noyb, the Vienna-based privacy enforcement group chaired by Max Schrems, today published its Annual Report 2025. The 35-page document shows the organisation filed 21 new complaints during the year, held 460 pending cases at the end of December, and ran on €1,558,856 in income against €1,278,225.14 in expenses. Its legal work, according to noyb, has produced administrative fines totalling €2 billion since 2018, "although many of these have not yet been collected due to pending appeals."

In Short

noyb is a small non-profit in Vienna that files legal complaints when it thinks big companies are breaking Europe's privacy law, and today it published a report on what it did in 2025. It filed fewer new complaints than in earlier years, because it spent a lot of time fighting an EU plan to rewrite parts of the privacy law, and it is now preparing its first group lawsuit, which could let thousands of people claim damages together. For companies that buy and sell ads using personal data, the report is a list of the cases still waiting for a decision, and the group says more lawsuits are coming in 2026.

A year spent partly in Brussels

The headline number for anyone tracking enforcement pressure on advertising and data businesses is 21. That is how many new complaints noyb filed across European jurisdictions in 2025. The figure sits well below the organisation's earlier pace: in its report on 2023, noyb said it had filed more than 40 new complaints in that year.

The report does not present the lower number as a strategic choice. Instead, it points to the European Commission's Digital Omnibus package. "As the only non-profit organisation working exclusively on the GDPR for years, noyb had to take a more active role in the policy space," Schrems wrote in the preface. "This has limited our resources for other matters, but seems to have been crucial for our mission and, so far, rather impactful."

The preface goes further than the public announcement in its assessment of the Commission. "Officially, this legislative package should have only included small, technical changes to several laws to 'simplify' EU law," it reads. "In reality, the EU Commission has secretly set in motion a potentially massive reform of the GDPR that would wreck core principles, including the core definition of what constitutes personal data."

Schrems also described the drafting quality as so poor that the package "would probably make the law even more complex rather than 'simpler'," and called the Commission's move from supporting baseline regulation to favouring deregulation "equally alarming for the digital rights sector." He added a note of legal confidence that matters for anyone planning around the eventual text: because most of the GDPR rests on Article 8 of the Charter of Fundamental Rights, noyb expects existing protections to survive, "even if this means that noyb may have to engage in more litigation to annul non-compliant EU secondary law in the future."

What noyb objected to in the Omnibus

Section 3.3.1 of the report sets out four objections to the Commission proposal, published in November 2025. PPC Land had reported on leaked drafts of the GDPR changes before publication.

The first concerns the definition of personal data. noyb says the Commission would replace an objective test with a subjective one, so that if a specific company claims it cannot, or does not currently aim to, identify a person, the GDPR would cease to apply to that company. According to noyb, "this would apply, for example, to many data brokers and the advertising industry, which handle large amounts of personal data."

The second is AI training. The proposal would allow AI companies to rely on legitimate interest for training and operating systems with personal data, which noyb says would mean "an otherwise illegal processing could suddenly become legal, simply because it is done using AI."

The third limits the right of access to "data protection purposes," which the report says would let employers reject access requests filed during labour disputes, and would affect journalists and researchers in the same way. The fourth introduces a broad definition of "scientific research" that noyb argues profit-oriented actors could use to escape purpose limitation and information obligations.

In response, noyb joined 126 other civil society organisations on two open letters to the Commission, produced a video analysis and published a 70-page report with suggestions for lawmakers. The report closes the section by noting that the Omnibus "is far from being signed into law."

That has remained true since the report was finalised. The PDF metadata shows it was produced on July 20, 2026, nearly three months before today's release. Since then, the Council has moved on its own version: a September 3 Council compromise leaked by noyb would allow AI development under legitimate interest without the Commission's unconditional right to object. And yesterday, noyb published a ranking of more than 1,000 Omnibus amendments in the European Parliament, finding that the EPP group had tabled 248 that it classified as weakening privacy.

The money: €1.56m in, €1.28m out

The finance section, on pages 30 and 31, gives the clearest picture so far of what it costs to run a litigation operation of this scale. Total income in 2025 was €1,558,856.00. Expenses came to €1,278,225.14. The difference, €280,630.86, equals roughly 18% of income. The report does not say what the surplus will fund.

Income splits into six lines:

  • Single donations from individuals and SMEs: €655,875.04, about 42.1% of the total.
  • Supporting member fees: €505,574.64, or 32.4%.
  • Project financing and institutional funding from the Austrian Ministry for Social Affairs, Sub3, DFF and Luminate: €327,339.34, or 21.0%.
  • Institutional member fees: €45,000.00, made up of €25,000 from the City of Vienna and €20,000 from the Austrian Chamber of Labor.
  • Other income, such as speaking fees and interest: €17,066.98.
  • Sponsoring: €8,000.

Three quarters of the money, in other words, came from individual people, either as one-off donations or as membership fees. No corporate sponsor of any size appears in the breakdown.

The expense side is dominated by staff. Personnel costs and ancillary employment costs reached €1,020,795.57, or 79.9% of all spending. Office supplies and operational costs, including rent, electricity and insurance, accounted for €125,312.64. The traineeship programme cost €46,923.94, covering allowances, housing and transport for trainees. Investment in furniture, hardware and software ran to €20,672.83, external non-legal staff and services to €11,258.30, and communication and advertising to just €4,021.19.

The most striking line is project costs, which the report defines as "fees for external lawyers, court fees, and alike." That figure was €49,240.67, or 3.9% of spending. Spread across 21 new complaints, it averages about €2,345 each, though the line also covers court costs on the 460 pending matters. The number reflects the model: most of noyb's work goes through data protection authorities, where filing a complaint costs little, and the legal drafting is done by staff lawyers rather than outside counsel.

Set against the €2 billion fines figure, the comparison is stark. The total fines attributed to noyb's work since 2018 are roughly 1,565 times the organisation's entire 2025 spending. That ratio overstates noyb's direct contribution, since authorities, not noyb, impose and defend fines, and the report concedes that many have not been collected. But it explains why the group has become a fixed reference point in European privacy enforcement, as PPC Land's coverage of the Xandr case decided by Norway's Datatilsynet showed this week.

A small discrepancy in the member count

The "noyb in numbers" page lists 5,400 supporting members as of December 2025, and the public announcement repeats that figure. The legend under the income chart, however, describes the €505,574.64 as "fees from 5200 Supporting Members." The 2023 report cited more than 5,200 supporting members, which suggests the chart legend may carry an older figure. Depending on which count is used, the average annual fee per supporting member works out to €93.62 or €97.23.

A second minor inconsistency appears in the communications figures. Schrems' preface refers to social media posts "on seven different platforms," while the numbers page reports more than 89,000 followers "on 6 media platforms."

The organisation behind the numbers

noyb reported a team of 20 people at the end of 2025, plus 11 legal trainees from seven countries who joined for three to six months during the year. The legal team lists eight data protection lawyers, Schrems as CEO and head of the legal team, and Ursula Pachl as head of collective redress. Monika Riegler is operations director.

The executive board of Schrems, Petra Leupold, head of litigation at the Austrian consumer association VKI, and Christof Tschohl, founder of epicenter.works, serves on a pro bono basis. The general assembly has four institutional members and 17 individuals, among them Johnny Ryan, Paul Nemitz, Johannes Caspar, Jan Philipp Albrecht and Shoshana Zuboff.

Other figures from the numbers page: 41 press releases, 12 newsletters and member updates, more than 50 cases "closed, withdrawn or lost by authorities," and more than 14,000 subscribers to the GDPRtoday newsletter. GDPRhub, the free decision database, held more than 4,600 summaries, maintained with the help of more than 300 volunteer country reporters.

Collective redress: the CRIF test case

The most consequential item for 2026 may be the least advanced one. noyb has been a qualified entity under the EU Collective Redress Directive in both Austria and Ireland since 2024; PPC Land reported the Irish approval of October 11, 2024 and the Austrian designation of December 2, 2024 at the time. That status lets noyb seek injunctions and redress measures, which the report describes as "a European version of a class action lawsuit, where thousands or millions of users could be represented."

In 2025 the group started preparing its first case, against the Austrian credit agency CRIF. The facts in the report are specific. In June 2025, noyb asked people living in Austria to donate their CRIF data. More than 2,400 people took part. A first evaluation, published in September 2025, covered more than 40,000 queries and more than 28,000 transmitted scores.

According to noyb, that evaluation showed companies including Erste Bank, Verbund and Drei evaluating customers with CRIF data, and T-Mobile, the online retailer Otto and the insurer Allianz appearing to supply customer data to CRIF. It also found that men were rated significantly worse than women and that people in cities received lower scores than those in the countryside. The report says that for most people, the score "is based on just a few pieces of information, such as address, age and gender."

noyb is working with a professor of financial mathematics to test whether the scores are statistically reliable, with results "expected in the first half of 2026." Only after that will it decide whether to sue.

The wording around this project is not consistent across the documents. The preface says noyb "launched our first collective redress project." Section 3 calls it "preparations for our first potential collective redress case." Today's announcement says noyb "began preparations for our first first collective redress case." No collective redress lawsuit was filed in 2025.

The CRIF project is also not the only one in motion. In 2026, noyb moved against the German credit agency SCHUFA, sending a cease-and-desist letter over an archive of historical records that it says may cover up to 69 million people, and announcing an injunction suit after SCHUFA did not sign by the September 9, 2026 deadline. noyb says in the report that it sees collective redress "as the primary new approach to enforcement and intend[s] to expand in this area."

The Meta AI damages calculation

The report's AI section contains a number that will interest anyone at Meta's European legal department. noyb is "currently assessing" a redress action over Meta's use of European users' data for AI training. "If the non-material damage were only € 500 per user, it could amount to around €200 billion for the roughly 400 million monthly active Meta users in Europe," the report says.

The figure has grown. When noyb published its Gallup survey of 1,000 German Meta users in August 2025, PPC Land's coverage of the finding that only 7% wanted their data used for AI carried a hypothetical maximum of about €137 billion, based on roughly 274 million users at the same €500 per head. The per-user figure is unchanged; the user base assumption has risen by more than 120 million. The report does not explain the change.

noyb had sent Meta a cease-and-desist letter on May 14, 2025, before Meta began training on EU user data that month. The report says Meta "is pressing ahead and ignoring the fundamental right to data protection of all affected Europeans," and argues that because Meta distributes models such as Llama as open-source software, it "can hardly call back or update a model once it is published."

Cases that touch advertising directly

Many of the 2025 complaints and decisions in the report bear on advertising technology, consent and tracking. Taken together, they show where the pressure points sit.

The French data protection authority CNIL fined Google €325 million in September 2025 over advertising emails placed in Gmail inboxes without consent, and over cookie refusal being made too difficult during Gmail account setup until October 2023. According to the report, noyb had filed the underlying complaint more than three years earlier.

The CNIL also fined Condé Nast €750,000 over cookies on Vanity Fair's French site. The report dates the decision to November 27, 2025, which PPC Land's coverage identified as the publication date; the restricted committee adopted it on November 20. The complaint dated to December 2019, when noyb also targeted CDiscount and Allocine. According to noyb's original data-flow analysis, CDiscount sent "fake consent" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375. The CNIL found that Condé Nast placed cookies before obtaining consent, failed to explain the purpose of supposedly "necessary" cookies, and offered ineffective refusal and withdrawal mechanisms. The report does not mention any outcome in the CDiscount or Allocine cases.

Pay or Okay

noyb published two pieces of research on Pay or Okay models in 2025. A survey found that roughly two in ten people agree to data collection when asked openly, about nine in ten choose "consent" when faced with paying instead, and seven in ten pick a third option of "advertising, but no tracking" when offered.

The companion report argued that the economic case for the model is weak. According to noyb, digital advertising makes up at best 10% of European press revenue, and only about 5% comes from processing personal data for advertising. Citing academic research, it says publishers earn €0.24 per user per month from tracking, while the Pay option generates €3.24. Pay or Okay increases "cookie banner related income" by 16.4%, which noyb calculates would raise overall press income by just 0.82%. PPC Land covered those figures when the report appeared, under the headline of websites achieving "North Korean consent rates".

Two court tracks continue. In Austria, the Federal Administrative Court ruled in August 2025 that DerStandard had not obtained valid consent, while allowing an appeal to the Supreme Administrative Court because the issue is novel. The report says a referral to the Court of Justice of the European Union is "very likely." DerStandard now offers granular choices in its banner. In Germany, the complainant against faz.net and t-online.de sued the Hesse and North Rhine-Westphalia authorities for inaction after almost four years without a decision on the merits. The report says the North Rhine-Westphalia authority issued "a 12-page decision that it cannot decide yet." Both suits are pending.

The report also notes that the European Data Protection Board is drafting guidelines on Pay or Okay, with publication "currently expected sometime in summer 2026." Since the report was finalised on July 20, 2026, that window has largely passed without the report recording an outcome.

App tracking and sensitive data

The complaint closest to programmatic advertising involves TikTok, the mobile measurement company AppsFlyer and Grindr. A user's access request showed that his activity on Grindr reached TikTok, which the report says happened "likely via the Israeli tracking company AppsFlyer." Because Grindr use allows inferences about sexual orientation, noyb argues the data falls under Article 9 GDPR as special category data. TikTok initially withheld the information and only disclosed it after repeated requests, including details of which apps the user opened and what he did inside them, such as adding a product to a shopping cart.

noyb filed two complaints with the Austrian authority, one against TikTok over the incomplete access response and one against all three companies over the sharing itself. The report dates the filings to December 17, 2025. PPC Land's coverage at the time, under the headline Your dating app activity is TikTok's business now, reported a filing date of December 9, 2025. The two dates cannot both be correct, and the report does not reconcile them.

WetterOnline is a second example. According to the report, the German weather app shared user data with hundreds of third parties for advertising, and in early 2025 this included precise location data that could reveal home, workplace or a visit to a military base. That data ended up on marketplaces where it was offered for sale. WetterOnline refused an access request, citing disproportionate effort. noyb's complaint to the North Rhine-Westphalia authority remains pending.

Transfers to China

On January 17, 2025, noyb filed complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi over transfers of European data to China. The report counts six complaints in five countries. noyb argues that because China has no adequacy decision and Chinese law places no limit on government access, no company can guarantee an equivalent level of protection through standard contractual clauses. It asked the authorities to suspend the transfers under Article 58(2)(j).

Follow-up complaints on July 17, 2025 targeted AliExpress, TikTok and WeChat for failing access requests. According to noyb, TikTok provided partial data "in an unstructured form that was impossible to understand," AliExpress provided "a broken file that could be opened only once," and WeChat ignored the request. All nine complaints are pending.

AI, biometrics and gaming

Beyond Meta, the report lists three AI-related complaints.

A complaint filed in June 2025 with the Austrian authority targets Bumble's AI Icebreakers feature, introduced in December 2023 in Bumble for Friends and powered by OpenAI's ChatGPT. noyb argues Bumble fed profile data into the system without consent while showing a banner that suggested consent, and actually relied on legitimate interest. It is pending.

On March 20, 2025, noyb filed a complaint with Norway's Datatilsynet on behalf of Arve Hjalmar Holmen, whom ChatGPT described as a convicted child murderer. The fabricated story included real details: the number and gender of his children and his home town. The case has since moved to the Irish Data Protection Commission, which leads on OpenAI under the one-stop-shop mechanism. It is noyb's second complaint against OpenAI over inaccurate output, after one in April 2024 involving a public figure's date of birth.

The Lithuanian authority, after receiving noyb's complaint against Whitebridge AI, opened its own investigation and cross-border proceedings. Under Lithuanian law, a complaint that coincides with an inspection is not examined separately, so the complaint itself was discontinued. Whitebridge sells "reputation reports" compiled from scraped data, some of it AI-generated, and sells them to the people they describe while refusing access requests.

On facial recognition, noyb took a different route. Clearview AI has faced fines of roughly €100 million from the French, Greek, Italian and Dutch authorities, none of which it challenged and none of which, according to noyb, have been enforced. noyb therefore filed a criminal complaint with Austrian prosecutors under section 63 of Austria's Data Protection Act, which the report says could expose executives to jail time "in particular if traveling to Europe."

noyb also filed its first complaint against a video game company. Ubisoft, publisher of Assassin's Creed, Far Cry and Prince of Persia, requires an internet connection to launch single-player games, which allows it to collect data on when a game is started, how long it is played and when it is closed. The report says the complaint was filed with the Austrian authority but is now "pending with the French data protection authority," which the report does not explain; the most likely reason is a transfer to the lead authority for a French-headquartered company, but that is an inference.

Enforcement that did not happen

The report's tone on regulators is harsher than in previous years. Schrems wrote of "increasing political pressure on DPAs to interpret the GDPR in an (even more) business friendly way" and of "open interference with (theoretically) independent authorities." He also wrote that "many courts are happy if they don't have to deal with facts around digital matters and the GDPR, and employ increasingly aggressive arguments to reject cases."

The data supports at least part of that. A noyb analysis covering 2018 to 2023 found that only 1.3% of cases before data protection authorities ended in a fine. Slovakia led with 6.84%, followed by Bulgaria at 4.19%, Cyprus at 3.12%, Greece at 2.65% and Croatia at 2.54%. At the bottom sat the Netherlands at 0.03%, France at 0.10%, Poland at 0.18%, Finland at 0.21%, Sweden at 0.25% and Ireland at 0.26%. A 2024 noyb survey of data protection professionals, cited in the same section, found that 67.4% said a fine against their own company would push decision makers toward compliance, and 61.5% said fines against other organisations would.

noyb's home regulator is part of the problem as the report describes it. In September 2025 the Austrian authority announced significant restrictions on its work because of budget cuts. noyb and epicenter.works complained to the European Commission, arguing that Austria is breaching Article 52(4) GDPR, which requires adequate funding. According to the report, Germany spends roughly twice as much per capita on data protection authorities as Austria. The complaint is still with the Commission.

The GDPR Procedural Regulation, intended to fix cross-border enforcement, is described with disappointment. noyb says Parliament and Council addressed some of its concerns and secured "some basic procedural rights for data subjects," but that "the general trajectory of the Commission's proposal prevailed in many regards, possibly leading to more confusion and complexity." The regulation becomes applicable in April 2027. PPC Land previously reported on noyb's warning that the effort risked making enforcement harder.

Rulings that went noyb's way

Two court decisions stand out. On January 29, 2025, the EU General Court dismissed the Irish Data Protection Commission's challenge to a December 2022 EDPB binding decision. The DPC had argued that the EDPB overreached by requiring it to investigate Meta's use of sensitive data under Article 9 in a complaint noyb filed on May 25, 2018, the day the GDPR took effect. The report says the ruling "is final and can't be appealed anymore."

Then the Austrian Supreme Court ruled that Meta must give Schrems complete access to his data, including the source, recipient and purpose for each item, within a 14-day deadline ending December 31, 2025. The report places the decision in December 2025; PPC Land's coverage showed the judgment was dated November 26, 2025 and made public on December 18. The case began in 2014 and reached the Austrian Supreme Court three times and the Court of Justice twice. Meta's trade-secret arguments were, according to noyb, "not properly argued by Meta and hence fully rejected."

Among authority decisions, the Austrian regulator found that Microsoft 365 Education used tracking cookies without consent and ordered Microsoft to explain whether personal data went to LinkedIn, OpenAI or Xandr. PPC Land dated that decision to January 2026, which suggests the 2025 report includes some developments from early 2026. The same regulator ruled that automated credit scoring by KSV1870 breached the Article 22 ban on fully automated decisions, and ordered YouTube to comply with an access request filed in January 2019 as part of eight complaints against streaming services.

In Sweden, noyb lost at the Stockholm Administrative Court in its attempt to stop the tax authority selling personal data to brokers and has appealed. A separate complaint against Swedbank, which refused to explain how an automated system set a customer's mortgage rate on the grounds of trade secrecy, is pending with IMY.

Why this matters for the marketing industry

For advertising and data businesses operating in Europe, the report is less a record of 2025 than an inventory of what remains open. Of the 460 pending cases, a large share touch consent, tracking, data sharing and access rights, the areas where adtech, mobile measurement and publisher monetisation are most exposed. The TikTok, AppsFlyer and Grindr complaint goes to how app event data moves between platforms. The WetterOnline complaint concerns location data from an advertising-funded app ending up for sale. The Pay or Okay litigation could determine whether publishers can keep charging users who refuse tracking.

The shift toward collective redress changes the financial calculation. Administrative fines go to the state and take years to collect. Damages claims of €100 to €1,000 per person, multiplied across millions of users, go to those users, and they turn a regulatory risk into a litigation liability. noyb's own estimate for Meta, however speculative, shows the scale it has in mind.

The policy fight cuts the other way. If the Digital Omnibus narrows the definition of personal data in the form the Commission proposed, some of the processing at issue in noyb's complaints could fall outside the GDPR entirely. noyb's response, set out in the preface, is that it would then litigate against the new rules themselves. Either outcome means more legal uncertainty for companies that rely on pseudonymous identifiers.

And the resources question cuts across both. noyb spent €1.28m in 2025, almost all of it on 20 staff. Its complaint count fell by roughly half compared with 2023 while it worked on the Omnibus. A group of this size cannot both litigate at full pace and lobby in Brussels, and the 2025 report is open about which it prioritised.

Timeline

Summary

Who: noyb, the European Center for Digital Rights, a Vienna-based non-profit chaired by Max Schrems, with 20 staff and 5,400 supporting members at the end of 2025.

What: Its Annual Report 2025 records 21 new complaints, 460 pending cases, €1,558,856 in income and €1,278,225.14 in expenses, preparation of a first collective redress case against the credit agency CRIF, and extensive policy work against the Digital Omnibus, which the report says limited resources for other matters.

When: The report was published today, October 13, 2026, and covers calendar year 2025, with some early 2026 developments; its PDF was produced on July 20, 2026.

Where: Complaints and cases span Austria, France, Germany, Ireland, Lithuania, Norway, Sweden and other EU states, with policy work aimed at the European Commission, Parliament and Council in Brussels.

Why: The report shows a litigation group shifting toward collective damages actions and EU policy fights while authorities fine in only a small share of cases, which matters for advertising and data businesses with consent, tracking and data-sharing practices still under complaint.