The Luxembourg Administrative Court on March 12, 2026 endorsed the CNPD's 2021 compliance order against Amazon Europe Core S.à r.l. for GDPR violations related to online behavioural advertising, confirming that Amazon's reliance on legitimate interests as a legal basis was not justified. The court also upheld the CNPD's finding that Amazon's information procedures did not comply with GDPR at the time of the decision. Amazon had already complied with the compliance order prior to the hearing. However, the court annulled the financial penalty, citing post-decision CJEU case law requiring a different analytical framework for assessing whether Amazon demonstrated negligence.