Amazon’s €746 million Luxembourg privacy fine is no longer a final, enforceable penalty. On 12 March 2026, Luxembourg’s Administrative Court annulled the 2021 decision and sent the penalty question back for reassessment because the regulator had not examined whether Amazon acted intentionally or negligently. The court nevertheless confirmed the essence of the GDPR violations; Amazon had brought the disputed processing into compliance by the time of the hearing.
Why Luxembourg fined Amazon
On 15 July 2021, Luxembourg’s National Commission for Data Protection (CNPD) fined Amazon Europe Core S.à r.l. €746 million over the way it processed personal data for interest-based online advertising. The dispute concerned behavioral advertising: using information about people to help select or target ads.
The case focused on whether Amazon had a valid legal basis for that processing and whether people received adequate information and could exercise their GDPR rights. In its 18 March 2025 judgment, Luxembourg’s Administrative Tribunal described failures involving lawful basis, transparency and information duties, and rights of access, rectification and erasure. It also listed the right to object among the issues. The later appellate court said an independent Article 21 objection-right violation fell outside the investigation’s scope, so that point should not be treated as a confirmed standalone finding.
The CNPD announced the fine publicly in August 2021 but said professional secrecy prevented it from discussing the individual case in detail. Its original decision also required corrective measures, backed by a possible €746,000 daily penalty.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors#1 Best Overall
What happened to the fine in court?
| Date and stage | Status of the penalty | What the court or regulator said |
|---|---|---|
| 15 July 2021 — CNPD decision | €746 million imposed | The regulator fined Amazon Europe Core S.à r.l. and ordered corrective measures. |
| 18 March 2025 — Administrative Tribunal | Fine upheld | The tribunal rejected Amazon’s appeal and upheld the CNPD decision. |
| 12 March 2026 — Administrative Court | Decision annulled; penalty must be reassessed | The court found that the CNPD had not assessed intentional or negligent conduct, as required by later Court of Justice of the European Union case law. It confirmed the essence of the GDPR violations. |
Why the 2026 court annulled the decision
The appellate ruling turned on how a GDPR fine must be justified, not on a conclusion that the advertising practices had been lawful. Later CJEU case law requires an authority imposing a fine to assess whether the infringement was committed intentionally or negligently. The Administrative Court held that the CNPD had not made that assessment in its 2021 decision and ordered a renewed analysis.
The court applied that legal requirement to the case even though the relevant CJEU case law came after the original CNPD decision. As a result, the original penalty decision could not stand in its existing form.
Which GDPR findings remain?
The Administrative Court confirmed the essence of the violations, while the CNPD said on 13 March 2026 that the court had confirmed its core findings: legitimate interests did not justify the disputed processing, and the information procedures had been non-compliant at the time. The appellate court also noted that some elements were not verified and excluded an independent Article 21 violation because it was outside the investigation’s scope. The ruling therefore preserved core compliance findings but did not affirm every allegation or the original fine calculation.
Does Amazon still have to pay €746 million?
Not on the basis of the annulled 2021 decision. The €746 million amount is the historical fine originally imposed and upheld by the tribunal, not a final amount currently established by the appellate ruling. The CNPD must reassess the financial penalty using the required fault analysis; the eventual outcome and amount are not established by the 12 March 2026 judgment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Separate from the fine, the court found Amazon had complied with the disputed corrective requirements by the time of the hearing. It therefore treated the injunction and daily-penalty issues as moot. That operational compliance does not itself decide what penalty, if any, the CNPD may impose after reassessment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What this means for the case
Amazon won annulment of the original CNPD decision in its existing form, but the ruling was not a blanket finding that no GDPR violation occurred. The core violations were confirmed, the original penalty methodology was found inadequate under later EU case law, and the regulator must revisit the fine. Until that reassessment and any further legal process are resolved, the €746 million figure should be described as the original proposed-by-decision amount, not as a settled final liability.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
