# Minors — legal context bundle > Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/minors > Sources are cited per item. Verify against the official texts before relying on them. Special protections for children under GDPR ## Overview ## Legal Framework The GDPR establishes special protections for children's personal data primarily through [Article 8](/laws/gdpr/art-8), which sets the age of consent for information society services offered directly to children. Below the default threshold of 16, processing requires parental authorization, though Member States may lower this floor to 13. Controllers must make "reasonable efforts" to verify that consent is properly given, "taking into consideration available technology" ([Article 8(2)](/laws/gdpr/art-8)). > "Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child." > — [GDPR Art. 8](/laws/gdpr/art-8) [Article 40(2)(g)](/laws/gdpr/art-40#par-2-pnt-g) encourages codes of conduct specifying how parental consent is obtained, while [Article 57(1)(b)](/laws/gdpr/art-57#par-1-pnt-b) requires supervisory authorities to give specific attention to activities directed at children. The [DSA Article 14(3)](/laws/dsa/art-14#par-3) extends analogous protections to intermediary services predominantly used by minors, requiring explanations "in a way that minors can understand." ## Key Developments Enforcement actions show DPAs apply heightened scrutiny to processing involving minors. The Swedish DPA fined a school in Skellefteå for using facial recognition to monitor student attendance, finding consent invalid because the power imbalance undermined voluntariness: > "consent can not be applied since students and their guardians cannot freely decide if they/their children want to be monitored for attendance purposes" > — [Skellefteå school decision](/posts/46182#seg-1) In the Mercadona case, the Spanish DPA fined the controller EUR 2,520,000 after a facial recognition system captured all store entrants, including minors, with the DPIA failing to account for children's specific risks. The AEPD has separately treated "affecting the rights of minors" as an aggravating factor in sanction assessment. The EDPB's breach notification guidance identifies children as warranting elevated concern: > "A breach may affect personal data concerning children or other vulnerable individuals, who may be placed at greater risk of danger as a result." > — [EDPB Guidelines 9/2022](/posts/38058#seg-115) ## Status of the Debate The regulatory perimeter around minors remains contested. Member State divergence on the digital consent age (13 versus 16) creates cross-border compliance friction. The EDPB's February 2025 Statement on Age Assurance signals an emerging regulatory consensus on age-verification methods, but no court has yet ruled on whether specific mechanisms satisfy [Article 8(2)](/laws/gdpr/art-8)'s "reasonable efforts" standard. National family courts have adjudicated minors' interests extensively but outside the data protection context. A CJEU preliminary reference on the proportionality of age-assurance technologies would be needed to settle whether particular methods are required or merely permitted. ## Practical Guidance - **Default to 16**: Apply the 16-year consent threshold unless you have confirmed the specific Member State has lowered it to 13 under [Article 8(1)](/laws/gdpr/art-8). - **Verify parental consent**: Implement age-appropriate verification — the "reasonable efforts" standard in [Article 8(2)](/laws/gdpr/art-8) is technology-dependent, and the Skellefteå enforcement shows consent fails where the power imbalance is structural. - **Account for minors in DPIAs**: The Mercadona fine demonstrates that failing to assess children's specific risks in impact assessments is independently sanctionable. - **Adapt transparency**: Provide information in clear, age-appropriate language for services directed at or predominantly used by minors, per [DSA Art. 14(3)](/laws/dsa/art-14#par-3) and [GDPR Art. 57(1)(b)](/laws/gdpr/art-57#par-1-pnt-b). - **Elevate breach response**: Treat breaches involving minors' data as higher-risk events, prioritizing notification and mitigation per EDPB guidance. ## Legislation (full text of key provisions) ### Conditions applicable to child's consent in relation to information society services *Source: GDPR, gdpr-art-8-en, 2016-04-27 — https://overview.legal/posts/90292* ### Online protection of minors *Source: DSA, dsa-art-28-en, 2022-10-19 — https://overview.legal/posts/94461* ### Recital 71 — protection of minors online *Source: DSA, dsa-rec-71-en, 2022-10-19 — https://overview.legal/posts/95539* The protection of minors is an important policy objective of the Union. An online platform can be considered to be accessible to minors when its terms and conditions permit minors to use the service, when its service is directed at or predominantly used by minors, or where the provider is otherwise aware that some of the recipients of its service are minors, for example because it already processes personal data of the recipients of its service revealing their age for other purposes. Providers of online platforms used by minors should take appropriate and proportionate measures to protect minors, for example by designing their online interfaces or parts thereof with the highest level of privacy, safety and security for minors by default where appropriate or adopting standards for protection of minors, or participating in codes of conduct for protecting minors. They should consider best practices and available guidance, such as that provided by the communication of the Commission on A Digital Decade for children and youth: the new European strategy for a better internet for kids (BIK+). Providers of online platforms should not present advertisements based on profiling using personal data of the recipient of the service when they are aware with reasonable certainty that the recipient of the service is a minor. In accordance with Regulation (EU) 2016/679, notably the principle of data minimisation as provided for in Article 5(1), point (c), thereof, this prohibition should not lead the provider of the online platform to maintain, acquire or process more personal data than it already has in order to assess if the recipient of the service is a minor. Thus, this obligation should not incentivize providers of online platforms to collect the age of the recipient of the service prior to their use. It should be without prejudice to Union law on protection of personal data. ### Recital 89 — protection of minors on large platforms *Source: DSA, dsa-rec-89-en, 2022-10-19 — https://overview.legal/posts/95575* Providers of very large online platforms and of very large online search engines should take into account the best interests of minors in taking measures such as adapting the design of their service and their online interface, especially when their services are aimed at minors or predominantly used by them. They should ensure that their services are organised in a way that allows minors to access easily mechanisms provided for in this Regulation, where applicable, including notice and action and complaint mechanisms. They should also take measures to protect minors from content that may impair their physical, mental or moral development and provide tools that enable conditional access to such information. In selecting the appropriate mitigation measures, providers can consider, where appropriate, industry best practices, including as established through self-regulatory cooperation, such as codes of conduct, and should take into account the guidelines from the Commission. ### Recital 46 — child-friendly terms explanation for minors *Source: DSA, dsa-rec-46-en, 2022-10-19 — https://overview.legal/posts/95489* Providers of intermediary services that are primarily directed at minors, for example through the design or marketing of the service, or which are used predominantly by minors, should make particular efforts to render the explanation of their terms and conditions easily understandable to minors. ### Recital 38 — special protection for children's personal data *Source: GDPR, gdpr-rec-38-en, 2016-04-27 — https://overview.legal/posts/91591* Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child. ### Recital 81 — fundamental rights risks of services *Source: DSA, dsa-rec-81-en, 2022-10-19 — https://overview.legal/posts/95559* A second category concerns the actual or foreseeable impact of the service on the exercise of fundamental rights, as protected by the Charter, including but not limited to human dignity, freedom of expression and of information, including media freedom and pluralism, the right to private life, data protection, the right to non-discrimination, the rights of the child and consumer protection. Such risks may arise, for example, in relation to the design of the algorithmic systems used by the very large online platform or by the very large online search engine or the misuse of their service through the submission of abusive notices or other methods for silencing speech or hampering competition. When assessing risks to the rights of the child, providers of very large online platforms and of very large online search engines should consider for example how easy it is for minors to understand the design and functioning of the service, as well as how minors can be exposed through their service to content that may impair minors’ health, physical, mental and moral development. Such risks may arise, for example, in relation to the design of online interfaces which intentionally or unintentionally exploit the weaknesses and inexperience of minors or which may cause addictive behaviour. ### Recital 95 — very large online platforms advertisement repositories *Source: DSA, dsa-rec-95-en, 2022-10-19 — https://overview.legal/posts/95587* Advertising systems used by very large online platforms and very large online search engines pose particular risks and require further public and regulatory supervision on account of their scale and ability to target and reach recipients of the service based on their behaviour within and