WhatsApp Fined EUR 225 Million for Transparency Violations
Ireland's Data Protection Commission (DPC) fined WhatsApp Ireland EUR 225 million for failing to provide transparent information to users and non-users about how their personal data was processed. The European Data Protection Board (EDPB) intervened with an Article 65 binding decision that required the DPC to increase the fine significantly from its original draft. The ruling found deficiencies in WhatsApp's privacy notices under Articles 12, 13, and 14 of GDPR. WhatsApp challenged the EDPB's binding decision, and on 10 February 2026 the Court of Justice of the EU held in Case C-97/23 P that EDPB binding decisions are directly reviewable by EU courts, sending the dispute back to the General Court on the merits.
Key Analytics
Impact Analysis
The EDPB's intervention demonstrated that the consistency mechanism can substantially alter outcomes from lead supervisory authorities, creating enforcement unpredictability for multinational companies. Organizations must ensure transparency obligations are met not only for direct users but also for non-users whose data may be processed (such as contacts uploaded from address books). The case raised the bar for what constitutes adequate and accessible privacy disclosures. The CJEU's February 2026 ruling that companies can challenge EDPB binding decisions directly before EU courts adds a judicial check on the consistency mechanism, and the merits of the WhatsApp fine dispute are now pending before the General Court.
Recommended Actions
- Audit privacy notices for compliance with Articles 12-14, ensuring all required information elements are present and written in clear, plain language.
- Evaluate whether your services process personal data of non-users (e.g., contact lists, referrals) and provide appropriate transparency notices to those individuals.
- Implement a review cycle for privacy documentation that accounts for regulatory guidance updates across all relevant EU member state authorities.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Article 12 to 14 notice gap audit and rewrite
- ›Non-user transparency assessment for contacts and referrals
- ›Notice review cycle covering EU supervisory authority guidance
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 65 to 140 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.