A qualified entity is an organisation or public body that an EU member state has formally designated to go to court on behalf of consumers as a group. Directive (EU) 2020/1828, known as the Representative Actions Directive, defines it in Article 3(4) as "any organisation or public body representing consumers' interests which has been designated by a Member State". Only a qualified entity can bring a representative action under the directive. It exists because individual consumer harms are often too small to litigate alone. "It is usually too difficult and not worth it to bring a lawsuit over 200 euros," Ursula Pachl, head of collective redress at the privacy group noyb, said in December 2024, according to noyb. Pooling claims through a vetted non-profit is the European answer, and a deliberate alternative to US-style class actions run by law firms.

How designation works

The directive creates two tiers. Domestic qualified entities may sue only in the courts of the member state that designated them, under criteria each government sets for itself. Cross-border qualified entities may sue anywhere in the EU, and Article 4(3) fixes the criteria they must meet. The organisation must be a legal person under national law with at least 12 months of "actual public activity in the protection of consumer interests" before applying. Its statutory purpose must show a legitimate interest in protecting consumers under the laws covered by the directive. It must be non-profit-making, must not be in insolvency proceedings, and must be independent of traders, with procedures to prevent conflicts of interest, including with funders. It must publish its funding sources and structure.

Article 4(6) lets member states designate an entity ad hoc for a single domestic case, and Article 4(7) allows public bodies, such as consumer authorities, to hold the status. Article 5 requires compliance reviews at least every five years, and a defendant trader can raise "justified concerns" about an entity's standing.

The European Commission publishes the list of cross-border entities. Under Article 6(3), courts must accept inclusion on that list as proof of legal standing. As of October 2026, the Commission's list contained 88 cross-border qualified entities, according to the Commission's justice collaboration platform. Croatia had notified ten, the Netherlands nine and Germany two.

What a qualified entity can do

The directive gives qualified entities two kinds of remedy, and an entity chooses which to seek under Article 7. Injunctive measures under Article 8 can be provisional or definitive and order a trader to stop or prohibit a practice. Article 8(3) spares the entity from proving loss, intent or negligence. Redress measures under Article 9 can deliver compensation, repair, replacement, price reduction, contract termination or reimbursement to the consumers concerned.

National law decides how consumers join. Most member states use opt-in, where each consumer must ask to be represented. A minority, including the Netherlands and Portugal, use opt-out, where the entity represents everyone in the defined group who does not object. Article 9(3) adds a cross-border rule: consumers not habitually resident in the country where the case is heard must always opt in.

Costs follow a loser-pays principle under Article 12, but individual consumers do not pay them. Article 20 asks governments to keep costs from deterring entities, through public funding, fee limits or legal aid. Third-party litigation funding is permitted but policed by Article 10. A funder cannot be a competitor of the defendant or a business on which the defendant depends, and courts can demand a financial overview of the entity's sources of funds.

National laws add their own thresholds. Germany's Consumer Rights Enforcement Act (VDuG), in force since October 13, 2023, requires a qualified association to show that claims of at least 50 consumers could be affected. It rules out funding arrangements that promise a funder more than 10% of what the defendant must pay, according to Herbert Smith Freehills.

Origin and evolution

The term predates the current directive by more than two decades. Directive 98/27/EC of May 19, 1998, the Injunctions Directive, first used "qualified entity" for consumer bodies allowed to seek court orders stopping infringements, with a Commission list published in the Official Journal. It was codified as Directive 2009/22/EC on April 23, 2009. They could stop unlawful conduct but not recover money.

The Commission proposed closing that gap on April 11, 2018, as part of its New Deal for Consumers. Directive (EU) 2020/1828 was adopted on November 25, 2020, published on December 4, 2020, and entered into force on December 24, 2020. Member states had to transpose it by December 25, 2022 and apply it from June 25, 2023, when the 2009 directive was repealed. Most missed the deadline. In early 2023 the Commission sent letters of formal notice to 24 member states, with only Hungary, Lithuania and the Netherlands having notified implementation, according to Linklaters. Ireland's Representative Actions Act 2023 was fully commenced on April 30, 2024, according to Matheson.

The scope keeps widening. Annex I of the directive originally listed 66 EU laws, including the ePrivacy Directive, the Unfair Commercial Practices Directive and the General Data Protection Regulation (GDPR). The Digital Services Act (DSA) added itself as point 68 through its Article 90. Article 42 of the Digital Markets Act (DMA) applies the directive to gatekeeper infringements that harm consumers, from June 25, 2023. Article 110 of the AI Act and Article 48 of the Data Act each add their regulation to the annex. A breach of any of them can ground a representative action.

The Court of Justice of the EU also widened the data protection route. On April 28, 2022, in case C-319/20, it ruled that Germany's consumer federation, vzbv, could bring GDPR proceedings against Meta without a mandate from any affected user.

Why it matters for advertisers and platforms

For ad tech, the significance is arithmetic. Non-material GDPR damages per person are modest, typically 100 to 1,000 euros according to noyb, but a qualified entity can aggregate millions of them. When noyb challenged Meta's plan to train AI on EU user data in May 2025, its chair Max Schrems illustrated the exposure with about 400 million European users each claiming roughly 500 euros, a theoretical 200 billion euros.

noyb's own status shows how quickly privacy groups have moved into this role. Ireland's Ministry of Justice and Austria's Federal Cartel Attorney approved it in late 2024, giving it EU-wide standing for collective data protection cases.

The Cologne Regional Court, ruling on a vzbv action on September 17, 2026, barred Snap from using My AI chat data for advertising without a legal basis, with fines of up to 250,000 euros per breach. The Irish High Court on May 26, 2025 granted the Irish Council for Civil Liberties permission for what PPC Land described as Ireland's first class action, against Microsoft's RTB system, which reportedly sends data to 1,647 entities.

Limitations and disputes

Opt-in is the main brake. In most member states consumers must take an active step to join a damages claim, so the group an entity represents can be far smaller than the group harmed. Funding is the second. Entities must be non-profit and independent, yet redress cases need expert evidence and years of litigation. The European Parliament, concerned that commercial funders could steer cases toward lucrative targets, called for EU-wide rules on litigation funding in a resolution of September 13, 2022. Article 10's safeguards have yet to be tested at scale.

Designation itself is uneven. Each member state sets domestic criteria, so organisations with very different resources and missions hold the same status. Where a damages model already existed, claimants still use it. Dutch foundations bring claims under Article 3:305a of the Dutch Civil Code, as Stichting Offlimits did in obtaining an Amsterdam order against Grok in March 2026. Hotels pursuing Booking.com use an assignment model instead.

Public dates diverge too: noyb says Ireland approved it on October 10, 2024, PPC Land reported October 11 and the Commission list records October 14.

Not the same as

  • Collective redress: the broader policy goal of letting groups seek remedies together, covered in its own explainer. A qualified entity is the vehicle the EU chose to deliver it.
  • GDPR Article 80 bodies: not-for-profit organisations that may lodge complaints or sue for data subjects, with or without a mandate depending on national law. Many are also qualified entities, but the two statuses are granted separately.
  • DSA trusted flaggers and Article 86 representatives: bodies that flag illegal content to platforms or exercise DSA rights for users. Neither designation confers standing for representative actions.
  • UK class representatives and US public interest plaintiffs: the UK's Competition Appeal Tribunal certifies a class representative case by case, as in the 5 billion pound advertiser claim against Google. The Consumer Federation of America's scam ads suit against Meta relies on District of Columbia law, not EU designation.

Recent developments

Larger consumer bodies have joined the cross-border list. BEUC, the European Consumer Organisation, was notified via Belgium on April 8, 2025 and vzbv via Germany on April 13, 2026, according to the Commission list. On August 26, 2026, noyb, describing itself as a state-approved qualified entity, sent SCHUFA a cease-and-desist letter over data on 69 million people, estimating immaterial damages at about 500 euros per person. Other routes remain active alongside the directive: a Madrid court ordered Meta to pay 479 million euros to 87 publishers in November 2025 under unfair competition law. Member states must report data to the Commission by June 26, 2027. By June 26, 2028 the Commission must also assess whether a European ombudsman for representative actions is needed.

Timeline

  • May 19, 1998 - Injunctions Directive 98/27/EC introduces qualified entities for consumer injunctions.
  • April 23, 2009 - Directive 2009/22/EC codifies the injunctions regime.
  • April 11, 2018 - Commission proposes representative actions in its New Deal for Consumers.
  • November 25, 2020 - Directive (EU) 2020/1828 adopted.
  • December 24, 2020 - The directive enters into force.
  • April 28, 2022 - CJEU rules in C-319/20 that consumer associations can bring GDPR actions without a mandate.
  • September 13, 2022 - European Parliament resolution on third-party litigation funding.
  • December 25, 2022 - Transposition deadline.
  • Early 2023 - Commission sends letters of formal notice to 24 member states.
  • June 25, 2023 - National rules apply; Directive 2009/22/EC repealed; DMA Article 42 applies.
  • October 13, 2023 - Germany's VDuG enters into force.
  • April 30, 2024 - Ireland's Representative Actions Act 2023 fully commenced.
  • October 2024 - Ireland approves noyb as a qualified entity.
  • December 2, 2024 - Austria approves noyb.
  • April 8, 2025 - BEUC notified as a cross-border qualified entity.
  • May 26, 2025 - Irish High Court grants ICCL permission against Microsoft.
  • April 13, 2026 - vzbv notified as a cross-border qualified entity.
  • August 26, 2026 - noyb sends SCHUFA a cease-and-desist letter.
  • September 17, 2026 - Cologne court rules for vzbv against Snap.
  • June 26, 2027 - First member state data due to the Commission.
  • June 26, 2028 - Commission evaluation and ombudsman assessment due.

Summary

Who. Consumer organisations, privacy groups and public bodies designated by EU member states, such as vzbv, BEUC, noyb and the Irish Council for Civil Liberties. Defendants include Meta, Snap, Microsoft and data brokers such as SCHUFA.

What. An organisation with legal standing to bring representative actions for injunctions or redress on behalf of groups of consumers under Directive (EU) 2020/1828. As of October 2026, 88 entities held cross-border status.

When. The term dates to the 1998 Injunctions Directive. The power to claim redress applies to actions brought from June 25, 2023, with a Commission evaluation due from June 26, 2028.

Where. In the courts and administrative authorities of all 27 member states. Cross-border entities can sue in any of them.

Why. Individual losses from data and advertising practices are too small to litigate alone. Qualified entities aggregate them, and because the GDPR, DSA, DMA, AI Act and Data Act all sit in the directive's annex, they now give consumer groups a direct enforcement route alongside regulators.