an Amazon subsidiary (AA) – Court Ruling (Luxembourg, 2025)

Court Ruling
Commission Nationale pour la Protection des Données18 March 2025Luxembourg
final
ePrivacy
Court Ruling

An Amazon subsidiary in Luxembourg processed personal data for ads without getting proper consent. They also didn’t provide clear information about how they used cookies. This matters because it shows that companies must be transparent and get permission before using people's data.

What happened

Amazon processed personal data for interest-based advertising without proper consent.

Who was affected

Website visitors whose data was used for targeted advertising by Amazon.

What the authority found

The court found that Amazon lacked a valid legal basis for processing personal data, violating GDPR requirements for consent and transparency.

Why this matters

This ruling emphasizes the importance of clear consent for data processing. Companies should ensure they have proper consent mechanisms in place, especially for advertising.

GDPR Articles Cited

AI-verified

Art. 11(GDPR)
Art. 12(GDPR)
Art. 13(GDPR)
Art. 14(GDPR)
Art. 15(GDPR)
Art. 16(GDPR)
Art. 17(GDPR)
Art. 21(GDPR)
Art. 6(1) GDPR
View original scraped data
Art. 6(1) GDPR
Art. 11(GDPR)
Art. 12(GDPR)
Art. 13(GDPR)
Art. 14(GDPR)
Art. 15(GDPR)
Art. 16(GDPR)
Art. 17(GDPR)
Art. 21(GDPR)

Original data from scraper before AI verification against source document.

Decision AuthorityTA Luxembourg
Reviewed AuthorityCNPD (Luxembourg)
Source verified 22 March 2026
amount discrepancy
date discrepancy
authority corrected
Luxembourg enforcementCommission Nationale pour la Protection des Données actionsAll an Amazon subsidiary (AA) actions
Full Legal Summary
Detailed

Amazon processed personal data for interest-based advertising without proper consent and failed to provide clear information or an easy opt-out mechanism.

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Violations (4)

Third-Party Cookies Without Consent
critical

Third-party tracking cookies or scripts are loaded without obtaining prior user consent.

Art. 13, 14 GDPR

Unclear Cookie Information
high

The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.

Art. 12, 13 GDPR

No Granular Cookie Choice
high

Users cannot select or deselect individual cookie categories; consent is presented as all-or-nothing.

Art. 4(11) GDPR

Cannot Withdraw Cookie Consent
critical

No accessible mechanism exists for users to withdraw previously given cookie consent.

Art. 7(3) GDPR

Related Cases (0)

No other cases found for an Amazon subsidiary (AA) in LU

This is the only recorded case for this entity in this jurisdiction.

Similar Cases

Enforcement actions with similar violations

unknown (claimant)

2021 · DPA OLGLinz

CNIL

2019 · Court of Justice of the European Union

Details

Ruling Date

18 March 2025

Authority

Commission Nationale pour la Protection des Données

Sources

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified
Cookie relevance: 80%

Cite as: Cookie Fines. an Amazon subsidiary (AA) - Luxembourg (2025). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: