Poste Italiane S.p.a. – €12,501,000 Fine (Italy, 2026)

€12,501,000Garante per la protezione dei dati personali17 April 2026Italy
final
ePrivacy
Fine

Poste Italiane was fined over 12 million euros for improperly accessing and processing users' personal data without proper consent. This case shows that companies must follow strict rules when handling personal data, especially regarding user consent. It serves as a warning to businesses about the serious consequences of violating data protection laws.

What happened

Poste Italiane unlawfully accessed and processed personal data on users' devices for antifraud measures without proper consent.

Who was affected

Users whose personal data was accessed and processed by Poste Italiane.

What the authority found

The authority found that Poste Italiane violated multiple GDPR rules related to data processing and user consent.

Why this matters

This significant fine illustrates the heavy penalties companies can face for failing to comply with data protection regulations. It highlights the need for businesses to ensure they have valid consent before processing personal data.

GDPR Articles Cited

AI-verified

Art. 6(GDPR)
Art. 13(GDPR)
Art. 25(GDPR)
Art. 32(GDPR)
Art. 35(GDPR)
Art. 5(1)(a) GDPR
Art. 5(1)(e) GDPR
Art. 6(1)(f) GDPR
View original scraped data
Art. 5(1)(e) GDPR
Art. 5(1)(a) GDPR
Art. 6(GDPR)
Art. 6(1)(f) GDPR
Art. 13(GDPR)
Art. 25(GDPR)
Art. 32(GDPR)
Art. 35(GDPR)

Original data from scraper before AI verification against source document.

National Law Articles

AI-identified

Article 122 Italian Code transposing Article 5(3) e-Privacy Directive 2002/58

Entities Involved

Poste Italiane S.p.a.
PostePay S.p.a.
Source verified 28 April 2026
articles corrected
national law identified
amount discrepancy
entity split needed
scope corrected
date discrepancy
Italy enforcementGarante per la protezione dei dati personali actionsAll Poste Italiane S.p.a. actions
Full Legal Summary
Detailed

The case involves unlawful access and processing of personal data on users' devices for antifraud measures, not directly related to cookie consent or tracking issues.

Violations (2)

Third-Party Cookies Without Consent
critical

Third-party tracking cookies or scripts are loaded without obtaining prior user consent.

Art. 13, 14 GDPR

Misleading Banner Messaging
critical

The cookie banner uses misleading language to trick or pressure users into accepting cookies (dark patterns).

Art. 7 GDPR

Related Enforcement Actions (2)

Other enforcement actions involving Poste Italiane S.p.a. in IT

Fine
Oct 2022· Garante per la protezione dei dati personali

The Italian DPA (Garante) fined Poste Italiane S.p.a. EUR 10,000 for failing to respond to the data subject's request for access to their data in a ti...

€10K
Fine
Apr 2026· Garante per la protezione dei dati personali

The Italian DPA has imposed a fine of EUR 6,624,000 on Poste Italiane S.p.a. The controller operated a banking application and used the ThreatMetrix f...

€6.6M
Current
Apr 2026

Fine

€12.5M

Similar Cases

Enforcement actions with similar violations

unknown (claimant)

2021 · DPA OLGLinz

Legal Person

2023 · Úřad pro ochranu osobních údajů

€4K

CNIL

2019 · Court of Justice of the European Union

Details

Fine Date

17 April 2026

Authority

Garante per la protezione dei dati personali

Fine Amount

€12,501,000

GDPRhub ID

gdprhub-9958

Sources

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. Poste Italiane S.p.a. - Italy (2026). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: