CNPD Wins Court Judgment Against Amazon for GDPR Violations

13/03/2026

• National

The National Commission for Data Protection (CNPD) takes note of the judgment delivered by the Administrative Court on 12 March 2026 in the case between Amazon Europe Core S.à r.l. (Amazon) and the CNPD concerning the decision taken by the latter in the summer of 2021 regarding Amazon.

In this decision, the CNPD issued a compliance order against Amazon for breaching several provisions of the GDPR in relation to its online behavioural advertising practices and imposed a fine in this regard.

The CNPD notes that the main regulatory action it had taken has borne fruit. Indeed, the Administrative Court has endorsed the CNPD’s approach almost in its entirety and, in particular, confirmed that Amazon’s reliance on legitimate interests as the legal basis for the processing operations in question was not justified. The Administrative Court also upheld the CNPD’s analysis that, at the time of its decision, the information procedures did not comply with the relevant provisions of the GDPR.

Finally, the Administrative Court noted that, prior to the date of the hearing in this case, Amazon had complied with the compliance order issued by the CNPD. It therefore concluded that the proceedings had become irrelevant in this respect.

As regards the fine, the Administrative Court annulled it on the basis of a development in the case law of the Court of Justice of the European Union that occurred after the CNPD’s decision. Thus, whilst upholding the core work of the CNPD, the judgment nevertheless establishes that the CNPD must analyse the imposition of a financial penalty in the light of this case law, particularly with regard to the question of whether Amazon demonstrated a certain degree of negligence in its practices.

The CNPD notes that its action has led to Amazon’s practices being brought into full compliance with the relevant provisions of the case regarding online behavioural advertising. Building on this progress, it will continue to handle the case in a way to ensure the efficient application of the GDPR.