GDPR
General Data Protection Regulation (EU) 2016/679
Recent developments
-
noyb files GDPR complaints against Scale AI's Outlier platform for invasive tracking and biometric verification
The complaints highlight potential EU data‑protection breaches in AI‑training platform labor practices. The privacy NGO noyb, together with partners, has lodged five GDPR complaints against Scale AI in France, Italy, the Netherlands and Austria. The complaints allege that Outlier places third‑party trackers on workers' devices and forces biometric verification without a legal basis, violating data‑minimisation and biometric data rules. No response to access requests is also claimed.
Source: noyb. GDPR in the regulations library.
-
AI Hallucination Goes to Court: Global Mapping of Emerging Legal Issues
The post shows how existing legal frameworks are being stretched to address the harms of AI‑generated misinformation, signalling emerging obligations for AI providers and users. A Future of Privacy Forum blog post maps 11 recent judicial and regulatory matters worldwide where AI‑generated false statements have become legally salient. The article highlights cases in China, Germany, Canada, the United States and the EU, showing how courts and regulators are applying existing doctrines such as defamation, unfair competition, misrepresentation and data‑protection accuracy to AI hallucinations.
Source: Future of Privacy Forum. GDPR in the regulations library.
-
noyb files GDPR complaints (C078, C097) over AI-generated inaccurate personal data
These complaints highlight how AI hallucinations challenge GDPR's accuracy and correction rights for individuals. The privacy NGO noyb has lodged two complaints (C078 and C097) with Data Protection Authorities alleging that ChatGPT generated false personal data, including an incorrect date of birth and a fabricated criminal narrative. The complaints argue that OpenAI cannot adequately correct or erase the inaccurate outputs, testing GDPR obligations on accuracy, rectification and erasure. The cases remain pending as of the publication date.
Case C078, C097.
Source: Future of Privacy Forum. GDPR in the regulations library.
-
German court grants preliminary injunction against Google for AI-generated search summary linking publishers to fraud
The ruling highlights that providers may be liable for inaccurate AI‑generated content presented as their own, shaping future AI governance and privacy obligations. The Munich I Regional Court issued a preliminary injunction in the Google AI Overview proceedings (26 O 869/26). The court found that the AI-generated search summary, which linked two publishers to fraud and other dubious practices, was treated as Google's own content. The decision emphasizes the provider’s responsibility for the authority created by AI‑generated statements.
Case 26 O 869/26.
Source: Future of Privacy Forum. GDPR in the regulations library.
-
EU Council approves amendment to GDPR allowing unrestricted AI data processing
The amendment could override fundamental privacy rights by permitting AI firms to use all personal data with minimal safeguards. EU Member States, through the Council, approved a change to the GDPR that would make processing personal data "in the context of AI" automatically lawful. The amendment (Article 88bis) would let AI companies use any personal data without consent, relying on a broad legitimate interest. The proposal still requires negotiation with the European Parliament before becoming law.
Effective: not stated.
Source: noyb. GDPR in the regulations library.
-
EDPB adopts Guidelines 3/2025 on DSA‑GDPR interplay
The new EDPB guidance helps platforms align DSA duties with GDPR privacy requirements. On 17 September 2026 the European Data Protection Board adopted Guidelines 3/2025 addressing how the Digital Services Act interacts with the EU General Data Protection Regulation. The guidance clarifies the application of GDPR obligations for services covered by the DSA.
Effective: 17 September 2026.
Source: Hunton Privacy & Cybersecurity Law Blog. GDPR in the regulations library.
-
Berlin DPA finds microtargeting by major German parties illegal
The rulings signal that political parties in Germany may not use personal political data for targeted ads without consent, impacting future campaign practices. The Berlin Data Protection Authority issued decisions that the SPD, Greens, Die LINKE and CDU unlawfully used political microtargeting in the 2021 election. The authority ruled there was no legal basis, such as consent, for processing personal political interests for advertising. The AfD case remains pending.
Source: noyb. GDPR in the regulations library.
-
Norwegian DPA fines Xandr €8.6M for unlawful processing of Grindr users' data
The fine highlights the strict liability of joint controllers for obtaining valid consent when handling sensitive personal data. The Norwegian Data Protection Authority issued a final decision on 2 October 2026 imposing an administrative fine of EUR 8.6 million on Xandr Inc. for processing personal and special category data of Grindr users without valid consent. Xandr was found to be a joint controller in real‑time bidding, relying on invalid consent from Grindr for sexual orientation data.
Penalty: administrative fine of EUR 8 600 000.
Source: European Data Protection Board news. GDPR in the regulations library.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws