Amazon Receives Record EUR 746 Million GDPR Fine
Luxembourg's CNPD issued a EUR 746 million fine against Amazon Europe Core on July 15, 2021 for processing personal data for targeted advertising without a valid legal basis under GDPR. At issuance it was the largest GDPR fine ever imposed. The Luxembourg Administrative Tribunal upheld the decision in March 2025, but on March 12, 2026 the Administrative Court annulled the fine on procedural grounds, finding the CNPD had not analysed fault or negligence, while confirming the core finding that Amazon could not rely on legitimate interests for behavioral advertising. The case was returned to the CNPD.
Key Analytics
Impact Analysis
Although the fine itself was annulled in March 2026, the courts confirmed the substantive violations: legitimate interests is not a valid legal basis for behavioral advertising at this scale, and Amazon's transparency toward data subjects fell short of GDPR requirements. Amazon complied with the CNPD's corrective order during the litigation, so the compliance outcome stands regardless of the penalty. Organizations processing EU consumer data for behavioral advertising or profiling must demonstrate a lawful basis under Article 6 and meet the high bar for valid consent under Article 7. The annulment also signals that regulators must document fault and consider less severe measures before imposing fines, which shapes how future mega-fines will be litigated.
Recommended Actions
- Review all consent mechanisms for advertising and profiling activities to confirm they meet GDPR's freely given, specific, informed, and unambiguous standard.
- Conduct a data protection impact assessment (DPIA) for any processing activity involving behavioral targeting of EU residents.
- Ensure privacy notices clearly describe all data processing purposes, retention periods, and third-party sharing related to advertising.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Consent flow remediation for advertising and profiling
- ›DPIA for behavioral targeting of EU residents
- ›Privacy notice updates on purposes, retention, and sharing
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 70 to 150 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.