Insufficient Compliance on One Side, Insufficient Reasoning on the Other

Background

The significance of the Amazon v. Commission Nationale pour la Protection des Données (“CNPD”) case can be summed up in one simple idea: the annulment of a EUR 746 million fine does not mean that no infringement occurred.

On 12 March 2026, the Luxembourg Administrative Court (the “Court”) annulled the decision of 15 July 2021 by which the CNPD had imposed a record fine on Amazon for breaches of the GDPR, together with several compliance orders.

As a reminder, the CNPD had criticised Amazon for:

• Using an inappropriate legal basis for targeted advertising: Amazon processed the personal data of data subjects for interest-based advertising purposes on the basis of “legitimate interest”;
• Lack of transparency: the CNPD found that the information provided to data subjects concerning the processing of their data did not comply with GDPR requirements;
• Failure to respect data subjects’ rights: shortcomings were identified in relation to the effective exercise of users’ rights of access, rectification and objection regarding their data.

The different perspectives

On the substance, the message remains clear.

Reliance on legitimate interest for online behavioural advertising was not valid, and Amazon did not comply with the information requirements laid down by the GDPR.

For data controllers, the practical lesson is straightforward.

A fragile legal basis and incomplete information can result in years of litigation.

For the CNPD, the lesson is equally clear.

A supervisory authority cannot impose such a substantial fine in a quasi-automatic manner without establishing wrongful conduct, namely an intentional infringement or negligence.

In the meantime, Amazon has modified its practices, and the CNPD now considers this new framework to be compliant.

Conclusion

If one lesson can be drawn from this case, it is that:

• Companies should audit their legal bases, consent mechanisms and privacy notices before a supervisory investigation or litigation forces them to do so;
• Proactive compliance measures implemented during litigation may neutralise certain enforcement measures.

In practice, hoping that a supervisory authority will make an error of assessment has never been a particularly robust compliance strategy.

➡️ For any questions relating to IP/IT matters or, more specifically, the GDPR, please contact Mathilde Wazana Moock or Nicolas Thieltgen.