/web/20260225040127/https://ico.org.uk/action-weve-taken/enforcement/2024/09/bonne-terre-limited/", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-08-27", "reviewDue": "2027-02-27", "citeAs": "ICO (United Kingdom). (2024, September 2). bonne-terre-limited-2024-09 - Bonne Terre Limited (trading as Sky Betting and Gaming). Primary source: https://ico.org.uk/action-weve-taken/enforcement/2024/09/bonne-terre-limited/. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/ico-bonne-terre-limited-2024-09" }, { "slug": "edpb-op-08-2024", "url": "https://www.consentmark.com/precedent/edpb-op-08-2024", "regulator": "edpb", "regulatorLabel": "EDPB (European Data Protection Board)", "caseRef": "OP-08-2024", "date": "2024-04-17", "respondent": "European Data Protection Board", "respondentAnonymised": false, "finding": "\"In most cases, it will not be possible for large online platforms to comply with the requirements for valid consent if they confront users only with a binary choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee.\" Large online platforms should give significant consideration to an additional free alternative without behavioural advertising.", "notes": "[Type: guidance] Non-enforcement opinion under Article 64(2) GDPR. Cite when the scanner narrative needs the principle that a paid- alternative-only model is not, by itself, sufficient to make behavioural-advertising consent freely given. Companion to Guidelines 05/2020 already in this registry.", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "EDPB (European Data Protection Board). (2024, April 17). OP-08-2024 - European Data Protection Board. Primary source: https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/edpb-op-08-2024" }, { "slug": "dpc-in-20-37-1", "url": "https://www.consentmark.com/precedent/dpc-in-20-37-1", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-20-37-1", "date": "2024-03-08", "respondent": "Groupon Ireland Operations Limited", "respondentAnonymised": false, "finding": "Groupon demanded photographic government-issued identification to verify the identity of a complainant who had requested access and erasure, despite less intrusive alternatives being available, breaching the data-minimisation principle in Article 5(1)(c) GDPR; Groupon also continued to process the complainant's personal data after the erasure request without a valid Article 6(1) basis, breaching Article 17(1) GDPR.", "notes": "Reprimand under Article 58(2)(b) GDPR; no administrative fine. Cite alongside the Twitter IN-19-6-1 reprimand for the principle that identity verification must be proportionate - a controller cannot collect more personal data than necessary as a precondition to honouring an Article 15 or Article 17 request.", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2024-06/Final-Decision-Groupon-International-Limited-March-2024-EN.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "DPC (Ireland). (2024, March 8). IN-20-37-1 - Groupon Ireland Operations Limited. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2024-06/Final-Decision-Groupon-International-Limited-March-2024-EN.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-20-37-1" }, { "slug": "cjeu-c-604-22", "url": "https://www.consentmark.com/precedent/cjeu-c-604-22", "regulator": "cjeu", "regulatorLabel": "CJEU (Court of Justice of the European Union)", "caseRef": "C-604/22", "date": "2024-03-07", "respondent": "IAB Europe", "respondentAnonymised": false, "finding": "A string composed of a combination of letters and characters, such as the TC String, constitutes personal data where those data may by reasonable means be associated with an identifier such as the IP address of the user's device. A sectoral organisation is a joint controller where it exerts influence over the processing for its own purposes and thereby determines, jointly with its members, the purposes and means of that processing.", "notes": "[Type: guidance] Court of Justice, not a DPA. Case file also at curia.europa.eu/juris/liste.jsf?num=C-604/22; EUR-Lex is cited as the primary source because curia serves the judgment only to a browser. A preliminary ruling is final - there is no appeal from the Court. The Court added that joint controllership does not extend automatically to the subsequent processing carried out by website or application providers.", "relevance": "gate", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62022CJ0604", "archiveUrl": "https://web.archive.org/web/20260624153912/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A62022CJ0604", "appealStatus": { "status": "final", "sourceUrl": null, "note": null, "meaning": "A preliminary ruling of the Court of Justice is final. No appeal lies from it." }, "verifiedAt": "2026-08-27", "reviewDue": "2027-02-27", "citeAs": "CJEU (Court of Justice of the European Union). (2024, March 7). C-604/22 - IAB Europe. Primary source: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62022CJ0604. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cjeu-c-604-22" }, { "slug": "dpc-in-20-39-1", "url": "https://www.consentmark.com/precedent/dpc-in-20-39-1", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-20-39-1", "date": "2024-03-07", "respondent": "Apple Distribution International Limited", "respondentAnonymised": false, "finding": "Apple retained a hashed version of a complainant's email address after processing an Article 17 erasure request and did not inform the data subject of the retention, the legal basis or the recipients of the data, breaching the transparency obligations in Article 13(1)(c) and 13(1)(d) GDPR; the retention itself was lawful under Article 6(1)(f) but the non-disclosure was not.", "notes": "Reprimand under Article 58(2)(b) GDPR; no administrative fine. Cite when a service hashes an email or identifier post-erasure for suppression-list purposes and does not surface the retention in its privacy notice - the hashing does not exempt the controller from Article 13 transparency.", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2024-08/Inquiry-into-Apple-Distribution-International-Limited-Final-Decision-March-2024-EN.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "DPC (Ireland). (2024, March 7). IN-20-39-1 - Apple Distribution International Limited. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2024-08/Inquiry-into-Apple-Distribution-International-Limited-Final-Decision-March-2024-EN.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-20-39-1" }, { "slug": "cnil-san-2024-002", "url": "https://www.consentmark.com/precedent/cnil-san-2024-002", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2024-002", "date": "2024-01-31", "respondent": "DE PARTICULIER A PARTICULIER (PAP)", "respondentAnonymised": false, "finding": "PAP retained user account data and inactive-user data beyond the period necessary for the purposes for which they were processed, breaching Article 5(1)(e) GDPR; failed to provide complete information to data subjects in breach of Article 13; did not frame its relationship with a processor with the contractual safeguards required by Article 28; and stored credentials without an appropriately strong hashing function and in plain text in some logs, breaching Article 32.", "notes": "Real-estate-classifieds publisher (pap.fr). Cite when the scanner narrative needs the precedent that inactive-user retention beyond a documented period is itself an Article 5(1)(e) breach, and that weak credential storage triggers Article 32 even when no external compromise occurred.", "relevance": "context", "fineEur": 100000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049128617", "archiveUrl": "https://web.archive.org/web/20250331054141/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049128617", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2024, January 31). SAN-2024-002 - DE PARTICULIER A PARTICULIER (PAP). Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049128617. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2024-002" }, { "slug": "dpc-in-20-38-1", "url": "https://www.consentmark.com/precedent/dpc-in-20-38-1", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-20-38-1", "date": "2024-01-31", "respondent": "Airbnb Ireland UC", "respondentAnonymised": false, "finding": "Airbnb required a copy of a government-issued identity document both to complete account registration and to process the user's erasure request, despite the complainant having provided minimal personal data before requesting deletion; the collection breached Article 5(1)(c) GDPR (data minimisation) and lacked a valid Article 6(1) basis, in particular as a precondition to action an Article 17 request.", "notes": "Reprimand under Article 58(2)(b) GDPR; no administrative fine. Cite alongside the Twitter IN-19-6-1 and Groupon IN-20-37-1 reprimands for the pattern that universal ID-document collection at signup or rights- request time is not proportionate without a documented risk basis.", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2024-04/Inquiry-into-Airbnb-Ireland-UC-31-January-2024-EN_0.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "DPC (Ireland). (2024, January 31). IN-20-38-1 - Airbnb Ireland UC. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2024-04/Inquiry-into-Airbnb-Ireland-UC-31-January-2024-EN_0.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-20-38-1" }, { "slug": "cnil-san-2023-024", "url": "https://www.consentmark.com/precedent/cnil-san-2023-024", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2023-024", "date": "2023-12-29", "respondent": "YAHOO EMEA LIMITED", "respondentAnonymised": false, "finding": "Around twenty advertising cookies were deposited on the user's terminal on yahoo.com despite no expressed consent, and Yahoo! Mail users who withdrew consent were told they would lose access to the service - both breaches of Article 82 of the French Data Protection Act.", "notes": "Cite the Legifrance deliberation rather than the cnil.fr press summary - the EN press release at cnil.fr/en/cookies-cnil-fined-yahoo-eu10-million 301-redirects to a generic landing page (verified dead 2026-05-22), whereas Legifrance is the French government's official legal gazette and carries the full deliberation text under CNILTEXT000048967251. CNIL is the lead authority on cookie enforcement under ePrivacy; quote this case whenever a scan finds advertising tags firing before consent.", "relevance": "gate", "fineEur": 10000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048967251", "archiveUrl": "https://web.archive.org/web/20241208085753/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048967251", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-08-27", "reviewDue": "2027-02-27", "citeAs": "CNIL (France). (2023, December 29). SAN-2023-024 - YAHOO EMEA LIMITED. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048967251. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2023-024" }, { "slug": "aepd-ps-00002-2023", "url": "https://www.consentmark.com/precedent/aepd-ps-00002-2023", "regulator": "aepd", "regulatorLabel": "AEPD (Spain)", "caseRef": "PS-00002-2023", "date": "2023-10-25", "respondent": "ENDESA ENERGIA, S.A.", "respondentAnonymised": false, "finding": "Endesa failed to implement appropriate security measures to protect customer data, allowing access credentials to its commercial platform to be offered for sale on third-party advertising channels and exposing the personal data of up to 4.8 million electricity and 1.2 million gas customers; the AEPD found composite breaches of Articles 5(1)(f), 32, 33, 34 and 44 GDPR (security, breach notification, notification to data subjects and international transfers).", "notes": "Composite fine: EUR 2.5M (Art 5(1)(f)) + EUR 1.5M (Art 32) + EUR 800k (Art 33) + EUR 800k (Art 34) + EUR 500k (Art 44). Cite as the AEPD's flagship security-of-processing precedent - the underlying incident was credential resale, not external system compromise, so the finding turns on the absence of detection and revocation rather than the attack vector.", "relevance": "context", "fineEur": 6100000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.aepd.es/documento/ps-00002-2023.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "AEPD (Spain). (2023, October 25). PS-00002-2023 - ENDESA ENERGIA, S.A.. Primary source: https://www.aepd.es/documento/ps-00002-2023.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/aepd-ps-00002-2023" }, { "slug": "dpc-in-21-9-1", "url": "https://www.consentmark.com/precedent/dpc-in-21-9-1", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-21-9-1", "date": "2023-09-01", "respondent": "TikTok Technology Limited", "respondentAnonymised": false, "finding": "TikTok's public-by-default account settings and the Family Pairing feature failed to provide age-appropriate protection for users aged 13-17, breaching Articles 5(1)(a), 5(1)(c), 5(1)(f), 12(1), 13(1)(e), 24(1), 25(1) and 25(2) GDPR; consent flows for child users were not presented in an objective, neutral way.", "notes": "Decision followed EDPB Binding Decision 2/2023 (Art. 65) on dispute resolution. The DPC's decisions index lists the case reference as IN-21-9-1 (not IN-21-9-7 as earlier note material had it). Cite alongside BD-02-2023 when the substantive issue is design patterns nudging child consent, not the cookie banner mechanics.", "relevance": "context", "fineEur": 345000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2023-09/Inquiry%20into%20TikTok%20Technology%20Limited%20-%20September%202023%20EN.pdf", "archiveUrl": "https://web.archive.org/web/20231017224852/https://www.dataprotection.ie/sites/default/files/uploads/2023-09/Inquiry%20into%20TikTok%20Technology%20Limited%20-%20September%202023%20EN.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-26", "reviewDue": "2026-11-26", "citeAs": "DPC (Ireland). (2023, September 1). IN-21-9-1 - TikTok Technology Limited. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2023-09/Inquiry%20into%20TikTok%20Technology%20Limited%20-%20September%202023%20EN.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-21-9-1" }, { "slug": "edpb-bd-02-2023", "url": "https://www.consentmark.com/precedent/edpb-bd-02-2023", "regulator": "edpb", "regulatorLabel": "EDPB (European Data Protection Board)", "caseRef": "BD-02-2023", "date": "2023-08-02", "respondent": "TikTok Technology Limited", "respondentAnonymised": false, "finding": "Two TikTok pop-up notifications shown to users aged 13-17 failed to present privacy options in an objective, neutral way and so breached the fairness principle in Article 5(1)(a) GDPR; the EDPB directed the Irish DPC to include findings on these dark-pattern design practices in its final decision.", "notes": "Binding decisions do not themselves impose fines; the accompanying DPC final decision (1 September 2023) imposed the EUR 345 million penalty. fine_eur is zero on this entry by convention - the citable significance is the EDPB framing of dark-pattern unfairness, not the monetary outcome.", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.edpb.europa.eu/documents/edpb-binding-decisions/binding-decision-22023-on-the-dispute-submitted-by-the-irish-sa_en", "archiveUrl": "https://web.archive.org/web/20251210212756/https://www.edpb.europa.eu/our-work-tools/our-documents/binding-decision-board-art-65/binding-decision-22023-dispute-submitted_en", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-08-27", "reviewDue": "2027-02-27", "citeAs": "EDPB (European Data Protection Board). (2023, August 2). BD-02-2023 - TikTok Technology Limited. Primary source: https://www.edpb.europa.eu/documents/edpb-binding-decisions/binding-decision-22023-on-the-dispute-submitted-by-the-irish-sa_en. