noyb Annual Report 2025: Fines Reach €2 Billion, Collective Redress Next

Collective redress and AI complaints

According to noyb, 2025 was the year it began preparing its first collective redress case, directed against the Austrian credit agency CRIF. The organisation says the project will keep it busy in 2026. noyb adds that "many details are still unclear", but it sees collective redress as the primary new approach to enforcement and intends to expand in this area.

The group also continued its actions against AI systems it considers unlawful. In 2025 it filed its second complaint against OpenAI and sent a cease-and-desist letter to Meta over AI training. Beyond these, noyb says it filed several new GDPR complaints during the year.

Policy work on the Digital Omnibus

A considerable part of noyb's resources went into the EU Commission's Digital Omnibus package. The organisation says the plans required it to increasingly share its legal expertise and litigation experience with policy makers and stakeholders at European level.

noyb describes itself as the only non-profit organisation working exclusively on the GDPR for many years, and argues that this means it has to take an active role in the policy space. It acknowledges that this limited the resources available for other matters, but says the work "seems to have been crucial" for its mission.

Decisions from authorities and courts

The report lists several decisions obtained during the year:

• The French data protection authority fined Google €325 million for "spam emails" in Gmail.
• Conde Nast was fined €750,000 for placing cookies without consent.
• The Austrian data protection authority decided that Microsoft 365 Education used tracking cookies without consent, which was found to be illegal.

noyb also highlights two major court rulings. In January 2025, the EU's General Court ruled that the Irish Data Protection Commission (DPC) must investigate a noyb complaint against Meta that was filed in 2018. The case reached the General Court after the EDPB decided that the DPC should also have investigated the use of sensitive data (Article 9 GDPR). Instead of following that guidance, the DPC sued the EDPB before the European Courts, claiming it had overreached. The General Court dismissed the DPC's claims.

In December 2025, the Austrian Supreme Court ruled that Meta must disclose all personal data it holds on its users and provide specific information on all data, such as the source, recipient or purpose of processing. The ruling stems from a case brought by Max Schrems in 2014, which reached the Austrian Supreme Court three times and the European Court of Justice twice.

Funding and what comes next

noyb thanks its 5,400 supporting members, its institutional members and individual donors, saying its work would not have been possible without them, especially in what it calls difficult economic times.

The full report covers new and ongoing projects, financials and plans for 2026. Based on the organisation's own account, the coming year will centre on the CRIF case and a broader push into collective redress, alongside continued involvement in the Digital Omnibus debate.