AP (The Netherlands) – Order (European Union, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The European Data Protection Board ordered the Irish Data Protection Authority to revise its decision about WhatsApp's data practices. This matters because it highlights the importance of ensuring that companies like WhatsApp follow data protection rules properly.
What happened
The EDPB instructed the Irish DPA to find more violations by WhatsApp regarding user data handling.
Who was affected
WhatsApp users and non-users whose data may have been improperly processed.
What the authority found
The EDPB found that the Irish DPA needed to identify additional GDPR violations by WhatsApp.
Why this matters
This decision shows that regulatory bodies are actively ensuring compliance with data protection rules. Companies using WhatsApp's services should be aware of their responsibilities in handling user data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The EDPB adopted a binding decision in the context of a dispute opposing the Irish DPA (the DPC) to several other DPAs. This dispute found its origin in a decision drafted by the DPC regarding a number of GDPR infringements by WhatsApp Ireland. The EDPB, after analysing the objections raised by the other concerned DPAs, instructed the DPC to amend its draft decision. In particular, the EDPB ordered the DPC to find additional infringements of the GDPR, and to increase the fine to be imposed on WhatsApp, among others. WhatsApp Ireland Ltd. (hereafter, WhatsApp) is a EU-based company of the Facebook group. Its services to consumers include text and voice messages, voice and video calls, as well as images, documents and locations sharing via a mobile or desktop application. WhatsApp processes both the personal data of its users (i.e. individuals who have created an account with WhatsApp) as well as the personal data of non-users. Users’ personal data include, among others, a cellular mobile telephone number which is required to sign up. Non-users’ personal data include data collected by WhatsApp when accessing the address book of its users. WhatsApp processing activities are described to data subjects in a privacy policy accessible online. On 10 December 2018, the Irish DPA (DPC) commenced an “own-volition inquiry” to determine whether WhatsApp Ireland was complying with its obligations pursuant to Articles 12, 13 and 14 GDPR (mandatory information to be provided to data subjects). Although the DPC specified that such inquiry did not concern any specific complaint or request, it admitted that it was prompted by the common theme running across a number of complaints received from data subjects (both users and non-users of WhatsApp services), as well as by a mutual assistance request from the German DPA. After the inquiry, the DPC published a draft decision (the Draft Decision) in its capacity as lead supervisory authority under Article 56 GDPR. This Draft Decision was
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for AP (The Netherlands) in EU
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. AP (The Netherlands) - European Union (2021). Retrieved from cookiefines.eu
Last updated: