noyb reports €2 billion in GDPR fines and key court rulings in 2025

What happened

In 2025 noyb documented €2 billion in GDPR administrative fines, including €325 million against Google and €750 000 against Conde Nast, and highlighted two EU court rulings requiring investigations of Meta and disclosure of its user data. The report also notes new complaints, a cease‑and‑desist to Meta over AI training, and preparation for a collective redress case against Austrian credit agency CRIF.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The report shows escalating enforcement and judicial activity around GDPR compliance across major tech firms in Europe.
• It relates to GDPR. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Inventory AI or automated decision systems in scope and their assessments.
4. Review age assurance and protections for minors' data.