outside that platform’s or search engine's online interface. Very large online platforms or very large online search engines should ensure public access to repositories of advertisements presented on their online interfaces to facilitate supervision and research into emerging risks brought about by the distribution of advertising online, for example in relation to illegal advertisements or manipulative techniques and disinformation with a real and foreseeable negative impact on public health, public security, civil discourse, political participation and equality. Repositories should include the content of advertisements, including the name of the product, service or brand and the subject matter of the advertisement, and related data on the advertiser, and, if different, the natural or legal person who paid for the advertisement, and the delivery of the advertisement, in particular where targeted advertising is concerned. This information should include both information about targeting criteria and delivery criteria, in particular when advertisements are delivered to persons in vulnerable situations, such as minors. ### Recital 102 — voluntary technical standards for compliance *Source: DSA, dsa-rec-102-en, 2022-10-19 — https://overview.legal/posts/95601* To facilitate the effective and consistent application of the obligations in this Regulation that may require implementation through technological means, it is important to promote voluntary standards covering certain technical procedures, where the industry can help develop standardised means to support providers of intermediary services in complying with this Regulation, such as allowing the submission of notices, including through application programming interfaces, or standards related to terms and conditions or standards relating to audits, or standards related to the interoperability of advertisement repositories. In addition, such standards could include standards related to online advertising, recommender systems, accessibility and the protection of minors online. Providers of intermediary services are free to adopt the standards, but their adoption does not presume compliance with this Regulation. At the same time, by providing best practices, such standards could in particular be useful for relatively small providers of intermediary services. The standards could distinguish between different types of illegal content or different types of intermediary services, as appropriate. ### Recital 104 — code of conduct consideration areas *Source: DSA, dsa-rec-104-en, 2022-10-19 — https://overview.legal/posts/95605* It is appropriate that this Regulation identify certain areas of consideration for such codes of conduct. In particular, risk mitigation measures concerning specific types of illegal content should be explored via self- and co-regulatory agreements. Another area for consideration is the possible negative impacts of systemic risks on society and democracy, such as disinformation or manipulative and abusive activities or any adverse effects on minors. This includes coordinated operations aimed at amplifying information, including disinformation, such as the use of bots or fake accounts for the creation of intentionally inaccurate or misleading information, sometimes with a purpose of obtaining economic gain, which are particularly harmful for vulnerable recipients of the service, such as minors. In relation to such areas, adherence to and compliance with a given code of conduct by a very large online platform or a very large online search engine may be considered as an appropriate risk mitigating measure. The refusal without proper explanations by a provider of an online platform or of an online search engine of the Commission’s invitation to participate in the application of such a code of conduct could be taken into account, where relevant, when determining whether the online platform or the online search engine has infringed the obligations laid down by this Regulation. The mere fact of participating in and implementing a given code of conduct should not in itself presume compliance with this Regulation. ## Case law ### CJEU - C‑769/22 - European Commission v Hungary *Source: Court of Justice of the European Union, 2026-07-24 — https://overview.legal/posts/158432 — original: https://gdprhub.eu/index.php?title=CJEU_-_C‑769/22_-_European_Commission_v_Hungary* Facts — The background In 2021 Hungary adopted "Law LXXIX of 2021 adopting stricter measures against persons convicted of paedophilia and amending certain laws for the protection of children" ("the amending law"). The law introduced a number of rules to restrict the access of minors to content portraying or promoting gender identities that do not correspond to the sex assigned at birth, sex reassignment or homosexuality. The law also introduced new rules for access to public documents, requiring public bodies to allow broad access to information about individuals convicted of sexual offences against children. The alleged purpose of the law was to protect minors. In 2021 the Commission sent a formal letter to Hungary contesting the amending law's compliance with EU law. After some unproductive back-and-forth, the Commission escalated the case to the CJEU, requesting the CJEU to declare the amending law incompatible with EU law. The European Commission filed four pleas, claiming that Hungary violated of a long list of provisions from primary and secondary EU law . Only the Commission's fourth plea invokes data protection law- specifically, Article 8(2) of the EU Charter of Fundamental Rights (CFR) ("Protection of personal data") and Article 10 GDPR ("Processing of personal data relating to criminal convictions and offences"). The fourth plea: Article 10 GDPR The alleged violation of the GDPR relates to the amended law's rules on access to information about individuals convicted of sexual offences against children. The law amended the "Law on the criminal record system" and made documents about sexual offences accessible to a broad audience. Under the new rules, any adult who is either a relative or a guardian of a minor ("authorised person"), has the right to access and share information about individuals convicted of sexual offences against children (the data subjects) from bodies with access to registered data. The Commission claimed that the amended law failed to specify with sufficient clarity who is authorised to submit a data request and, therefore, did not provide sufficient guarantees for the rights and freedoms of data subjects regarding the conditions of access to their personal data. On these grounds, the Commission claimed that the amended law infringed Article 10 of the GDPR (as well as Art. 8(2) CFR). In its defense, Hungary argued that the law accurately identified "authorised persons" when read in light of the definition of "relatives" in the Hungarian civil code. Additionally, Hungary claimed that there were two additional criteria access to personal data under Hungarian law: the authorised person must consider the relevant data to be probably necessary, and it must be disproportionately difficult for them to access the subjects' data if they are not disclosed. In other words, Hungary argued that when interpreted correctly, Hungarian law provided for three cumulative criteria for the disclosure of data about convictions for sex offences against children: (i) the disclosure was requested by an authorized person (i.e. "any adult who is either a relative of, or educates, supervises or cares for, a person who has not attained 18 years of age"- where "relative" was to be understood in the well-defined sense of Hungarian civil law); (ii) the disclosure was probably necessary to keep the minor safe; (iii) it was disproportionately difficult for the authorized person to access the data otherwise. Hungary claimed that these criteria were clearly defined and provided sufficient safeguards for data subjects. On this basis, Hungary argued that the amended law complied with Article 10 GDPR and 8(2) CFR. Advocate General Opinion — AG Cápeta clarified that, according to CJEU case law, the GDPR did not impose an absolute ban on the disclosure of personal data from public authorities. The GDPR did, however, require a balancing between the purpose of such disclosures, and the rights and freedoms of data subjects. In particular, the disclosure of personal data regarding criminal convictions, required strict justification and clear legal safeguards, because of the sensitive nature of such data. In the case at hand, the AG conceded that the data disclosure pursued an important public interest (the protection of minors). So, the question was whether the amending law correctly balanced this interest against the right to data protection. The AG opined that the amending law failed to do so and exceeded what was strictly necessary to protect minors, for two reasons. First, the AG agreed with the Commission that the notion of "authorised persons" was too broad and unclearly defined under the amending law, even when the amending law was interpreted in light of domestic civil law. In this regard, the AG pointed to the CJEU case law on the access to personal data from national authorities: in order to satisfy the requirement of proportionality, national law that allowed for such access "must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards". The AG further opined that such criteria would also apply to access from private citizens, as in the case at hand. Second, the AG considered that requirements (ii) and (iii) (i.e.: the probable necessity of the disclosure, and the difficulty of otherwise accessing the data) were overly generic and were to be assessed by the authorized person themselves. The AG argued that such a self-declaratoty regime lent itself to abuse and deprived the disclosing body of any control over the necessity and proportionality of the disclosure. For this reason, the AG opined that the amending law failed to provide the required safeguards for data subjects. On these grounds, the AG opined that the amended law was disproportionate and violated Article 10 GDPR as well as Article 8(2) CFR. Holding — The court first noted that one of the objectives of the GDPR is to ensure a high level of protection of data subjects’ fundamental rights and freedoms, in accordance with Article 1 GDPR and Article 8(1) CFR. Therefore, any processing of personal data must be lawful, in accordance with Articles 5(1)(a) and 6(1) GDPR. In addition, any legal basis other than consent (Article 6(1)(a) GDPR) must be interpreted restrictively. The court then assessed whether the processing was lawful under Article 6(1)(e) and 86 GDPR. Article 6(1)(e) GDPR provides for a legal basis based on public interest or in the exercise of official authority vested in the controller. In the case of disclosing this data, Article 86 GDPR states that this may be done to reconcile public access to official documents with the right to the protection of personal data. The court stated that, in principle, the processing of data related to criminal convictions (including its disclosure) could be lawful under Article 6(1)(e) and 10 GDPR. However, Article 10 GDPR makes the processing subject to additional restrictions (for example, the processing must provide for appropriate safeguards). In addition, limits to the fundamental rights to privacy and data protection must respect the essence of the fundamental right and be proportionate, in accordance with Article 52(1) CFR. This is especially relevant in this case, as data related to criminal convictions is particularly sensitive and its processing can be a particularly serious interference with data subjects’ fundamental rights. The court followed the reasoning of the AG in stating that the protection of minors was an important public interest. However, the court considered the amending law incompatible with Article 10 GDPR. The law was not sufficiently precise, particularly in defining the concept of “authorised person”. The court considered that the processing was not limited to what is strictly necessary, as the circle of persons potentially entitled to submit a request was too broad. Finally, the court concurred with the AG, and stated that the amending law was not proportionate. This is because it relied on the person requesting the data to justify the need to access it. Therefore, the amending law did not provide for appropriate safeguards by relying on the self-declaration regarding the necessity and proportionality of accessing the data. The court concluded that the amending law did not meet the requirements under Article 10 GDPR, meaning it could not justify its processing under Article 6(1)(e) GDPR. With this, Hungary had failed to fulfil its obligations under Article 10 GDPR and Article 8(2) CFR. ### Amazon EU Sàrl, venant aux droits de Amazon Services Europe Sàrl v European Commission *Source: General Court, T-367/23, 2025-11-19 — https://overview.legal/posts/132131 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023TJ0367* Amazon EU Sàrl challenged the European Commission's decision designating Amazon Store as a very large online platform under Article 33(4) of the Digital Services Act (Regulation 2022/2065), raising pleas alleging the illegality of Articles 33(1), 38, and 39 of the regulation on grounds including violations of fundamental rights to privacy, freedom to conduct a business, property, equal treatment, and freedom of expression. The General Court (Seventh Chamber, Extended Composition) ruled on the admissibility of the plea challenging Article 33(1), finding that the application's scope was sufficiently clear and precise to permit assessment of its merits, thereby rejecting the Council's argument that the plea was inadmissible for lack of clarity. ### CJEU - C-473/12 - IPI *Source: Court of Justice of the European Union, 2013-11-07 — https://overview.legal/posts/158436 — original: https://gdprhub.eu/index.php?title=CJEU_-_C-473/12_-_IPI* Facts — The Belgian Professional Institute of Real Estate Agents (IPI) had used private detectives to collect information on a real estate company that allegedly breached regulatory rules. The admissibility of the private detectives’ evidence in court was questioned on the grounds that the company’s agents had not been informed that their personal data would be processed by third parties in accordance with Article 11(1) of the Data Protection Directive 95/46. IPI argued that the use of private detectives fell within the exception under Article 13(1)(d) of Directive 95/46, which permits the collection of data without consent for the prevention, investigation, detection and prosecution of breaches for regulated professions. Belgian law had specified exceptions for journalistic purposes, artistic or literary expression, public authorities exercising judicial police duties, police services and the European Centre for Missing and Sexually Abused Children. The Belgian Constitutional Court considered that the Belgian law did not strictly transpose exceptions comparable to Article 13 of Directive 95/46/EC. It referred three questions to the ECJ for clarification on the obligations for Member States to implement Article 13 in national law: Does Article 13(1)(d) of Directive 95/46 leave Member States free to choose whether or not to provide for an exception to the immediate obligation to inform under Article 11(1) to protect others’ rights and freedoms? Do professional activities of private detectives (governed by national law) come within an exception referred to in Article 13(1)(d) and (g) of Directive 95/46? If they do not, is Article 13(1)(d) and (g) of Directive 95/46 compatible with Article 6(3) TEU – specifically, with the principle of equality and non-discrimination? Holding — With regard to the first question, the Court ruled that Member States have the option, but not an obligation, to transpose the list of exceptions provided under Article 13 of the Data Protection Directive 95/46/EC. Article 13 permits Member States to adopt exemptions allowing the collection and processing of personal data without notifying the data subject in seven circumstances: To safeguard national security. For defence. For public security. For the prevention, investigation, detection and prosecution of criminal offenses or breaches of ethics for regulated professions. For an important economic or financial interests of a Member State. For monitoring, inspection or regulatory functions. For the protection of the data subject or the rights and freedoms of others. The CJEU based its interpretation on the emphasis on a high level of protection found in recitals 3, 8 and 10 of Directive 95/46. In provisions such as these, Directive 95/46's aim of harmonisation must be balanced against the applicability of the Directive's general language in specific situations and the need to afford Member States some flexibility in this regard. With regard to the second question, the CJEU considered that the activity of a private investigator on behalf of a regulated body – in this case, the IPI – falls within the scope of Article 13(1)(d) of Directive 95/46. Thus, if a Member State has chosen to implement an exception pursuant to Article 13(1)(d) of Directive 95/46, the professional body concerned and the private detectives acting on its behalf may rely on it. Accordingly, they need not inform the data subject pursuant to Article 10 and 11 of Directive 95/46. ### HvJ EU 9 januari 2025, C‑394/23 (Mousse). *Source: CJEU, 2025-01-09 — https://overview.legal/posts/50377 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0394* HvJ EU 9 januari 2025, C‑394/23 (Mousse). Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20 (Vyriausioji tarnybinės etikos komisija), maar dat had hier ook heel logisch geweest. ### European Commission v Hungary *Source: Court of Justice of the European Union, C-769/22, 2026-04-21 — https://overview.legal/posts/354142 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0769* The Court of Justice of the European Union (Full Court) ruled on whether Hungary's national legislation restricting content related to gender identity, gender reassignment, and homosexuality violated EU law, including the GDPR. The court held that Hungary failed to fulfil its obligations under multiple EU instruments—finding that provisions restricting access to information society services, commercial advertising, and audiovisual media services constituted unjustified restrictions under Directives 2000/31, 2006/123, and 2010/13, violated Articles 7, 11, and 21 of the Charter of Fundamental Rights (private life, expression, and non-discrimination), infringed Article 10 of the GDPR by processing criminal records data without a proper legal basis, and breached the EU values of human dignity, freedom, and non-discrimination enshrined in Article 2 TEU. ### Meta Platforms v noyb *Source: CJEU, C-252/21, 2023-01-12 — https://overview.legal/posts/51484 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252* GDPR consent requirements and lead supervisory authority mechanism. ### Google Spain SL and Google Inc. v AEPD and Mario Costeja González *Source: CJEU, C-131/12, 2014-05-13 — https://overview.legal/posts/51472 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0131&ref=51472* Established the right to be forgotten (delisting). Search engines are data controllers. ### GC and Others v CNIL *Source: CJEU, C-136/17, 2019-09-24 — https://overview.legal/posts/51475 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0136* Conditions for delisting sensitive data from search results. ### Maximillian Schrems v Data Protection Commissioner *Source: CJEU, C-362/14, 2015-10-06 — https://overview.legal/posts/51471 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362&ref=51471* Invalidated Safe Harbor adequacy decision. National supervisory authorities can examine adequacy decisions. ### Privacy International v Secretary of State *Source: CJEU, C-623/17, 2020-10-06 — https://overview.legal/posts/51481 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0623* General and indiscriminate transmission of traffic data to security agencies incompatible with EU law. ### Norwegian Supreme Court: Legelisten.no has Art. 6(1)(f) legal basis for doctor reviews *Source: Norges Høyesterett, 2021-12-07 — https://overview.legal/posts/125647 — original: https://gdprhub.eu/index.php?title=Norges_Høyesterett_-_2021-2403-A* Facts — In 2012, a company "Legelisten.no AS" launched a website where people could submit anonymous reviews of healthcare personnel. From the same year, the Norwegian DPA Datatilsynet received multiple complaints from affected individuals. In one case in 2015, the DPA held that Legelisten did not have a legal basis for processing personal data related to the website reviews and, further, that Legelisten had to offer an opt-out arrangement for healthcare personnel not wanting their personal data published on the website. The decision was appealed to the Norwegian Privacy Appeals Board, who overturned parts of the DPA's decision, importantly relating to the (lack of) legal basis and the opt-out arrangement. Following this, the Norwegian Medical Association brought an action to the Norwegian courts, claiming that the website had no legal basis as per Article 6(1)(f) GDPR for registering and publishing subjective user reviews of healthcare personnel. Holding — After a balancing of the legitimate interests safeguarded by the website operator Legelisten against the interests of the healthcare personnel, the Supreme Court agreed with the Privacy Appeal Board's decision and found that Legelisten had a legal basis for the processing as per Article 6(1)(f) GDPR. The Court emphasised that Legelisten.no is an important source for the general public to acquire information about healthcare providers. The measures taken to limit privacy concerns also satisfied what could reasonably be expected. Thus, the DPA's initial decision was overturned and the appeal appeal against the Privacy Appeals Board's decision was rejected. ### French Conseil d'État strikes down GendNotes police app decree for excessive special data *Source: CE, 2021-04-13 — https://overview.legal/posts/125663 — original: https://gdprhub.eu/index.php?title=CE_-_439360* Facts — In February 2020 the French minister of the interior enacted the Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile note-taking application" (Décret n° 2020-151 du 20 février 2020 portant autorisation d'un traitement automatisé de données à caractère personnel dénommé «application mobile de prise de notes» (GendNotes)). The app should be used on the occasion of preventive actions, investigations or interventions necessary for the exercise of judicial or administrative police missions. Among the data that can be collected is information relating to alleged racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health or sexual activities or orientation. A group of human rights organisations filed a complaint with the French Constitutional Court. Dispute — Is the "GendNotes" App of the French national police force (Gendarmerie nationale) unlawfully processing special category personal data? Holding — The French Highest Administrative Court held that the decree infringed Article 4 of the Law of 6 January 1978, implementing GDPR in France, the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and Article 8 CFR, as it excessively infringed upon the right to respect for private life and the correlative right to protection of personal data, without providing appropriate safeguards for their protection in terms of the purpose of the processing and the nature of the data collected, as well as excessive data retention period, data sharing and data security. The Court discussed whether the decree violated Article 4 (a) GDPR, Article 4 (b) GDPR, Article 4 (c) GDPR, and Article 4 (e) GDPR and Article 9 GDPR. According to the Court, the processing of data did not comply with the principle of purpose limitation, as data is collected for future investigations or proceedings. However, the Court did not find a violation on the collect of special category data, given the fact that the decree establishes that this data can only be processed in case of "absolute necessity". Additionally, the Court noted that, even if the decree provides a limitation for the storage of the data, in practice this can be ignored, as the data may be used in different or further investigations, that would impede its erasure. However, they found that the decree was lawful in this regard, given that it clearly stated a retention period of 3 months to 1 year. Taken the above-mentioned into account, the French Highest Administrative Court decided that the data processed by the French national police force can no longer be used "in other data processing, in particular by means of a pre-information system". Therefore, the Court held: In Article 1° of the decree, the words "in other data processing, in particular by means of a pre-information system," are cancelled out. The State will pay €3,000 to every claimant. The rest of the application is rejected. The allowance to collect special category data is not overruled, as the Court argues that the decree only allows it when it is "absolutely necessary". This decision will be notified to the claimants: the Ligue des droits de l'homme, the associations Homosexualités et socialismes and Internet Society France, the associations Mousse, Stop Homophobie, Adheos and Familles A, the association AIDES, the Syndicat de la magistrature, the Syndicat des avocats de France, the Conseil national des barreaux, the Quadrature du Net and the International League against Racism and Anti-Semitism, the Prime Minister and the Minister of the Interior. ## Guidance ### EDPB comments on European Commission's Guidelines on Art. 28 DSA *Source: EDPB, edpb-comments-europeancommission-article-28-dsa-en, 2025-06-25 — https://overview.legal/posts/50981 — original: https://www.edpb.europa.eu/documents/other-policy-document/edpb-comments-on-european-commissions-guidelines-on-art-28-dsa_en* EDPB, EDPB comments on European Commission's Guidelines on Art. 28 DSA, 2025. ### Guidelines 3/2025 on the interplay between the DSA and the GDPR *Source: EDPB, edpb-guidelines-202503-interplay-dsa-gdpr-v1-en, 2026-09-17 — https://overview.legal/posts/51175 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en* G uidelines 3/2025 on the interplay between the DSA and the GDPR Version 2.0 Adopted on 17 September 2026 1 | Adopted Version history Version Date Adoption information Version 2.0 17 September 2026 Adoption of the Guidelines after public consultation Version 1.1 12 September 2025 Minor corrections in the executive summary Version 1.0 11 September 2025 Adoption of the Guidelines for public consultation 3 | Adopted of special categories of data to present advertisements based on profiling.… ### EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse *Source: EDPB, edpb-edps-joint-opinion-042022-on-the-proposal-for-a-regulation-of-en, 2022-07-28 — https://overview.legal/posts/125917 — original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-042022-on-the-proposal-for-a-regulation-of_en* Adopted 2 EDPB-EDPS Joint Opinion 0 4/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse Adopted on 28 July 2022 Adopted 3 Adopted 5 Executive Summary On 11 May 2022, the European Commission published a Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse. The Proposal would impose qualified obligations on providers of hosting… ### Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) *Source: EDPB, edpb-guidelines-on-transparency, 2018-04-11 — https://overview.legal/posts/38076 — original: https://www.edpb.europa.eu/system/files/2023-09/wp260rev01_en.pdf* The Article 29 Data Protection Working Party issued these guidelines (WP260 rev.01), adopted on 29 November 2017 and last revised on 11 April 2018, to provide interpretive and practical guidance on the transparency requirements under the GDPR (Articles 12–14). The document addresses the form, timing, content, and modalities of information provided to data subjects, including issues such as plain language, layered privacy notices, information for children, and exceptions to the obligation to provide information. No fines or enforcement actions are imposed, as this is a guidance document rather than an enforcement decision. ### Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms *Source: EDPB, opinion-082024-on-valid-consent-in-the-context-of-consent-or-en, 2024-04-17 — https://overview.legal/posts/125765 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-082024-on-valid-consent-in-the-context-of-consent-or_en* A dopted 1 Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms Adopted on 17 April 2024 Adopted 2 Adopted 3 Executive summary The Dutch, Norwegian and German (Hamburg) supervisory authorities requested the EDPB to issue an opinion on the question of under which circumstances and conditions ’consent or pay’ models relating to behavioural advertising can be implemented by large online platforms in a way that constitutes valid, and in… ### Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them *Source: EDPB, edpb-guidelines-on-deceptive-design-patterns-in-social-media-platform-interfaces-how-to-recognise, 2023-02-24 — https://overview.legal/posts/38056 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-032022-on-deceptive-design-patterns-in-social-media-platform_en* These Guidelines offer practical recommendations to social media providers as controllers of social media, designers and users of social media platforms on how to assess and avoid so-called 'deceptive design patterns' in social media interfaces that infringe on GDPR requirements. To this end, the EDPB recommends that controllers make use of interdisciplinary teams, consisting, among others, of designers, data protection officers and decision-makers. It is important to note ... ### Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects *Source: EDPB, guidelines-22019-on-the-processing-of-personal-data-under-article-61b-gdpr-in-en, 2019-10-16 — https://overview.legal/posts/126202 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-22019-on-the-processing-of-personal-data-under-article-61b-gdpr-in_en* 1 Adopted Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects Version 2.0 8 October 2019 2 Adopted Version history Version 2.0 8 October 2019 Adoption of the Guidelines after public consultation Version 1.0 9 April 2019 Adoption of the Guidelines for publication consultation 3 Adopted 1 Part 1 – Introduction ................................ ................................… ### Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1) *Source: EDPB, edpb-guidelines-on-the-criteria-of-the-right-to-be-forgotten-in-the-search-engines-cases-under-th, 2020-07-07 — https://overview.legal/posts/38070 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-52019-on-the-criteria-of-the-right-to-be-forgotten-in-the-search_en* The European Data Protection Board (EDPB) issued these guidelines to clarify the criteria and grounds for exercising the right to erasure (right to be forgotten) specifically in the context of search engine cases under the GDPR. The document details the six grounds under Article 17(1) that allow data subjects to request delisting, alongside the relevant exceptions, such as the right to freedom of expression and information. As a guidance instrument, it does not impose administrative fines but instead aims to harmonize how search engine providers handle and balance delisting requests across the EU. ## Enforcement decisions ### AEPD fines El Español for publishing video of minor assailant without anonymization *Source: AEPD (Spain), 2026-09-16 — https://overview.legal/posts/184546 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS-00304-2024* Facts — El León de El Español Publicaciones, S.A., the controller, operates the Spanish digital newspaper „El Español“. It published an article concerning an assault and embedded a video showing both the victim and the assailant, who was a minor. Their image and voice were disclosed without applying techniques to prevent their direct or indirect identification. The controller also published the video through its accounts on two social media platforms. The DPA initiated preliminary investigations ex officio after becoming aware of the dissemination of the video. It ordered the controller, as a precautionary measure, to immediately remove the content from the relevant URLs. The controller subsequently informed the DPA that it had removed the article and prevented access through both external links and its internal search engine. The DPA verified that the video was no longer available through the identified web addresses. The DPA subsequently initiated disciplinary proceedings for a potential infringement of Article 5(1)(c) GDPR. The controller argued that the incident was newsworthy, the video had already gone viral and the publication was protected by freedom of information. It also claimed that the video was necessary to understand the news and that the assailant’s status as a minor should be assessed in light of his apparent maturity and awareness that he was being recorded. Holding — The DPA found that the controller violated the data minimisation principle under Article 5(1)(c) GDPR. The DPA clarified that the proceedings did not concern whether the incident was newsworthy or whether the controller could report on it. Instead, the relevant question was whether publishing the identifiable image and voice of the individuals was necessary and proportionate for that purpose. According to the DPA, freedom of information and the right to data protection are not absolute. Under Article 85 GDPR, they must be reconciled on a case-by-case basis. In this case, the controller could have informed the public about the incident while using technical measures, such as blurring the individuals’ faces or altering the audio, to prevent their identification. Showing the individuals in an identifiable manner was therefore not necessary to achieve the journalistic purpose. The DPA also rejected the argument that the previous virality of the video justified its republication. Each additional publication contributed to the further dissemination of the personal data and amplified the risks and adverse effects for the data subjects. Similarly, the fact that the affected individuals had not submitted a complaint did not prevent the DPA from exercising its supervisory powers ex officio. The DPA gave particular weight to the vulnerability of the victim and to the fact that the assailant was a minor. It held that the best interests and enhanced protection of minors had to be taken into account irrespective of the minor’s alleged maturity or awareness of being recorded. The age at which a minor may consent under Article 7 LOPDGDD did not reduce the controller’s obligation to assess whether the disclosure was necessary. The DPA further noted that, pursuant to Articles 5(2) and 25 GDPR, the controller was required to assess and document the risks of the processing and implement data protection by design and by default. As a professional media organisation regularly processing personal data, the controller was expected to apply a particularly high standard of diligence and to consider less intrusive methods of publication. When determining the sanction, the DPA considered the unrestricted online dissemination of the data, the potentially unlimited audience, the controller’s negligence, the sensitive circumstances surrounding the victim and the minor, and the impact of the infringement on the rights of a minor. It therefore imposed a €20,000 fine. Under Article 58(2)(d) GDPR, the DPA also ordered the controller to demonstrate, within three months after the decision became enforceable, that it had adopted measures to prevent the excessive publication or dissemination of personal data, particularly data concerning minors. It made the earlier precautionary measure definitive and required the permanent removal of the content, while allowing its restricted preservation where necessary as evidence for administrative, police or judicial proceedings. ### AEPD: RFEF requiring school certificate in addition to residence proof for minor *Source: AEPD (Spain), 2026-10-07 — https://overview.legal/posts/449833 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS/00339/2024* Facts — The father of the data subject, who is a minor, submitted a complaint after registering his daughter with the Royal Spanish Soccer Federation (RFEF, the controller). In order to apply, the controller requested the father to provide, amongst other documentation, a certificate of municipal registration and a school certificate (as supporting documentation), to verify the required uninterrupted five-year residence in Spain. According to the FIFA guidelines for submitting applications for minors, for first time applications the player must have lived continuously for five years in the country where they are being registered. FIFA’s guidelines require a residence certificate and as an alternative the school certificate of the minor. The controller explained that this procedure and the requested documents is a result of a long-established procedure by FIFA, which required both the residence certificate and the minors school certificate. Holding — The DPA found the requirement by FIFA of proof of residence for a player whose registration is sought through a certificate of residence, a logical and reasonable exception to the prohibition of international transfers of minors. Nonetheless, according to the controller the school transcripts were required as supporting documentation, which implied that they are required in addition to the certificate of municipal registration. The DPA held that requesting and requiring both documents violated the principle of data minimisation, and deemed the requesting of one of the two documents sufficient to prove uninterrupted residence. This was considered in addition to the fact that FIFA’s guidelines explicitly state the alternative nature of the documents. Therefore, DPA held that the controller required, for player registration, documentation from the play which contained personal data exceeding what is officially required by FIFA. The DPA emphasised the importance of data protection for minors and how such a requirement involves more processing than necessary which could potentially expose minors to unnecessary risks. In light of the foregoing, the DPA fined the controller €100,000 for the violation of the data minimisation principle, enshrined in Article 5(1)(c) GDPR. ### Garante per la protezione dei dati personali (Italy) - 487/2026 *Source: Garante per la protezione dei dati personali (Italy), 2026-07-03 — https://overview.legal/posts/108999 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_487/2026* Facts — Character Technologies, Inc (the controller) is a company established in the US that operates the site Character.AI. Character.AI is a generative AI service that allows users to create and interact through chat with virtual characters that already exist or are created at the moment. The controller made this available to data subjects in Italian, and had a specific version for children. The DPA initiated an ex-officio investigation in 2024. The DPA requested information related to the LLM models used by the controller, the provision of the service, and data transfers. The controller provided a DPIA, and stated that it introduced an age verification system that required data subjects to register their date of birth. In 2025, the controller announced it would prevent underage data subjects from accessing open chat rooms, and would begin processing personal data of data subjects in the EEA to post-train its generative AI systems. Holding — The DPA first clarified that the GDPR is applicable even if the controller was established outside of the EU, in accordance with Article 3(2) GDPR. The DPA took into account the fact that the service was available in Italy and in Italian, as well as the privacy policy also applying to EEA residents. Given that the controller did not have an establishment in the EU, the one-stop-shop mechanism did not apply and the DPA was competent. The DPA found a violation of Articles 12(1), 13(1) and (2), and 14(1) and (2) GDPR. The DPA considered that the controller had failed to meet its information obligations. In terms of the controller’s privacy policy, the DPA considered that the controller had not provided data subjects’ with clear information regarding its processing activities, data transfers, or data subjects’ right to object and opt out. In addition, the controller failed to designate a representative in the EU, and included misleading and inaccurate statements on the processing of personal data for purposes of post-training LLMs for the service. However, the DPA also took into consideration that the controller had updated its privacy policy to make its language clearer. In terms of its pre-training activities, the DPA stated that the controller had failed to provide adequate information and therefore violated Articles 14(1) and (2) GDPR. The DPA dismissed the controller’s argument that it did not have the obligation to provide this information due to the data being collected by third parties from open sources. The DPA stated that the controller had the obligation to verify whether personal data was present. In addition, the exemption under Article 14(5)(b) GDPR does not exempt the controller from having the obligation to implement appropriate measures to protect data subjects’ rights. However, the DPA did not find a violation of Articles 21(1) and (4). The DPA referred to the EDPB opinion on processing personal data in relation to AI systems. The EDPB recommended controllers to adopt measures for data subjects to exercise their rights, including providing the option to provide data subjects with the option to object unconditionally before the processing takes place. The DPA considered that this opinion went beyond the literal wording of Articles 14 and 21 GDPR. This interpretation could not, in the DPA’s view, be interpreted retroactively to the controller’s processing activities. The DPA found a violation of Articles 24(1) and 25(2) GDPR. The DPA considered that the controller had failed to implement adequate technical and organisational measures to verify data subjects’ age. During its investigations, the DPA found that the controller’s age verification systems were not effective, as they allowed data subjects’ to access the service even after self declaring to be younger than the minimum age limit set by the controller. The DPA also found that the accounts were set to public by default. Therefore, the controller had failed to implement appropriate measures to protect underage data subjects, even if the GDPR does not set a harmonised and binding standard in relation to age verification. The DPA also found a violation of Articles 5(2) and 35 GDPR. Under Article 5(2) GDPR, the controller has the obligation to proactively demonstrate compliance with the GDPR. The DPA stated that a key tool to do this is through data protection impact assessments (DPIAs). Controllers are obliged to carry out a DPIA under Article 35 GDPR if the processing is likely to result in a high to the rights and freedoms of data subjects. The controller failed to do a DPIA on time in relation to providing the service to underage data subjects, as well as in relation to its processing activities for the purpose of pre-training its LLM. The DPA stated that the controller should have done this before launching the service in 2022, as the processing activities had a presumed high risk to freedoms and rights of data subjects (e.g. the use of large scale processing or processing data of vulnerable data subjects). However, the DPA acknowledged that the controller progressively improved its compliance by doing a (late) DPIA and updating it. Finally, the DPA found a violation of Article 27(1) GDPR, as the controller belatedly designated a representative in the EU. The DPA stated that the exemption under Article 27(2) GDPR did not apply. The DPA fined the controller €158,000. The DPA also ordered the controller to bring its privacy policy and storage of personal data for purposes of pre-training its LLM into compliance with the GDPR. The DPA also ordered the controller to implement effective age verification mechanisms. ### Italy Garante: TikTok switch to legitimate interest for personalized ads violates *Source: Garante per la protezione dei dati personali (Italy), 2022-07-07 — https://overview.legal/posts/122853 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_9788429* Facts — Social media platform TikTok (the controller) provided personalized advertising to its users (the data subjects) on the legal basis of consent (Article 6(1)(a) GDPR). In June 2022, the controller announced that a new privacy policy would come into effect on 13 July 2022. Under the new policy, the controller would only serve personalize advertising to users over 18 years of age and on the legal basis of the legitimate interest of the controller (Article 6(1)(f) GDPR). The Italian DPA started an investigation and found that personalized advertisement would likely involve the use of cookies or other tracking mechanisms. Holding — Regarding the competence of the Italian DPA, it should be noted that the Irish DPA is the lead supervisory authority for the controller’s data processing activities under the GDPR's "one-stop-shop" mechanism. The Italian DPA acknowledged the Irish DPA’s position in its decision. However, the Italian DPA held the ePrivacy Directive to be applicable to the processing of cookies by the controller and held itself competent to enforce the Directive. The DPA referenced Recital 173 GDPR and EDPB Opinion 05/2020 on this point. The DPA held that the controller’s new privacy policy violated Article 5(3) ePrivacy Directive 2002/58/EC. The Article only allows the controller to process cookies and use similar tracking mechanisms with the user’s consent . For this reason, legitimate interest under Article 6(1)(f) GDPR is not a valid legal basis for the processing of cookies. The Italian DPA also held that the controller violated Article 122 of the Italian Privacy Code (d. lgs. 30 giugno 2003, n. 196). Article 122 is a direct transposition of Article 5(3) ePrivacy Directive. The violation of the Code constitutes a direct consequence of the violation of the Directive. The DPA issued a warning against the controller. ### Website providing legal information: Insufficient fulfilment of information obligations *Source: Belgian Data Protection Authority (APD), 2019-12-17 — https://overview.legal/posts/46284 — original: https://www.enforcementtracker.com/ETid-169* An operator of a website for legal news had the privacy statement only available in English, although it was also addressed to a Dutch and French speaking audience. In addition, the first version of the privacy statement was not easily accessible and did not mention the legal basis for data processing under the GDPR. Furthermore, with reference to the ECJ ruling on Planet 49, it was determined that effective consent was required for the use of Google Analytics. ### SOPHIE ET VOILA, S.L: Insufficient legal basis for data processing *Source: Spanish Data Protection Authority (aepd), 2022-09-16 — https://overview.legal/posts/47507 — original: https://www.enforcementtracker.com/ETid-1392* The Spanish DPA has imposed a fine of EUR 10,000 on SOPHIE ET VOILA, S.L..The wedding dress company had published a picture of a customer in a wedding dress on its Instagram account without the customer's consent. For this reason, the DPA determined that the processing of the customer's personal data was unlawful. ### CNIL (France) - SAN-2021-023 *Source: CNIL (France), 2021-12-31 — https://overview.legal/posts/125662 — original: https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2021-023* Facts — Google LLC is a subsidiary owned wholly by Alphabet Inc. Google Ireland Limited ('GIL') "presents itself" as the headquarters for the Google group's operations in the EEA and Switzerland. In March 2020 the French DPA (CNIL) carried out an online inspection of the website "google.fr" in the context of a previous procedure against Google LLC and GIL. The purpose of this inspection was to verify their compliance with the Loi 'Informatique et Libertés', and in particular with Article 82 thereof. This resulted in this decision, that Google appealed. Following this decision, the CNIL received more complaints about the methods of refusing cookies from the website "google.fr". It therefore reopened the case and launched a new investigation. Holding — On the request for a stay of proceedings — First, the companies requested that per Article 66 of the CNIL's rules of procedure, the CNIL stay these proceedings pending the decision to be handed down by the Council of State in the appeal against its first decision against Google and pending the conclusions of the new EDPB working group on cookies. The CNIL rejected this request, as it considered that there were no acceptable grounds for staying the proceedings. On the complaint alleging breach of the ne bis in idem principle — Second, the companies argued that the restricted formation cannot rule again on the same facts as those concerned by deliberations No. SAN-2020-012 and No. SAN-2021-004, without violating the ne bis in idem principle, as it considered the parties and material facts in those case to be identical. The CNIL responded that the two procedures do not concern the same facts, as these cases included an injunction relating to the information of users on the purposes of cookies subject to consent and on the means available to refuse cookies, whereas the one at hand concerned the refusal methods themselves, and not only the information. It also highlighted that this procedure concerned both the websites "google.fr" and "youtube.com", whereas the previous procedure concerned only the website "google.fr". As such, the CNIL rejected the complaint based on the violation of the ne bis in idem principle. On the competence of the CNIL — The material competence of the CNIL and the non-application of the "one-stop shop" mechanism provided for by the GDPR — The processing operations investigated by the CNIL in this case were carried out in the context of the provision of publicly available electronic communications