The encyclopedia · Legal & Compliance · Legal decision · 2021–2026
Amazon's €746M GDPR record fine was scrapped on a technicality
Luxembourg's regulator hit Amazon with the biggest GDPR fine ever, then its own courts knocked it down — the violation stood, the sanction did not.
Amazon · 2026-03-12
What happened
In July 2021 Luxembourg's data-protection authority, the CNPD, fined Amazon €746 million — at the time the largest penalty ever imposed under the GDPR — over how it processed customer data to run personalised advertising. The regulator said the processing lacked a proper legal basis.
Amazon appealed. On 12 March 2026 the Luxembourg administrative court annulled the fine, but only on procedural grounds. It largely sided with the CNPD on the underlying GDPR violations, while finding the regulator had not properly analysed whether Amazon's breach was intentional or negligent, and had moved almost automatically to a fine without weighing less severe measures the GDPR allows.
The court sent the case back to the CNPD to do those two analyses. The outcome left the record fine unenforced and the violation confirmed — a demonstration that the size of a GDPR penalty is only as durable as the process that produced it.
Why it happened
- Basing a record fine on an assumption of fault and a rushed penalty choice handed Amazon a clean procedural hook the appeal ran on.
- A regulator that wins the substance but loses the arithmetic leaves the case open — the violation was confirmed, yet the company escaped the bill this round.
- Pricing a penalty as a deterrent against a company of Amazon's scale set the number so high that the process flaws carried more weight than the breach.
The lesson
A fine is only as enforceable as the process that produced it — a regulator that wins the violation but loses the arithmetic hands the company an appeal it can run on.
Sources
- Luxembourg court scraps Amazon's €746M data-privacy fine — International Comparative Legal Guides (ICLG)
- Amazon appeal decision — Commission nationale pour la protection des données (CNPD)
- Administrative court annuls €746 million fine against Amazon in GDPR case — RTL Today
spotted an error? The club wants to know.
More like this
AliExpress got a €550M EU fine — the DSA's first big test landed on Alibaba
Italy fines Replika's maker €5 million over GDPR and children's data
Meta offered EU users only a binary 'consent or pay' choice — €200M DMA fine
Somewhere, someone solved the problem this company failed at. 2nd Opinion →
Comments · 0
Sign in to join the comments.