# GDPR News — gdpr.news

> Independent news and analysis on the General Data Protection Regulation and EU data protection law.

GDPR News (gdpr.news) tracks enforcement actions, landmark rulings, fines, and upcoming changes to EU data privacy law. The site covers developments from GDPR's entry into force in May 2018 through the present, including speculative analysis on likely future regulatory changes.

## Key topics

- GDPR enforcement actions and fines by European DPAs
- Landmark CJEU rulings affecting data protection (e.g. Schrems I, Schrems II)
- EU–US data transfer frameworks: Safe Harbour, Privacy Shield, Data Privacy Framework
- Standard Contractual Clauses (SCCs) and Transfer Impact Assessments
- EDPB guidelines, opinions, and binding decisions
- One-stop-shop mechanism and cross-border cooperation
- Children's data protection and age-appropriate design
- AI Act intersections with GDPR (Article 22, automated decision-making)
- ePrivacy Regulation developments
- Cookie consent and legitimate interests enforcement
- Speculative analysis on future GDPR amendments and enforcement trends

## Notable fines covered

- Meta (Facebook) €1,200,000,000 — Irish DPC, May 2023 (US data transfers)
- Amazon €746,000,000 — CNPD (Luxembourg), July 2021 (advertising consent)
- X Corp (Twitter) €550,000,000 — Irish DPC, September 2024 (advertising data)
- TikTok €530,000,000 — Irish DPC, May 2025 (data transfers to China)
- Meta (Instagram) €405,000,000 — Irish DPC, September 2022 (children's data)
- Google €325,000,000 — CNIL (France), September 2025 (Gmail spam/consent)
- LinkedIn €310,000,000 — Irish DPC, October 2024 (advertising legal basis)
- Uber €290,000,000 — Dutch DPA, August 2024 (US data transfers)
- Meta (Facebook) €265,000,000 — Irish DPC, November 2022 (data scraping)
- WhatsApp €225,000,000 — Irish DPC, September 2021 (transparency)
- Google LLC €50,000,000 — CNIL (France), January 2019 (consent/transparency)
- Criteo €40,000,000 — CNIL (France), upheld March 2026 (tracking/advertising)

## Key milestones

- May 2018: GDPR becomes enforceable (replaces 1995 Data Protection Directive)
- July 2020: Schrems II — CJEU invalidates Privacy Shield
- June 2021: New Standard Contractual Clauses published by European Commission
- July 2023: EU–US Data Privacy Framework adequacy decision adopted
- August 2024: EU AI Act enters into force
- May 2025: TikTok fined €530M for data transfers to China
- March 2026: EDPB launches CEF 2026 on transparency obligations
- June 2026: EDPB adopts common data breach notification template
- June 2026: US Supreme Court FTC ruling threatens EU–US Data Privacy Framework
- July 2026: EDPB and AMLA announce joint guidelines on information sharing

## External resources

- EDPB (European Data Protection Board): https://edpb.europa.eu/
- Irish DPC: https://www.dataprotection.ie/
- CNIL (France): https://www.cnil.fr/en
- NOYB (privacy NGO): https://noyb.eu/
- GDPR Enforcement Tracker: https://www.enforcementtracker.com/
- Official GDPR text: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

## About

This site provides independent editorial analysis of EU data protection developments. It is not legal advice. Always consult a qualified data protection professional for compliance questions.