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/edpb-bd-02-2023" }, { "slug": "cnil-san-2023-009", "url": "https://www.consentmark.com/precedent/cnil-san-2023-009", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2023-009", "date": "2023-06-15", "respondent": "CRITEO SA", "respondentAnonymised": false, "finding": "Criteo processed user navigation data for behavioural-advertising retargeting without verifying that the consent collected by its partner publishers met the freely-given, specific, informed and unambiguous standard, breaching Article 6(1)(a) and 7 GDPR; provided insufficient information to data subjects under Articles 12 and 13; and failed to give effect to access and erasure requests under Articles 15 and 17 across the data-broker network.", "notes": "The flagship adtech-retargeting precedent under GDPR. Cite when a scanner finds third-party retargeting or behavioural-advertising tags firing without an evidenced upstream consent signal - the principle here is that the downstream processor cannot rely on the publisher's consent banner without verifying it carries through.", "relevance": "context", "fineEur": 40000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063", "archiveUrl": "https://web.archive.org/web/20241128150640/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2023, June 15). SAN-2023-009 - CRITEO SA. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2023-009" }, { "slug": "dpc-in-20-8-1", "url": "https://www.consentmark.com/precedent/dpc-in-20-8-1", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-20-8-1", "date": "2023-05-12", "respondent": "Meta Platforms Ireland Limited", "respondentAnonymised": false, "finding": "Meta Ireland's transfers of Facebook user personal data from the EU/EEA to the United States, made on the basis of updated Standard Contractual Clauses, did not address the risks identified by the Court of Justice in Schrems II and so breached Article 46(1) GDPR; the DPC ordered suspension of future transfers and a six-month deadline to cease unlawful processing and storage in the US.", "notes": "Decision followed EDPB Binding Decision 1/2023 (Art. 65) on dispute resolution. Cite when the scan shows US-hosted analytics or ad-tech processing EU personal data without a working Article 46 transfer mechanism - the underlying problem is the SCC inadequacy, not the cookie banner.", "relevance": "context", "fineEur": 1200000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2023-06/12.05.2023%20Decision%20IN-20-8-1%20Meta%20Platform%20Ireland%20Limited%20%28Facebook%29%20data%20transfers.pdf", "archiveUrl": "https://web.archive.org/web/20250918030541/https://www.dataprotection.ie/sites/default/files/uploads/2023-06/12.05.2023%20Decision%20IN-20-8-1%20Meta%20Platform%20Ireland%20Limited%20%28Facebook%29%20data%20transfers.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-26", "reviewDue": "2026-11-26", "citeAs": "DPC (Ireland). (2023, May 12). IN-20-8-1 - Meta Platforms Ireland Limited. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2023-06/12.05.2023%20Decision%20IN-20-8-1%20Meta%20Platform%20Ireland%20Limited%20%28Facebook%29%20data%20transfers.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-20-8-1" }, { "slug": "ico-tiktok-2023-04", "url": "https://www.consentmark.com/precedent/ico-tiktok-2023-04", "regulator": "ico", "regulatorLabel": "ICO (United Kingdom)", "caseRef": "tiktok-2023-04", "date": "2023-04-04", "respondent": "TikTok Information Technologies UK Limited and TikTok Inc.", "respondentAnonymised": false, "finding": "Between May 2018 and July 2020, TikTok processed the personal data of up to 1.4 million UK children under 13 who used the platform without parental consent; failed to provide adequate information to users about how their data would be collected, used and shared; and failed to ensure the personal data of UK users was processed lawfully, fairly and in a transparent manner - breaching Articles 5(1)(a), 8, 12 and 13 UK GDPR.", "notes": "Native fine GBP 12.7M; the EUR figure is our own conversion at the enforcement-date FX rate, has no regulator source, and is approximate. Penalty notice PDF: ico.org.uk/media2/migrated/4025182/tiktok-mpn.pdf. Cite for the children's- data precedent under UK GDPR, parallel to the DPC's TikTok IN-21-9-1 EU-level enforcement.", "relevance": "context", "fineEur": 14500000, "fineNative": { "currency": "GBP", "amount": 12700000 }, "fineApproximate": true, "primarySourceUrl": "https://ico.org.uk/action-weve-taken/enforcement/2023/05/tiktok/", "archiveUrl": "https://web.archive.org/web/20260806010552/https://ico.org.uk/action-weve-taken/enforcement/2023/05/tiktok/", "appealStatus": { "status": "appealed", "sourceUrl": "https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/08/ico-statement-on-upper-tribunal-decision/", "note": "Upper Tribunal dismissed TikTok's appeal on 28 July 2026 ([2026] UKUT 277 (AAC)) and remitted the substantive issues to the First-tier Tribunal. The GBP 12.7M penalty stands but is not final.", "meaning": "An appeal is pending, or its outcome is not on the public record. Not final." }, "verifiedAt": "2026-08-27", "reviewDue": "2027-02-27", "citeAs": "ICO (United Kingdom). (2023, April 4). tiktok-2023-04 - TikTok Information Technologies UK Limited and TikTok Inc.. Primary source: https://ico.org.uk/action-weve-taken/enforcement/2023/05/tiktok/. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/ico-tiktok-2023-04" }, { "slug": "edpb-gl-09-2022", "url": "https://www.consentmark.com/precedent/edpb-gl-09-2022", "regulator": "edpb", "regulatorLabel": "EDPB (European Data Protection Board)", "caseRef": "GL-09-2022", "date": "2023-03-28", "respondent": "European Data Protection Board", "respondentAnonymised": false, "finding": "Under Article 33(1) GDPR the controller must notify the supervisory authority \"without undue delay and, where feasible, not later than 72 hours after having become aware of it\". A controller is \"considered to have become aware\" once it has a \"reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised\", not at the moment of the underlying compromise.", "notes": "[Type: guidance] Non-enforcement guideline. Cite when the scanner narrative covers a delayed-notification finding - the EDPB's \"reasonable degree of certainty\" test is what supervisory authorities apply when computing whether the 72-hour clock was breached (compare DPC IN-19-4-1 Meta and ICO 23andMe-2025-06).", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202209_personal_data_breach_notification_v2.0_en.pdf", "archiveUrl": "https://web.archive.org/web/20260506171220/https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202209_personal_data_breach_notification_v2.0_en.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "EDPB (European Data Protection Board). (2023, March 28). GL-09-2022 - European Data Protection Board. Primary source: https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202209_personal_data_breach_notification_v2.0_en.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/edpb-gl-09-2022" }, { "slug": "dpc-in-20-7-2", "url": "https://www.consentmark.com/precedent/dpc-in-20-7-2", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-20-7-2", "date": "2023-02-27", "respondent": "Bank of Ireland Group plc", "respondentAnonymised": false, "finding": "A series of ten personal data breaches in the Bank of Ireland 365 mobile banking application resulted in unauthorised users gaining access to other customers' accounts; Bank of Ireland failed to implement appropriate technical and organisational measures to ensure the integrity and confidentiality of personal data, breaching Article 5(1)(f) GDPR and the security-of-processing obligation in Article 32(1) GDPR.", "notes": "EUR 750k administrative fine plus reprimand and compliance order. Cite when the scanner narrative covers an authenticated-app authorisation bug that surfaces another customer's data in-session - the DPC frames this as Article 32(1) security, not Article 25 design.", "relevance": "context", "fineEur": 750000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2023-03/Final%20Decision%20IN-20-7-2%20Bank%20of%20Ireland%20%28BOI%29%20365.pdf", "archiveUrl": "https://web.archive.org/web/20260428141316/https://www.dataprotection.ie/sites/default/files/uploads/2023-03/Final%20Decision%20IN-20-7-2%20Bank%20of%20Ireland%20%28BOI%29%20365.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "DPC (Ireland). (2023, February 27). IN-20-7-2 - Bank of Ireland Group plc. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2023-03/Final%20Decision%20IN-20-7-2%20Bank%20of%20Ireland%20%28BOI%29%20365.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-20-7-2" }, { "slug": "edpb-gl-03-2022", "url": "https://www.consentmark.com/precedent/edpb-gl-03-2022", "regulator": "edpb", "regulatorLabel": "EDPB (European Data Protection Board)", "caseRef": "GL-03-2022", "date": "2023-02-14", "respondent": "European Data Protection Board", "respondentAnonymised": false, "finding": "Interface design choices that \"influence users in a way that infringes on the fairness, transparency or data-protection-by-design principles of the GDPR\" constitute deceptive design patterns; the Guidelines identify six categories - overloading, skipping, stirring, obstructing, fickle, and left in the dark - and state that these patterns, where they steer users towards a specific decision contrary to their data protection interests, breach Articles 5(1)(a), 12, 13, 24 and 25 GDPR.", "notes": "[Type: guidance] Non-enforcement guideline. Cite when the scanner observes a deliberately-asymmetric consent UI - the EDPB has assigned these specific category names (\"obstructing\" for reject-behind-settings, \"stirring\" for emotional-colour nudging, \"skipping\" for default opt-in) so the narrative can name the pattern rather than paraphrase it. The EDPB Cookie Banner Taskforce Report 02/2023 cross-references this taxonomy when grading specific complaints.", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032022-deceptive-design-patterns-social-media_en", "archiveUrl": "https://web.archive.org/web/20240519080404/https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032022-deceptive-design-patterns-social-media_en", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-26", "reviewDue": "2026-11-26", "citeAs": "EDPB (European Data Protection Board). (2023, February 14). GL-03-2022 - European Data Protection Board. Primary source: https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032022-deceptive-design-patterns-social-media_en. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/edpb-gl-03-2022" }, { "slug": "dpc-in-18-5-6", "url": "https://www.consentmark.com/precedent/dpc-in-18-5-6", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-18-5-6", "date": "2023-01-12", "respondent": "WhatsApp Ireland Limited", "respondentAnonymised": false, "finding": "WhatsApp could not lawfully rely on Article 6(1)(b) GDPR (necessity for performance of a contract) as the legal basis for processing personal data for service-improvement and security purposes; the forced-acceptance presentation of the May 2018 Terms of Service did not provide a freely-given consent under Article 6(1)(a) either, breaching the lawfulness and transparency principles of Article 5 GDPR.", "notes": "The DPC initially accepted WhatsApp's contractual-necessity argument for service improvements; the EDPB Article 65 binding decision required the position to be reversed. Cite when a service uses a forced-acceptance Terms of Service to bundle marketing-or-analytics processing into \"necessary for the service\".", "relevance": "context", "fineEur": 5500000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2023-04/WhatsApp%20FINAL%20DECISION%20%28adoption%20version%29%20Redacted.pdf", "archiveUrl": "https://web.archive.org/web/20240529211629/https://www.dataprotection.ie/sites/default/files/uploads/2023-04/WhatsApp%20FINAL%20DECISION%20(adoption%20version)%20Redacted.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "DPC (Ireland). (2023, January 12). IN-18-5-6 - WhatsApp Ireland Limited. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2023-04/WhatsApp%20FINAL%20DECISION%20%28adoption%20version%29%20Redacted.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-18-5-6" }, { "slug": "dpc-in-18-5-5", "url": "https://www.consentmark.com/precedent/dpc-in-18-5-5", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-18-5-5", "date": "2022-12-31", "respondent": "Meta Platforms Ireland Limited", "respondentAnonymised": false, "finding": "Meta Ireland could not rely on the contract legal basis (Article 6(1)(b) GDPR) to process Facebook users' personal data for behavioural advertising; the processing therefore lacked any valid lawful basis and breached transparency obligations under Articles 12 and 13(1)(c).", "notes": "Decision followed EDPB Binding Decision 3/2022 (Art. 65 GDPR) on dispute resolution. Cite alongside Article 5(3) ePrivacy when the substantive issue is lawful basis for tracking, not the cookie banner mechanics.", "relevance": "context", "fineEur": 210000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Meta%20FINAL%20DECISION%20(ADOPTED)%2031-12-22%20-%20IN-18-5-5%20(Redacted).pdf", "archiveUrl": "https://web.archive.org/web/20260414181401/https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Meta%20FINAL%20DECISION%20%28ADOPTED%29%2031-12-22%20-%20IN-18-5-5%20%28Redacted%29.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-08-27", "reviewDue": "2027-02-27", "citeAs": "DPC (Ireland). (2022, December 31). IN-18-5-5 - Meta Platforms Ireland Limited. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Meta%20FINAL%20DECISION%20(ADOPTED)%2031-12-22%20-%20IN-18-5-5%20(Redacted).pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-18-5-5" }, { "slug": "cnil-san-2022-027", "url": "https://www.consentmark.com/precedent/cnil-san-2022-027", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2022-027", "date": "2022-12-29", "respondent": "TIKTOK TECHNOLOGY LIMITED and TIKTOK INFORMATION TECHNOLOGIES UK LIMITED", "respondentAnonymised": false, "finding": "On tiktok.com, users could accept cookies in a single click but had to navigate multiple steps to refuse them, breaching the symmetry-of- refusal limb of Article 82 of the French Data Protection Act; the information provided about the purposes of the cookies was also incomplete, undermining the informed-consent limb of the same article.", "notes": "Joint sanction against TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited - EUR 2.5M each. Cite alongside SAN-2021-024 (Facebook) and SAN-2022-023 (Microsoft Bing) for the pan-platform \"no equivalent refuse\" pattern.", "relevance": "gate", "fineEur": 5000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046977994", "archiveUrl": "https://web.archive.org/web/20240229200426/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046977994/", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2022, December 29). SAN-2022-027 - TIKTOK TECHNOLOGY LIMITED and TIKTOK INFORMATION TECHNOLOGIES UK LIMITED. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046977994. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2022-027" }, { "slug": "cnil-san-2022-023", "url": "https://www.consentmark.com/precedent/cnil-san-2022-023", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2022-023", "date": "2022-12-19", "respondent": "MICROSOFT IRELAND OPERATIONS LIMITED", "respondentAnonymised": false, "finding": "Advertising cookies were deposited on users' terminals when they arrived on bing.com without their prior consent, and the consent interface did not offer a \"refuse\" mechanism with the same simplicity as the \"accept\" mechanism, breaching the freely-given and equivalent- refusal limbs of Article 82 of the French Data Protection Act.", "notes": "Bing (Microsoft search engine) precedent. Cite alongside SAN-2021-024 (Facebook), SAN-2021-023 (Google) and SAN-2022-027 (TikTok) for the pan-platform asymmetric-refuse pattern; the EUR 60M scale signals that the CNIL does not treat the asymmetry as a paperwork failing.", "relevance": "gate", "fineEur": 60000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046768989", "archiveUrl": "https://web.archive.org/web/20250209183135/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046768989", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2022, December 19). SAN-2022-023 - MICROSOFT IRELAND OPERATIONS LIMITED. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046768989. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2022-023" }, { "slug": "dpc-in-21-4-2", "url": "https://www.consentmark.com/precedent/dpc-in-21-4-2", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-21-4-2", "date": "2022-11-25", "respondent": "Meta Platforms Ireland Limited", "respondentAnonymised": false, "finding": "Facebook Search, the Messenger Contact Importer and the Instagram Contact Importer, as deployed between May 2018 and September 2019, failed to implement appropriate technical and organisational measures to ensure data protection by design and by default, breaching Articles 25(1) and 25(2) GDPR; the design enabled unauthenticated enumeration of personal data tied to phone numbers and email addresses, a \"data scraping\" pattern Meta had not designed-out.", "notes": "Cite when the scanner narrative covers a feature that exposes more data per-request than the minimum needed to render its UI - the Article 25 by-design and by-default obligations bite even if no individual access is itself \"unauthorised\". Companion finding to the earlier April-2021 Facebook data leak coverage.", "relevance": "context", "fineEur": 265000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2022-12/Final%20Decision_IN-21-4-2_Redacted.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "DPC (Ireland). (2022, November 25). IN-21-4-2 - Meta Platforms Ireland Limited. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2022-12/Final%20Decision_IN-21-4-2_Redacted.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-21-4-2" }, { "slug": "ico-easylife-2022-10", "url": "https://www.consentmark.com/precedent/ico-easylife-2022-10", "regulator": "ico", "regulatorLabel": "ICO (United Kingdom)", "caseRef": "easylife-2022-10", "date": "2022-10-04", "respondent": "Easylife Ltd", "respondentAnonymised": false, "finding": "Easylife profiled customers based on items purchased from its non-health catalogue to make assumptions about their medical conditions and then used those profiles to market health products, processing special- category data within Article 9 UK GDPR without an Article 9(2) lawful basis; also made 1,345,732 unsolicited direct marketing calls to individuals registered with the Telephone Preference Service in breach of regulation 21 PECR.", "notes": "Native fine GBP 1.35M (combined GBP 1.35M GDPR penalty and GBP 130k PECR penalty). Cite when the scanner narrative needs the precedent that inferring health-related profiles from on-site behaviour triggers Article 9 even if the inputs are not themselves health data - directly relevant to ad-tech audiences built on purchase signals.", "relevance": "context", "fineEur": 1500000, "fineNative": { "currency": "GBP", "amount": 1350000 }, "fineApproximate": true, "primarySourceUrl": "https://ico.org.uk/action-weve-taken/enforcement/easylife-limited-mpn/", "archiveUrl": "https://web.archive.org/web/20240617084322/https://ico.org.uk/action-weve-taken/enforcement/easylife-limited-mpn/", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-26", "reviewDue": "2026-11-26", "citeAs": "ICO (United Kingdom). (2022, October 4). easylife-2022-10 - Easylife Ltd. Primary source: https://ico.org.uk/action-weve-taken/enforcement/easylife-limited-mpn/. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/ico-easylife-2022-10" }, { "slug": "dpc-in-20-7-4", "url": "https://www.consentmark.com/precedent/dpc-in-20-7-4", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-20-7-4", "date": "2022-09-02", "respondent": "Meta Platforms Ireland Limited", "respondentAnonymised": false, "finding": "Instagram child users (aged 13-17) who operated business accounts had their phone numbers and email addresses exposed publicly, and child personal accounts defaulted to public visibility, breaching Articles 5(1)(a), 5(1)(c), 6(1), 12(1), 24(1), 25(1), 25(2) and 35(1) GDPR; the DPC issued a reprimand and ordered remedial action alongside the fine.", "notes": "The DPC's filename embeds an internal date (09-09-22) that does not match the formal case reference (IN-20-7-4); the decisions index page is the authoritative source for the case ref. Cite when the scan involves a platform with public-by-default settings for users under 18.", "relevance": "context", "fineEur": 405000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/sites/default/files/uploads/2022-09/02.09.22%20Decision%20IN%2009-09-22%20Instagram.pdf", "archiveUrl": "https://web.archive.org/web/20260316112924/https://www.dataprotection.ie/sites/default/files/uploads/2022-09/02.09.22%20Decision%20IN%2009-09-22%20Instagram.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-26", "reviewDue": "2026-11-26", "citeAs": "DPC (Ireland). (2022, September 2). IN-20-7-4 - Meta Platforms Ireland Limited. Primary source: https://www.dataprotection.ie/sites/default/files/uploads/2022-09/02.09.22%20Decision%20IN%2009-09-22%20Instagram.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-20-7-4" }, { "slug": "aepd-ps-00037-2022", "url": "https://www.consentmark.com/precedent/aepd-ps-00037-2022", "regulator": "aepd", "regulatorLabel": "AEPD (Spain)", "caseRef": "PS-00037-2022", "date": "2022-07-18", "respondent": "OPEN BANK, S.A.", "respondentAnonymised": false, "finding": "openbank.es presented an initial cookie banner with an \"Accept\" button but no equivalent option to reject non-strictly-necessary cookies at the same interaction level, requiring users to navigate to a \"Cookie settings\" panel to refuse - the asymmetric design fell short of the unambiguous and freely-given consent standard required by Article 22.2 LSSI in line with Article 4(11) and 7 GDPR.", "notes": "Cite alongside CNIL SAN-2022-031 (Meta Facebook) for symmetry-of- refusal as a pan-EU principle, not a French-only quirk. AEPD has been explicit since at least 2020 that \"Accept\" without a same-level \"Reject\" is non-compliant under LSSI Article 22.2.", "relevance": "gate", "fineEur": 30000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.aepd.es/documento/ps-00037-2022.pdf", "archiveUrl": "https://web.archive.org/web/20240127061511/https://www.aepd.es/documento/ps-00037-2022.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-26", "reviewDue": "2026-11-26", "citeAs": "AEPD (Spain). (2022, July 18). PS-00037-2022 - OPEN BANK, S.A.. Primary source: https://www.aepd.es/documento/ps-00037-2022.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/aepd-ps-00037-2022" }, { "slug": "dpc-twitter-id-verification-2022-04", "url": "https://www.consentmark.com/precedent/dpc-twitter-id-verification-2022-04", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "twitter-id-verification-2022-04", "date": "2022-04-27", "respondent": "Twitter International Company", "respondentAnonymised": false, "finding": "Twitter required photographic identification to verify the identity of a complainant whose account had been suspended and who had requested erasure under Article 17, breaching Articles 5(1)(c) and 6(1) GDPR; Twitter also failed to process the erasure within the statutory period in Article 17(1) and did not inform the data subject of the action taken within one month as required by Article 12(3) GDPR.", "notes": "Reprimand under Article 58(2)(b) GDPR plus an Article 58(2)(d) order to revise erasure-request policies; no administrative fine. Companion to Groupon IN-20-37-1 and Airbnb IN-20-38-1. Subject-rights handling, not cookies or trackers.", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.dataprotection.ie/en/dpc-guidance/decisions/decision-concerning-twitter-international-company", "archiveUrl": "https://web.archive.org/web/20260806010835/https://www.dataprotection.ie/en/dpc-guidance/decisions/decision-concerning-twitter-international-company", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-08-27", "reviewDue": "2027-02-27", "citeAs": "DPC (Ireland). (2022, April 27). twitter-id-verification-2022-04 - Twitter International Company. Primary source: https://www.dataprotection.ie/en/dpc-guidance/decisions/decision-concerning-twitter-international-company. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-twitter-id-verification-2022-04" }, { "slug": "aepd-ps-00477-2021", "url": "https://www.consentmark.com/precedent/aepd-ps-00477-2021", "regulator": "aepd", "regulatorLabel": "AEPD (Spain)", "caseRef": "PS-00477-2021", "date": "2022-03-09", "respondent": "VODAFONE ESPAÑA, S.A.U.", "respondentAnonymised": false, "finding": "vodafone.es deposited cookies on user terminals before any consent action and provided information about cookies through a banner that did not enable users to refuse them with the same ease as accepting - infringing Article 22.2 of Law 34/2002 (LSSI), the Spanish national transposition of Article 5(3) of the ePrivacy Directive.", "notes": "Cite when the scanner finds pre-consent cookies on a Spanish-jurisdiction site - the AEPD has been issuing PS/00xxx/202x cookie sanctions since the LSSI 2020 amendment aligned Spanish law with the EDPB's strict reading of valid consent.", "relevance": "gate", "fineEur": 70000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.aepd.es/documento/ps-00477-2021.pdf", "archiveUrl": "https://web.archive.org/web/20240127061533/https://www.aepd.es/documento/ps-00477-2021.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-26", "reviewDue": "2026-11-26", "citeAs": "AEPD (Spain). (2022, March 9). PS-00477-2021 - VODAFONE ESPAÑA, S.A.U.. Primary source: https://www.aepd.es/documento/ps-00477-2021.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/aepd-ps-00477-2021" }, { "slug": "cnil-med-google-analytics-anonymised", "url": "https://www.consentmark.com/precedent/cnil-med-google-analytics-anonymised", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "MED-GOOGLE-ANALYTICS-ANONYMISED", "date": "2022-02-10", "respondent": "Anonymised French website operator", "respondentAnonymised": true, "finding": "On 10 February 2022 the CNIL put a French website operator on formal notice, holding that the unique identifiers, IP addresses, browser data and metadata collected through the Google Analytics functionality and transferred to Google LLC in the United States could be justified under no Chapter V instrument, and so compromised the level of protection guaranteed by Article 44 GDPR. The operator was given one month to comply, if necessary by ceasing to use the tool.", "notes": "Published in anonymised form: the CNIL redacted the decision number, date and respondent because the tool is widely used and the point was general, so the case_ref here is a constructed stable id, not a CNIL number. Decided on the post-Schrems II position; the EU-US Data Privacy Framework adequacy decision of 10 July 2023 changed the transfer analysis prospectively for certified US importers. Both 2022 CNIL pages now 301 elsewhere and the PDF 404s, so archive_url is load-bearing.", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.cnil.fr/sites/default/files/atoms/files/med_google_analytics_anonymisee.pdf", "archiveUrl": "https://web.archive.org/web/20230308201444/https://www.cnil.fr/sites/default/files/atoms/files/med_google_analytics_anonymisee.pdf", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-08-18", "reviewDue": "2027-02-18", "citeAs": "CNIL (France). (2022, February 10). MED-GOOGLE-ANALYTICS-ANONYMISED - Anonymised French website operator. Primary source: https://www.cnil.fr/sites/default/files/atoms/files/med_google_analytics_anonymisee.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-med-google-analytics-anonymised" }, { "slug": "cnil-san-2021-024", "url": "https://www.consentmark.com/precedent/cnil-san-2021-024", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2021-024", "date": "2021-12-31", "respondent": "FACEBOOK IRELAND LIMITED", "respondentAnonymised": false, "finding": "Facebook deposited cookies on the terminals of users visiting facebook.com without their prior consent and offered no equivalent \"refuse\" option alongside the \"accept\" option at the first interaction; users had to click through to a secondary panel to refuse, breaching the freely-given and equivalent-refusal limbs of Article 82 of the French Data Protection Act.", "notes": "Issued the same day as SAN-2021-023 (Google EUR 150M) under the same factual pattern. Cite for the principle that \"accept in one click, refuse in several clicks\" is itself the violation - the CNIL does not require that no consent be obtained, only that the path to refusal match the path to acceptance.", "relevance": "gate", "fineEur": 60000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840532", "archiveUrl": "https://web.archive.org/web/20241111172550/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840532", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2021, December 31). SAN-2021-024 - FACEBOOK IRELAND LIMITED. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840532. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2021-024" }, { "slug": "cnil-san-2021-023", "url": "https://www.consentmark.com/precedent/cnil-san-2021-023", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2021-023", "date": "2021-12-31", "respondent": "GOOGLE LLC and GOOGLE IRELAND LIMITED", "respondentAnonymised": false, "finding": "Cookies were deposited on the terminals of users visiting google.fr without their prior consent, and the consent interface did not offer an equivalent refusal control alongside the acceptance control at the first interaction; users had to navigate to a secondary panel to refuse, breaching the freely-given and equivalent-refusal limbs of Article 82 of the French Data Protection Act.", "notes": "Fine split: EUR 90M against Google LLC + EUR 60M against Google Ireland Limited. Companion to SAN-2021-024 (Facebook) and SAN-2022-023 (Microsoft Bing). The 2025-09-01 Google decision (SAN-2025-004) is the follow-on under the same Article 82 framework.", "relevance": "gate", "fineEur": 150000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840062", "archiveUrl": "https://web.archive.org/web/20241230173721/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840062", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "CNIL (France). (2021, December 31). SAN-2021-023 - GOOGLE LLC and GOOGLE IRELAND LIMITED. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840062. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2021-023" }, { "slug": "edpb-gl-07-2020", "url": "https://www.consentmark.com/precedent/edpb-gl-07-2020", "regulator": "edpb", "regulatorLabel": "EDPB (European Data Protection Board)", "caseRef": "GL-07-2020", "date": "2021-07-07", "respondent": "European Data Protection Board", "respondentAnonymised": false, "finding": "The notions of controller and processor are functional - they aim to allocate responsibilities according to the actual roles of the parties. A controller is the body which \"determines the purposes and means\" of the processing; a processor processes \"on behalf of the controller\". Where an entity defines what data is collected, for what purpose, with whom it is shared and for how long, it acts as a controller regardless of its self-description.", "notes": "[Type: guidance] Non-enforcement guideline. Cite when the scanner narrative covers a vendor (analytics, tag-management, email-tracking) that self-classifies as Article 28 processor while in fact determining the purposes of processing - the AEPD Mailtrack PS-00388-2022 decision applies this guideline directly.", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "EDPB (European Data Protection Board). (2021, July 7). GL-07-2020 - European Data Protection Board. Primary source: https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/edpb-gl-07-2020" }, { "slug": "dpc-in-19-1-1", "url": "https://www.consentmark.com/precedent/dpc-in-19-1-1", "regulator": "dpc", "regulatorLabel": "DPC (Ireland)", "caseRef": "IN-19-1-1", "date": "2020-12-09", "respondent": "Twitter International Company", "respondentAnonymised": false, "finding": "Twitter International Company failed to notify the Data Protection Commission of a personal data breach within 72 hours of becoming aware of it, breaching Article 33(1) GDPR, and failed to document the breach adequately, breaching Article 33(5) GDPR.", "notes": "Full decision PDF at dataprotection.ie/sites/default/files/uploads/2021-02. Breach notification, not cookies or trackers. Cite for the Article 33 timeline, never for a tracking finding.", "relevance": "context", "fineEur": 450000, "fineNative": { "currency": "USD", "amount": 500000 }, "fineApproximate": true, "primarySourceUrl": "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-twitter-international-company-tic", "archiveUrl": "https://web.archive.org/web/20260806010831/https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-twitter-international-company-tic", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-08-27", "reviewDue": "2027-02-27", "citeAs": "DPC (Ireland). (2020, December 9). IN-19-1-1 - Twitter International Company. Primary source: https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-twitter-international-company-tic. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/dpc-in-19-1-1" }, { "slug": "cnil-san-2020-013", "url": "https://www.consentmark.com/precedent/cnil-san-2020-013", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2020-013", "date": "2020-12-07", "respondent": "AMAZON EUROPE CORE", "respondentAnonymised": false, "finding": "When a user visited amazon.fr - including by following an advertisement link from a third-party site - a substantial number of advertising cookies were deposited on the terminal without any action on the user's part, and before any information was provided; the banner shown did not describe the purposes of those cookies or how to refuse them, in breach of Article 82 of the French Data Protection Act.", "notes": "Companion to SAN-2020-012 (Google). Cite together when the scanner narrative needs to anchor \"ad cookies on arrival without consent is unlawful\" against multiple respondents and not against a single one.", "relevance": "gate", "fineEur": 35000000, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729", "archiveUrl": "https://web.archive.org/web/20241208090125/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-26", "reviewDue": "2026-11-26", "citeAs": "CNIL (France). (2020, December 7). SAN-2020-013 - AMAZON EUROPE CORE. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2020-013" }, { "slug": "cnil-san-2020-012", "url": "https://www.consentmark.com/precedent/cnil-san-2020-012", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "SAN-2020-012", "date": "2020-12-07", "respondent": "GOOGLE LLC and GOOGLE IRELAND LIMITED", "respondentAnonymised": false, "finding": "Advertising cookies were automatically deposited on the user's terminal on google.fr without prior consent, and the information notice did not explain the purposes of all cookies or the means available to refuse them - a breach of Article 82 of the French Data Protection Act (the French transposition of Article 5(3) ePrivacy).", "notes": "The fine is split between the two respondents (EUR 60M against Google LLC and EUR 40M against Google Ireland Limited); fine_eur records the aggregate. CNIL is the lead authority on cookie enforcement under ePrivacy; quote this case whenever a scan finds advertising tags firing before consent on a French-language surface.", "relevance": "gate", "fineEur": 100000000, "fineNative": { "currency": "EUR", "amount": 100000000 }, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706", "archiveUrl": "https://web.archive.org/web/20240530121148/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-26", "reviewDue": "2026-11-26", "citeAs": "CNIL (France). (2020, December 7). SAN-2020-012 - GOOGLE LLC and GOOGLE IRELAND LIMITED. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-san-2020-012" }, { "slug": "ico-marriott-2020-10", "url": "https://www.consentmark.com/precedent/ico-marriott-2020-10", "regulator": "ico", "regulatorLabel": "ICO (United Kingdom)", "caseRef": "marriott-2020-10", "date": "2020-10-30", "respondent": "Marriott International, Inc.", "respondentAnonymised": false, "finding": "An attacker placed a web shell on a Starwood guest-reservations system in or around July 2014 and maintained undetected access through Marriott's 2016 acquisition until September 2018, exfiltrating up to 339 million guest records (including 7 million UK records); Marriott failed to implement appropriate security measures to protect the personal data and to assess the Starwood IT estate adequately on acquisition, breaching Article 5(1)(f) and Article 32 GDPR.", "notes": "The original notice of intent was GBP 99.2M; the pandemic-period discount and other mitigating factors reduced the final. Cite when the scanner narrative needs the precedent that acquisition due-diligence on the security posture of an acquired estate is a controller obligation, not just commercial good practice.", "relevance": "context", "fineEur": 21000000, "fineNative": { "currency": "GBP", "amount": 18400000 }, "fineApproximate": true, "primarySourceUrl": "https://ico.org.uk/media2/migrated/2618524/marriott-international-inc-mpn-20201030.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "ICO (United Kingdom). (2020, October 30). marriott-2020-10 - Marriott International, Inc.. Primary source: https://ico.org.uk/media2/migrated/2618524/marriott-international-inc-mpn-20201030.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/ico-marriott-2020-10" }, { "slug": "ico-ba-2020-10", "url": "https://www.consentmark.com/precedent/ico-ba-2020-10", "regulator": "ico", "regulatorLabel": "ICO (United Kingdom)", "caseRef": "ba-2020-10", "date": "2020-10-16", "respondent": "British Airways plc", "respondentAnonymised": false, "finding": "Between 22 June and 5 September 2018 a Magecart-style skimming attacker injected code into the BA website and mobile app payment pages and exfiltrated names, addresses, payment-card data and BA log- in credentials of approximately 429,612 customers and staff; British Airways failed to implement appropriate technical and organisational measures to secure the processing, breaching Article 5(1)(f) and Article 32 GDPR.", "notes": "The original notice of intent was GBP 183.39M; the pandemic-period discount and other mitigating factors reduced the final to GBP 20M. The skimming-via-third-party-script pattern is directly relevant to scanner findings about supply-chain scripts on the payment page.", "relevance": "context", "fineEur": 23000000, "fineNative": { "currency": "GBP", "amount": 20000000 }, "fineApproximate": true, "primarySourceUrl": "https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-05-27", "reviewDue": "2026-11-27", "citeAs": "ICO (United Kingdom). (2020, October 16). ba-2020-10 - British Airways plc. Primary source: https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/ico-ba-2020-10" }, { "slug": "cnil-delib-2020-092", "url": "https://www.consentmark.com/precedent/cnil-delib-2020-092", "regulator": "cnil", "regulatorLabel": "CNIL (France)", "caseRef": "DELIB-2020-092", "date": "2020-09-17", "respondent": "Commission Nationale de l'Informatique et des Libertés", "respondentAnonymised": false, "finding": "The controller must offer users the option to accept and to refuse read/write operations on their terminal with the same degree of simplicity (Article 2.4, \"Modalités du refus\"); withdrawing consent must be as easy as giving it, and the means of withdrawal must be signposted before consent is collected (Article 3, \"Retrait et gestion du consentement\").", "notes": "[Type: guidance] Non-enforcement recommendation. CNIL's own description of a compliant cookie banner (symmetric accept/refuse, easy withdrawal, granular per-purpose consent). Original in French; `finding` paraphrases Article 2.4 + Article 3 in English. Companion binding text: Délibération 2020-091 (lignes directrices).", "relevance": "gate", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042398022", "archiveUrl": "https://web.archive.org/web/20231202122010/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042398022/", "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-08-27", "reviewDue": "2027-02-27", "citeAs": "CNIL (France). (2020, September 17). DELIB-2020-092 - Commission Nationale de l'Informatique et des Libertés. Primary source: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042398022. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cnil-delib-2020-092" }, { "slug": "edpb-gl-05-2020", "url": "https://www.consentmark.com/precedent/edpb-gl-05-2020", "regulator": "edpb", "regulatorLabel": "EDPB (European Data Protection Board)", "caseRef": "GL-05-2020", "date": "2020-05-04", "respondent": "European Data Protection Board", "respondentAnonymised": false, "finding": "Valid consent requires \"a clear affirmative act\" by which the data subject signifies agreement; \"the use of pre-ticked opt-in boxes is invalid under the GDPR\" and \"silence or inactivity on the part of the data subject, as well as merely proceeding with a service\" cannot be regarded as an active indication of choice (paragraphs 75 and 79).", "notes": "[Type: guidance] Non-enforcement document. Use this entry as the regulator-language anchor for the \"consent-gated done right\" zone of the scanner narrative - it defines what a compliant pattern looks like in the EDPB's own words. The verbatim quotes in `finding` come from paragraphs 75 (\"clear affirmative act ... active motion or declaration\") and 79 (\"pre-ticked opt-in boxes ... invalid\") of the consolidated v1.1 PDF hosted on edpb.europa.eu.", "relevance": "context", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en", "archiveUrl": null, "appealStatus": { "status": "not_checked", "sourceUrl": null, "note": null, "meaning": "We have not checked whether this decision was appealed. This is not a statement that no appeal exists." }, "verifiedAt": "2026-08-27", "reviewDue": "2027-02-27", "citeAs": "EDPB (European Data Protection Board). (2020, May 4). GL-05-2020 - European Data Protection Board. Primary source: https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/edpb-gl-05-2020" }, { "slug": "cjeu-c-673-17", "url": "https://www.consentmark.com/precedent/cjeu-c-673-17", "regulator": "cjeu", "regulatorLabel": "CJEU (Court of Justice of the European Union)", "caseRef": "C-673/17", "date": "2019-10-01", "respondent": "Planet49 GmbH", "respondentAnonymised": false, "finding": "Consent under Article 5(3) of Directive 2002/58 is not validly constituted where, in the form of cookies, the storage of information or access to information already stored in a website user's terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse consent. That conclusion does not vary according to whether the information stored or accessed is personal data.", "notes": "[Type: guidance] Court of Justice, not a DPA. Case file also at curia.europa.eu/juris/liste.jsf?num=C-673/17; EUR-Lex is cited as the primary source because curia serves the judgment only to a browser. A preliminary ruling is final - there is no appeal from the Court. Point 3 of the operative part adds that the information the provider must give includes how long the cookies operate and whether third parties may access them.", "relevance": "gate", "fineEur": 0, "fineNative": null, "fineApproximate": false, "primarySourceUrl": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62017CJ0673", "archiveUrl": "https://web.archive.org/web/20260624151027/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A62017CJ0673", "appealStatus": { "status": "final", "sourceUrl": null, "note": null, "meaning": "A preliminary ruling of the Court of Justice is final. No appeal lies from it." }, "verifiedAt": "2026-08-27", "reviewDue": "2027-02-27", "citeAs": "CJEU (Court of Justice of the European Union). (2019, October 1). C-673/17 - Planet49 GmbH. Primary source: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62017CJ0673. Recorded in the ConsentMark precedent corpus, 2026, August 27: https://www.consentmark.com/precedent/cjeu-c-673-17" } ], "omits": [ "Anything the deciding authority withheld. Where a regulator anonymised a respondent, the entry carries the authority's own designation and respondentAnonymised is true. This corpus does not restore a name a regulator declined to publish.", "Any obligation on a controller, and any technical condition for meeting one. The entries record what an authority decided and where to read it. What follows for a given organisation is not in this file.", "Decisions withheld from the registry. An entry we can no longer stand over is withdrawn with a reason recorded rather than left on a public page." ] }