Cybersecurity Policy Report, Luxembourg Court Cancels $853M Privacy Fine Against Amazon, (Mar 13, 2026)
A Luxembourg court has canceled a fine of 746 million euros ($853 million) against Amazon.com, Inc., over violations of the European Union’s General Data Protection Regulation (GDPR), the court announced today.
The fine was originally imposed by Luxembourg’s National Commission for Data Protection (CNPD), which found that Amazon had violated several GDPR provisions by collecting personal data for targeted advertising without disclosures to the data subjects (CPR, July 30, 2021).
In Amazon’s second appeal of the fine, Luxembourg’s Administrative Court found that the CNPD failed to take into account a ruling by the Court of Justice of the EU (CJEU) that requires data protection authorities to assess whether a privacy violation was intentional or the result of negligence, the court explained in a news release.
The CJEU ruling came after the CNPD’s original decision in the case, but CJEU rulings apply retroactively, the court noted. It remanded the case to the CNPD to conduct the analysis required by the CJEU.
The CNPD characterized the Luxembourg court’s decision as “upholding the core work of the CNPD” and said it would “continue to handle the case in a way to ensure the efficient application of the GDPR.”
“As regards the fine, the Administrative Court annulled it on the basis of a development in the case law of the Court of Justice of the European Union that occurred after the CNPD’s decision,” according to a CNPD news release.
“Thus, whilst upholding the core work of the CNPD, the judgment nevertheless establishes that the CNPD must analyse the imposition of a financial penalty in the light of this case law, particularly with regard to the question of whether Amazon demonstrated a certain degree of negligence in its practices,” it said.
Amazon welcomed the court’s ruling, saying in a news release that it “strongly disagreed with the initial ruling and disproportionate fine that had originally been issued in this case.”
“In 2018, when an ambiguous new privacy law came into force in the EU without clear guidance on how to show customers relevant advertising, we worked in good faith to give customers control over whether they see personalised advertising based on their interests,” the company said.
“At Amazon, we work hard to earn customer trust, and customer privacy is a top priority,” it added. “We’re proud to innovate and continually improve the services we offer customers. As we innovate, we work with regulators to ensure new services are fully understood and legally compliant.”
News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR