noyb prepares first collective redress case against CRIF, files second OpenAI complaint

The European data protection advocacy group noyb has started preparations for its first collective redress case against the Austrian credit agency CRIF. According to the organization’s 2025 annual report, this new legal strategy represents a primary shift in enforcement approaches and will occupy the group’s resources through 2026.

noyb continues to expand its legal actions against major technology companies, particularly those developing artificial intelligence systems. In 2025, the group filed its second formal complaint against OpenAI under the General Data Protection Regulation. Additionally, noyb issued a cease-and-desist letter to Meta concerning the company’s use of data for AI training purposes.

Legal Outcomes and Regulatory Fines

The organization’s litigation efforts have contributed to significant financial penalties for tech firms across Europe. To date, administrative fines resulting from noyb’s legal interventions total €2 billion. Recent decisions include a €325 million fine imposed by the French data protection authority on Google for sending unsolicited emails through Gmail.

Other recent regulatory actions include a €750,000 fine levied against Conde Nast for deploying cookies without user consent. The Austrian data protection authority also ruled that Microsoft 365 Education illegally used tracking cookies without obtaining necessary consent. These decisions highlight ongoing enforcement of privacy standards across various digital services.

Court Rulings and Policy Influence

noyb received a major court ruling in its favor in early 2025, reinforcing its position in European privacy law. In January, the EU’s General Court ruled that the Irish Data Protection Commission must investigate a noyb complaint against Meta that was originally filed in 2018. The case reached the court after the European Data Protection Board determined the Irish authority should have examined the use of sensitive data.

The Irish Data Protection Commission had previously sued the European Data Protection Board, arguing that the board had overstepped its authority. The EU’s General Court dismissed these claims, mandating the investigation. Furthermore, noyb dedicated significant resources to advising policymakers on the EU Commission’s Digital Omnibus package, sharing its litigation experience with stakeholders at the European level.

What should you do?

Organizations relying on credit data or AI services should monitor the progress of the CRIF collective redress case. Companies should review their AI training data sources to ensure compliance with GDPR standards following the complaints against OpenAI and Meta. Users should check their privacy settings regarding cookie consent, particularly for services like Microsoft 365 Education and Gmail.

What to do and how to stay safe: noyb

• Review your organization’s data processing agreements with credit agencies and AI vendors to ensure GDPR compliance.
• Audit cookie consent mechanisms on all customer-facing platforms to verify explicit user permission is obtained.
• Monitor regulatory announcements regarding the EU Digital Omnibus package for potential changes in data protection requirements.
• Stay informed about the outcomes of the noyb collective redress case against CRIF for insights into emerging legal precedents.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the total amount of fines resulting from noyb's work?

Administrative fines resulting from noyb's legal work have totaled €2 billion to date.

Who is the target of noyb's first collective redress case?

The Austrian credit agency CRIF is the target of noyb's first collective redress case, which began in 2025.

Did noyb file a new complaint against OpenAI?

Yes, noyb filed its second GDPR complaint against OpenAI in 2025.