services via a public electronic communications network offered within the European Union. As such, it considered they fell within the material scope of the ePrivacy Directive. Article 5(3) of that directive was transposed into domestic law through Article 82 of the French Data Protection Act. The CNIL therefore considered itself materially competent under these provisions to monitor and sanction the access or registration of information by companies in the terminals of users of the "google.fr" and "youtube.com" websites in France. The companies contested the jurisdiction of the CNIL. They argued they should be subject to the procedural framework provided for by the GDPR, or the 'one-stop shop' mechanism, under which the Irish DPA (DPC) would be the lead supervisory authority (LSA). They considered that the absence of specific rules on determining the competence of the supervisory authority in the case of cross-border processing operations falling within the scope of the ePrivacy Directive should be replaced by the application of the procedural framework provided for by the GDPR. Interestingly, the companies further argued that the EDPB's announcement regarding the creation of a working group on cookie banners in response to the significant number of complaints recently filed with supervisory authorities by noyb was evidence that the EDPB considers that cookie-related breaches fall directly within the scope of the GDPR and, therefore, the 'one-stop shop' mechanism. First, the CNIL responded that a distinction should be made between, on the one hand, the operations consisting in depositing and reading a cookie on a user's terminal and, on the other hand, the subsequent use that is made of the data generated by these cookies ("subsequent/further processing"). The former are governed by special rules, set by the ePrivacy Directive - in this case, by its Article 5(3) - and transposed into national law, the latter is governed by the GDPR and, as such, may be subject to the "one-stop-shop" mechanism in the event that they are cross-border. This case only concerned the read and write operations carried out on the terminal of the user located in France visiting the Google Search and YouTube search engines. Second, it held that where a processing operation may fall within both the material scope of the ePrivacy Directive and the material scope of the GDPR, reference should be made to the relevant provisions of the two texts which provide for their articulation. The rule laid down in Article 5(3) of the ePrivacy Directive, according to which reading and/or writing operations must systematically be subject to the prior consent of the user, after having been informed, constitutes a special rule with regard to the GDPR, since it prohibits the legal bases mentioned in Article 6 GDPR from being invoked in order to be able to lawfully carry them out. The control of this rule is therefore a matter for the special control and sanction mechanism provided for by the ePrivacy Directive, and not for the data protection authorities and the EDPB under the GDPR. It stated that the French legislator entrusted this task to the CNIL. Thus, the "one-stop shop" mechanism provided for by the GDPR could not be applied to the processing operations covered by the Directive, as the companies claimed. Third, the CNIL confirmed that the 'one-stop-shop' mechanism is not applicable to facts that are materially covered by the ePrivacy Directive, by referring to the Opinion No 5/2019 of the EDPB and the CJEU decision C-645/19 (Facebook Belgium) upholding this opinion. Finally, the CNIL stated that the creation of a working group on cookies in response to the large number of complaints filed by noyb did not mean that the EDPB considered that all violations related to cookies necessarily fall within the scope of the GDPR. Furthermore, pursuant to Article 70(1)(u) GDPR, one of the EDPS's tasks is to promote cooperation and the effective bilateral and multilateral exchange of information and best practices between supervisory authorities. The purpose of the working party was thus only to exchange views on the analysis of the numerous complaints lodged by noyb . Thus, the CNIL held that the "one-stop shop" mechanism provided for by the GDPR was not applicable to the present procedure and that it was competent to control and sanction processing operations consisting of reading and/or writing information in the terminal of users located in France implemented by companies falling within the scope of the "ePrivacy" Directive, provided that they fall within its territorial jurisdiction. On the territorial jurisdiction of the CNIL — The CNIL considered it was territorially competent under Article 3 GDPR since the processing that was the subject of the present procedure, namely consisting of accessing or recording information on the terminals of users residing in France when using the Google Search engine and YouTube, in particular for advertising purposes, was carried out within the "framework of the activities" of the company Google France, which constituted the "establishment" of the Google group in France. In response, Google argued that its establishment in the EU was located in Ireland. The CNIL considered a range of CJEU case law (included but not limited to Google Spain C-131/12, Weltimmo C-230/14) and its findings in the previous decision SAN-2020-012, which pointed towards a broad interpretation of 'establishment' and 'in the context of the activities' and rejected this argument. As such, it held that French law was applicable and that it was materially and territorially competent to exercise its powers, including the power to impose sanctions on processing operations falling within the scope of the ePrivacy Directive. The determination of the controller — The CNIL held that Google LLC and Google Ireland Limited jointly determined the purposes and means of the processing consisting of accessing or recording information in the terminal of users residing in France when using the Google Search engine and YouTube. On the failure to comply with the obligations relating to cookies — The CNIL finally assessed whether the companies had complied with Article 82 of the French Data Protection Act. It noted that, in order to give consent to the reading and/or writing of information on their terminal, users visiting the home page of the sites "google.fr" and "youtube.com" only had to click on the "I accept" button on the pop-up window, which made the window disappear and allowed them to continue browsing. On the other hand, the users going to these same home pages and wishing to refuse cookies had to click on the "Personalise" button of this first window, which took them to an interface on both the "google.fr" and "youtube.com" sites, offering them the choice of activating or deactivating cookies, on which they had the possibility of carrying out various actions. The investigator for the CNIL considered that making the mechanism for refusing cookies more complex than the one for accepting them amounted to discouraging users from refusing cookies and encouraging them to opt for the "I accept" button. This led to their conclusion that the methods of refusing cookies implemented by the companies on the sites "google.fr" and "youtube.com" did not comply with the provisions of Article 82 of the French Data Protection Act, as clarified by the enhanced consent requirements set out in the GDPR. In response, the companies argued that neither the ePrivacy Directive, nor the RGPD, nor Article 82 of the Data Protection Act provided that the action of refusing cookies should be as simple as accepting them. "They [also added] that, for many years, the CNIL itself had not deduced this principle even though the regulations in question had remained unchanged since the RGPD came into force. They point out that the CNIL cannot, through its guidelines and recommendations, introduce new requirements relating to the refusal of consent and consider that it is up to each data controller to choose the most appropriate method of obtaining consent." The CNIL rejected this, restating its powers, which include drawing up and publishing guidelines, recommendations or benchmarks intended to facilitate the compliance of personal data processing with the texts relating to the protection of personal data. It was in this context the DPA had issued its previous deliberations which provided guidance to stakeholders on the implementation of concrete measures to ensure compliance with these provisions, so that they implemented these measures or measures of equivalent effect. Indeed, the guidelines' main purpose "is to recall and clarify the law applicable to the reading and/or writing of information [...] in the subscriber's or user's electronic communications terminal equipment, and in particular to the use of cookies". It thus considered that it had not created any new obligations for the actors in its recommendation, but has limited itself to illustrating in concrete terms how Article 82 of the law should be applied. The position according to which it must be as simple for users to refuse cookies as to consent to them was even endorsed by the French Council of State in CE, 19 June 2020, No. 434684, pt 15. Further, the CNIL highlighted that users residing in France who visit the Google Search engine and/or YouTube had to perform a single action to accept cookies, whereas they had to perform five to refuse them. It was therefore not as simple to refuse cookies as to accept them. It referred to studies that showed that having a "refuse all" button on the first-level consent interface led to a decrease in the rate of consent to accept cookies. It therefore considered that making the mechanism for refusing cookies more complex than the one for accepting them actually discourages users from refusing cookies and encourages them to prefer the ease of the "accept all" button. "In view of the above, the [CNIL held] that there [had] been a breach of the provisions of Article 82 of the [French] Data Protection Act, interpreted in the light of the GDPR, insofar as the companies [did] not provide users located in France, on the websites "google.fr" and "youtube.com", with a means of refusing to read and/or write information to their terminal that is as simple as the one provided for accepting its use. Thus, the CNIL: imposed a fine of €90,000,000 on Google LLC for failing to comply with Article 82 of the French Data Protection Act, imposed a fine of €60,000,000 on Google Ireland Limited for failing to comply with Article 82 of the French Data Protection Act, ordered Google LLC and Google Ireland Limited to modify, on the websites "google.fr" and "youtube.com", the methods for obtaining the consent of users located in France to the reading and/or writing of information in their terminal, by offering them a means of refusing these operations that is as simple as the mechanism provided for their acceptance, in order to guarantee the freedom of their consent; attached to the injunction a penalty of 100,000 euros (one hundred thousand euros) per day of delay at the end of a period of three months following notification of this decision, with proof of compliance to be sent to the restricted panel within this period; made its decision public on the CNIL website and on the Légifrance website, which will no longer identify the companies by name at the end of a two-year period from the date of its publication. ### NAIH (Hungary) - NAIH-11443-3/2026 *Source: NAIH (Hungary), 2026-07-22 — https://overview.legal/posts/156361 — original: https://gdprhub.eu/index.php?title=NAIH_(Hungary)_-_NAIH-11443-3/2026* Facts — The DPA initiated an investigation into the GDPR compliance of an online store (the controller) processing the data of its customers (the data subjects) in April 2025. The processing activities in question included, inter alia, cookies, registration, billing, shipping, consumer complaint, and processing of orders. The privacy notice of the company operating the online store had been in force unchanged from May 2018 to May 2025, and the period under investigation extended from 1 January 2020 to 27 June 2025. Holding — The DPA held that the controller had violated Articles 12(1), 13(1)(c), (d) and (f), and 13(2)(a) GDPR and issued the controller a fine of HUF 2,000,000 (€5,500). In addition, the DPA ordered the controller to bring its data processing operations into compliance with the GDPR and to amend the content of its privacy notice. First, the DPA found an infringement of Article 12(1) GDPR: the structure of the privacy notice was confusing and difficult to follow. The privacy notice also contained incomplete, incorrect, and unnecessary information as well as repetitive details. Based on this, the DPA concluded that the controller had failed to provide data subjects with information regarding the processing of personal data that was sufficiently concise, transparent, intelligible and easily accessible. Second, the DPA held that the controller had also violated Articles 13(1)(c), (d) and (f) GDPR by failing to specify a legal basis for certain processing operations such as the use of cookies, not specifying its legitimate interests when relying on Article 6(1)(f) GDPR as a legal basis, and not providing detailed information regarding the safeguards ensuring the lawfulness of data transfers to the United States. Finally, the DPA found a violation of Article 13(2)(a) GDPR as the controller had also failed to provide the data subjects information on the period for which the personal data processed would be stored. ## Recent developments ### When No ID Means No Internet: Age Verification and the Right to Access Information *Source: Electronic Frontier Foundation, 2026-10-08 — https://overview.legal/posts/595644 — original: https://www.eff.org/deeplinks/2026/10/when-no-id-means-no-internet-age-verification-and-right-access-information* This post was co-authored by Sheila B. Lalwani, a doctorate student and recent COMPASS Fellow hosted by EFF. Age verification proposals are often presented as a simple tradeoff: sacrifice a little privacy to better safeguard children online. But that framing overlooks a more fundamental question. What happens to people who cannot verify their age at all? This is particularly a problem when users are required to prove their age with identity documents. Age-related restrictions are developing quic ### The KIDS Act will make the internet less safe *Source: European Digital Rights, 2026-09-30 — https://overview.legal/posts/449815 — original: https://edri.org/our-work/the-kids-act-will-make-the-internet-less-safe/* On 16 September, the European Commission presented the KIDS ACT, its plan for making online experiences safer for young people. Far from being a move to lead the EU towards better digital environments, this move is a missed opportunity to address the root cause of why online platforms are harmful to children – and everyone else. This blog analyse the proposal’s shortcomings. ### EU Kids Act Won't Keep the Internet Accountable and Trustworthy *Source: Electronic Frontier Foundation, 2026-09-21 — https://overview.legal/posts/354289 — original: https://www.eff.org/deeplinks/2026/09/eu-kids-act-wont-keep-internet-accountable-and-trustworthy* The EU Commission draft law to restrict young people’s access to the internet that it presented last week will come at a high cost: it will put online services behind age gates, expand the use of intrusive age verification, and undermine the privacy of all users. The EU Kids Act aims to protect children from risks associated with social media, video games, and AI systems by introducing age-based access rules, safety requirements, and stronger enforcement and oversight measures. It presents itsel ### Governor Newsom Signs Student-Backed Digital Literacy Bills Alongside Misguided Bans *Source: Electronic Frontier Foundation, 2026-09-11 — https://overview.legal/posts/353949 — original: https://www.eff.org/deeplinks/2026/09/governor-newsom-signs-student-backed-digital-literacy-bills-alongside-misguided* Governor Newsom signed a package of 12 bills yesterday aimed at “protecting children” online. One of them was AB 1709, which EFF has opposed this legislative session and serves as a functional ban on young people under 16 using social media. However, EFF supported two of the bills signed into law, AB 2071 and AB 2298, which require that children learn critical digital literacy and cybersecurity topics. The bills are an affirmative and constitutional way for the state to address valid concerns ab ### Meta's $17 Billion Settlement is a Bad Deal for Teens and All Social Media Users *Source: Electronic Frontier Foundation, 2026-09-01 — https://overview.legal/posts/353632 — original: https://www.eff.org/deeplinks/2026/09/metas-17-billion-settlement-bad-deal-teens-and-all-social-media-users* Meta’s settlement with 52 state attorneys general is a bad deal for all internet users, and especially for teens. That’s what we said the day the settlement was announced. In this post, we go through the Settlement’s provisions in detail and explain why that is so, including how: The Settlement embeds age assurance technology and age-gates into Meta’s social media products and requires all users—minors and adults—to undergo a rights-threatening age estimation process The Settlement places severe ## Literature ### Legal concerns regarding the protection of minors’ personal data in compliance with national legislation and GDPR requirements *Source: ScienceRise: Juridical Science, 2023-09-13 — https://overview.legal/posts/132533 — original: https://doi.org/10.15587/2523-4153.2023.286647* The article highlights the legal concerns surrounding the protection of minors' personal data. The writers have conducted an original study of the sources regulating civil and labor relations in the field of acquiring and using personal data. The expansion and use of information technology and online communications can potentially lead to the violation of personal rights by the owners of personal data, both in workplace settings and in the daily lives of ordinary residents. The purpose of this a ### GDPR ve KVKK Bakımından Çocukların Kişisel Verilerinin Korunması ve Konuya İlişkin Kurul Kararının Değerlendirilmesi (Protecting Personal Data Of Children From Point Of GDPR and Personal Data Protection Law and Review Of Assize) *Source: SSRN Electronic Journal, 2021-01-01 — https://overview.legal/posts/132476 — original: https://doi.org/10.2139/ssrn.3792410* ### Children and the Artificial Intelligence Act: Is the EU Legislator Doing Enough? *Source: European Law Blog, 2023-09-12 — https://overview.legal/posts/132444 — original: https://doi.org/10.21428/9885764c.799b4d2d* This post argues that because children are often not mentioned explicitly in the positions taken by the Parliament, the Council and the Commission, it is not clear what effect the AI Act will have for children in AI contexts. ### GDPR Implementation Series ∙ Netherlands: The GDPR Implementation Act *Source: European Data Protection Law Review, 2018-01-01 — https://overview.legal/posts/132478 — original: https://doi.org/10.21552/edpl/2018/3/15* ### GDPR Implementation Series ∙ Malta: An Overview of the GDPR Implementation *Source: European Data Protection Law Review, 2020-01-01 — https://overview.legal/posts/132480 — original: https://doi.org/10.21552/edpl/2020/4/15* ## Related topics - **Personal Data** — https://overview.legal/topics/personal-data Information relating to identified or identifiable natural persons - **Processing** — https://overview.legal/topics/processing Any operation performed on personal data - **Controllers** — https://overview.legal/topics/controllers Entities that determine purposes and means of processing - **Consent** — https://overview.legal/topics/consent Freely given, specific, informed indication of data subject wishes - **Public Authority** — https://overview.legal/topics/public-authority Government bodies and their data processing activities - **Law Enforcement** — https://overview.legal/topics/law-enforcement Processing for law enforcement purposes --- Generated by overview.legal · https://overview.legal/topics/minors · 2026-10-13