European Commission – Complaint Upheld (European Union, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The European Commission faced a complaint for running a targeted advertising campaign that allegedly violated data protection rules. This is important because it raises concerns about how public institutions handle personal data in their marketing efforts. Transparency in data processing is crucial for building trust.
What happened
A complaint was upheld against the European Commission for unlawfully processing personal data during a targeted advertising campaign.
Who was affected
A user who felt their personal data was misused in the Commission's advertising campaign.
What the authority found
The European Data Protection Supervisor found that the Commission did not comply with data protection laws while conducting the campaign.
Why this matters
This case highlights the need for public institutions to adhere to strict data protection standards, just like private companies. It serves as a warning for all organizations about the importance of lawful data processing.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The campaign From the 15 to the 28 September 2023, the Commission ran a targeted advertising campaign on X focussing on users in eight Member States. The campaign aimed at communicating the proposal for a Regulation laying down rules to fight and prevent child sexual abuse, the so-called “Chat Control Regulation”. The Commission, here the controller, carried out the campaign through an external contractor. For its targeting strategy, the Commission defined certain inclusion and exclusion keywords and accounts affiliated with political interests. The exclusion words selected by the Commission showed to exclude terms that correlate with a "Eurosceptic" political opinion such as “Viktor Orban”. The inclusion words then correlated to “pro-EU” sentiments and included particular parties and politicians. This input was then used through X’s keyword targeting and look-alike strategy allowing the targeting of people with interests similar to the keywords and accounts (proxy data). Specifically, the campaign targeted X users speaking Dutch, who were from the Netherlands and were older than 18. The complaint On the 16 November 2023, noyb on behalf of a data subject filed a complaint with the European Data Protection Supervisor against the Commission alleging unlawful data processing for targeted advertising. The data subject based its complaint on the provisions of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Regulation 2018/1725] (EU-GDPR) which is data protection legislation applicable to data processing operations conducted by EU-institution. The data subject alleged that under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Regulation 2018/1725] the Commission had processed special categories of his data under Article 10(2) in breach of the principle of lawfulness under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Article 4(1)(a)]. The data subject laid out that this practice encompasses pro
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (4)
Other enforcement actions involving European Commission in EU
Complaint Upheld
Details
About this data
Cite as: Cookie Fines. European Commission - European Union (2024). Retrieved from cookiefines.eu
Last updated: