DPA case TSV/12992/2025 – Complaint Upheld (Finland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A user of a social media platform complained after their request to stop direct marketing was not handled properly. The authority agreed that the platform failed to provide a clear response but decided not to take further action. This case highlights the importance of clear communication regarding user requests.
What happened
The social media platform did not adequately respond to a user's objection to direct marketing.
Who was affected
The user of the social media platform was affected by the inadequate response to their request.
What the authority found
The authority ruled that the platform did not fulfill its obligation to provide a clear reason for not acting on the user's request.
Why this matters
This case serves as a reminder for companies to ensure they handle user requests properly and communicate clearly about data processing practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A user of a social media platform (the data subject) sent the platform (the controller) an email where they objected to the processing of their personal data for direct marketing purposes. The controller replied with instructions on how to delete data stored in the social media app and opt out of targeted marketing in the app's internal settings. Following three further emails where the data subject repeated this request, the data subject lodged a complaint against the controller in October 2025. According to the data subject, the controller had violated Articles 12 and 21 GDPR by referring the request to a customer service representative instead of the data protection officer and providing irrelevant and misleading information. The controller stated that its customer service had provided the data subject information on the basis for targeted advertising, changing advertising settings, deleting data from the app, and how to reduce targeted messages by changing account settings. However, the controller pointed out that it does not target advertising at the data subject at all because the data subject is under 18 years of age and resides in an EEA country. According to the controller, all decisions regarding the purposes and means of processing personal data were made in the United States. The DPA held that the controller had infringed Article 12(4) GDPR by failing to provide the data subject with a reason for not taking action in response to the data subject’s objection to direct marketing. However, the DPA did not consider it necessary to exercise corrective powers in the case at issue. First, the DPA held that the GDPR was applicable to the present case as the processing at issue concerned a data subject located in Finland and was related to the offering of social media services to Finnish data subjects. Second, the DPA pointed out that the controller had not processed the data subject's personal data for direct marketing purposes, as the data subject had been u
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case TSV/12992/2025 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case TSV/12992/2025 - Finland (2026). Retrieved from cookiefines.eu
Last updated: