The one-stop-shop is the mechanism in the General Data Protection Regulation (GDPR) that gives a company processing personal data across several European countries a single lead regulator: the data protection authority of the member state where it has its main establishment. It exists to stop one company facing 30 separate investigations over the same conduct, one in each country of the European Economic Area (EEA), and to give individuals and businesses one consistent decision instead of many. In exchange, the lead authority must share its drafts with every other regulator concerned and accept their objections.

For advertising, the rule explains why the largest cases against Meta, Google, LinkedIn and TikTok have run through Dublin.

How a case finds its lead authority

Three definitions in Article 4 do most of the work. Article 4(16) defines the main establishment of a controller as its place of central administration in the EU, unless decisions on the purposes and means of processing are taken in another EU establishment that can enforce them. Article 4(23) defines cross-border processing as processing carried out through establishments in more than one member state, or processing in a single establishment that substantially affects people in several. Article 4(22) defines a supervisory authority concerned: any regulator whose territory hosts an establishment, whose residents are substantially affected, or that received a complaint.

Article 56(1) then makes the authority of the main or single establishment the lead supervisory authority for that cross-border processing. Article 56(6) makes it the controller's "sole interlocutor". The European Data Protection Board (EDPB), the body of EEA regulators created on May 25, 2018, set out how to identify a main establishment in Guidelines 8/2022, whose final version is dated April 17, 2023.

Article 56(2) lets a local authority keep a complaint that concerns only an establishment in its own state, or only people there. A company with no establishment in the EU, which falls under the GDPR through Article 3(2) because it targets or monitors Europeans, gets no lead authority at all. Appointing a legal representative under Article 27 does not change that. Every regulator in the EEA can pursue it.

The cooperation procedure, step by step

Cross-border cases follow Article 60. A complaint can be lodged anywhere. The receiving authority passes it to the lead authority, which investigates and circulates a draft decision to all concerned authorities. They have four weeks to raise a relevant and reasoned objection, a term defined in Article 4(24). If the lead authority amends its draft, the others get two weeks to review the new version. If no objection is raised, the draft becomes binding on all of them.

When the lead authority rejects an objection, the dispute goes to the EDPB under Article 65. The board has one month, extendable by a second, to adopt a binding decision by a two-thirds majority, falling back to a simple majority if that fails. The lead authority must then adopt its final decision within one month of being notified. Article 66 adds an urgency procedure, allowing any concerned authority to impose provisional measures for up to three months and to ask the board for an urgent binding decision.

The EDPB recorded 414 new cross-border cases in its register in 2025, along with 1,299 one-stop-shop procedures, 572 of which led to final decisions, according to its annual report. The board adopted no Article 65 binding decisions that year.

A routine case looks like LinkedIn. A complaint by the French group La Quadrature du Net was transferred to the Irish Data Protection Commission (DPC), which circulated a draft in July 2024. No authority objected, and the DPC fined LinkedIn 310 million euros on October 24, 2024 over behavioural analysis and targeted advertising. A contested case looks like WhatsApp: the DPC's December 2020 draft drew objections from eight authorities, the EDPB adopted a binding decision on July 28, 2021, and the final fine of 225 million euros on August 20, 2021 reflected the board's findings.

From national silos to a single regulator

The 1995 Data Protection Directive contained no such rule. Each national authority applied its own transposing law, and a multinational could face parallel proceedings in several states. The European Commission proposed the one-stop-shop in its draft regulation of January 25, 2012, presenting it as a simplification for business. Negotiators added the counterweights: objections and EDPB arbitration. The GDPR was adopted on April 27, 2016 and has applied since May 25, 2018.

The Court of Justice of the European Union (CJEU) has since defined the edges. In Facebook Belgium (C-645/19), decided on June 15, 2021, it held that an authority that is not the lead may, in specific circumstances such as the urgency procedure, bring proceedings itself. On February 10, 2026, in WhatsApp Ireland v EDPB (C-97/23 P), the Grand Chamber held that companies can challenge Article 65 binding decisions directly before the EU courts, reversing a General Court order of December 7, 2022.

The GDPR left hearings, deadlines and access to files to national procedural law, so each authority ran cases differently. The Commission proposed harmonising rules on July 4, 2023, as COM(2023) 348. A provisional agreement followed on June 16, 2025, and the text was adopted as Regulation (EU) 2025/2518 on November 26, 2025, published in the Official Journal on December 12, 2025. It entered into force on January 1, 2026 and applies from April 2, 2027. It harmonises admissibility, sets a 15-month target for investigations, extendable in complex cases, and 12 months for a simple cooperation procedure, and adds an early resolution route and a right to be heard on preliminary findings.

Why Dublin matters to advertisers

Because Meta, Google, Microsoft, TikTok and LinkedIn base their European operations in Ireland, the DPC leads their cases. Of roughly 7.1 billion euros in GDPR fines announced in the first eight years, the DPC accounted for about 4.04 billion, around 66 per cent, from 37 actions. The largest, 1.2 billion euros against Meta in May 2023 over transfers to the US, followed an EDPB binding decision and remains under appeal.

In December 2022, EDPB binding decisions found that Meta could not rely on contract for ad processing and instructed the DPC to investigate its use of sensitive data. After Norway's authority used the urgency procedure in 2023, the board ordered Meta to stop processing data for behavioural advertising on the basis of contract or legitimate interest across the EEA.

Cookies are the main exception. Consent for storing and reading information on devices falls under the ePrivacy Directive, which sits outside the one-stop-shop. That is why France's CNIL could fine SHEIN's subsidiary 150 million euros without routing the case through another regulator.

Delay, forum shopping and contested competence

Ireland's DPC questioned Google about location tracking in August 2018 and said it required an urgent response. It opened an inquiry on February 4, 2020 and fined Google 403 million euros on September 21, 2026, 2,951 days after its statement. Johnny Ryan of the Irish Council for Civil Liberties wrote that "'Urgent' meant 8+ years". On January 29, 2025, the EU General Court held that the DPC acted unlawfully in refusing to investigate a noyb complaint about Meta's use of sensitive data. The appointment of a former Meta executive, Niamh Sweeney, as commissioner drew further criticism.

Competence itself can be gamed. OpenAI had no EU establishment when ChatGPT suffered a data breach on March 20, 2023. OpenAI Ireland was incorporated four days later, and the DPC recognised it as the company's single establishment on February 15, 2024. Italy's Garante fined OpenAI 15 million euros on November 2, 2024, but the Court of Rome annulled the fine on March 18, 2026 on the ground that competence had passed to Dublin before any final decision.

The procedural regulation has its own critics. Max Schrems, chairman of noyb, said in April 2025 that the draft risked becoming "the biggest legislative mess I have seen in a long time", arguing that it shielded lead authorities rather than speeding them up. The mechanism was built to avoid the opposite risk: conflicting decisions from 30 regulators applying one law.

Not the same as

The EU VAT One-Stop Shop. Launched on July 1, 2021, it lets online sellers declare and pay value-added tax on cross-border sales to consumers through a single tax portal, with an Import One-Stop Shop for consignments worth up to 150 euros. It is a tax system with no connection to data protection.

Digital Services Act and Digital Markets Act enforcement. Under the Digital Services Act, the regulator of the member state of establishment supervises most platforms, but the Commission supervises very large platforms directly. The Digital Markets Act is enforced by the Commission alone. Neither uses GDPR-style lead authorities and objections.

One-stop-shop as a commercial claim. Agencies, ad tech vendors and retailers describe a combined offering as a "one-stop shop". The phrase carries no legal meaning there.

Recent developments

On May 28, 2026 the EDPB adopted Binding Decision 1/2026, ordering Belgium's authority not to dismiss a noyb cookie complaint against broadcaster VRT after Austria objected to the Belgian draft.

The Digital Omnibus, published on November 19, 2025, could change the cookie exception. It would move device-access consent rules into the GDPR through a new Article 88a. Lawyers at Freshfields wrote on January 8, 2026 that the change would "centralise oversight under GDPR supervisory authorities", but how cross-border cookie cases would then be allocated remains unclear. As of October 2026 the proposal had not cleared the legislative process, with the member states' position in Coreper and the Parliament's report both still pending ahead of trilogue talks,.

Timeline

  • October 24, 1995 - Data Protection Directive 95/46/EC adopted, with enforcement left to each national authority.
  • January 25, 2012 - European Commission proposes the GDPR, including the one-stop-shop.
  • April 27, 2016 - GDPR adopted.
  • May 25, 2018 - GDPR applies; EDPB replaces the Article 29 Working Party.
  • June 15, 2021 - CJEU rules in Facebook Belgium (C-645/19) on when non-lead authorities may act.
  • July 28, 2021 - EDPB binding decision in the WhatsApp case; DPC fines WhatsApp 225 million euros on August 20, 2021.
  • December 2022 - EDPB binding decisions on Meta's legal basis for advertising.
  • April 17, 2023 - EDPB finalises Guidelines 8/2022 on identifying the lead supervisory authority.
  • May 2023 - DPC fines Meta 1.2 billion euros after an EDPB binding decision.
  • July 4, 2023 - Commission proposes the GDPR procedural regulation.
  • October 24, 2024 - DPC fines LinkedIn 310 million euros after an uncontested Article 60 procedure.
  • January 29, 2025 - General Court rules the DPC acted unlawfully in refusing to investigate a noyb complaint.
  • June 16, 2025 - Provisional agreement on the procedural regulation.
  • November 19, 2025 - Commission publishes the Digital Omnibus.
  • December 12, 2025 - Regulation (EU) 2025/2518 published; in force January 1, 2026.
  • February 10, 2026 - CJEU rules in WhatsApp Ireland v EDPB that binding decisions can be challenged.
  • March 18, 2026 - Court of Rome annuls OpenAI's 15 million euro fine on competence grounds.
  • May 28, 2026 - EDPB adopts Binding Decision 1/2026 on the VRT cookie complaint.
  • September 21, 2026 - DPC fines Google 403 million euros over location data.
  • April 2, 2027 - Procedural regulation applies.

Summary

Who: National data protection authorities in the 30 EEA states, acting as lead or concerned authorities; the EDPB as arbiter; companies with an EU main establishment, most prominently the large platforms led by Ireland's DPC; complainants and groups such as noyb.

What: A GDPR mechanism under Articles 56 and 60 to 66 that assigns cross-border processing cases to the authority of a company's main establishment, which must cooperate with other authorities and accept EDPB binding decisions when they disagree.

When: Proposed on January 25, 2012, applicable since May 25, 2018, and supplemented by procedural rules in Regulation (EU) 2025/2518, which apply from April 2, 2027.

Where: Across the EU and EEA, with the heaviest caseload in Ireland, and with cookie rules under the ePrivacy Directive handled separately by national regulators.

Why: To spare companies parallel investigations and produce consistent decisions, at the cost of disputes over delay, forum shopping and which regulator is competent.