A record fine imposed on Amazon for failing to comply with European data protection regulations is about to take effect.
Recently, the Administrative Court of the Grand Duchy of Luxembourg confirmed the data protection penalty decision made by the National Data Protection Commission (CNPD) on July 15th, 2021, and rejected the appeal of Amazon Europe Core SARL.
According to the penalty decision, the US e-commerce giant must pay €746 million and take corrective measures, or face a fine of €74,600 per day, the second-highest GDPR fine in history until March 2025.
The court found that Amazon had violated several key provisions of the EU General Data Protection Regulation (GDPR). These included unjustified legal bases for processing personal data and violations of the principles of transparency and informing users. In addition, the company restricted users' rights to access, modify and object to their data, which was a direct violation of European law.
The enforcement action is likely related to a complaint filed in 2018 by French digital rights group La Quadrature du Net, which targeted Amazon's way of obtaining consent for targeted advertising. Sources say the decision could be related to how data is used to show personalized ads to customers. Amazon stressed that no data breach had occurred and no personal data was exposed to third parties, but "the decision, which concerns how we show relevant ads to customers, relies on a subjective and untested interpretation of privacy law, and even if it is such an interpretation, the proposed fine is completely disproportionate."
As early as June 2021, Amazon disclosed the ruling in a disclosure document submitted to the U.S. Securities and Exchange Commission: On July 16th, 2021, the Luxembourg National Data Protection Commission ("CNPD") issued a ruling against Amazon Europe Core S.àr.l., stating that Amazon's processing of personal data was not in compliance with the provisions of the EU General Data Protection Regulation. The decision imposed a fine of €746 million on Amazon and revised its practices accordingly. We believe that the CNPD's ruling is unfounded and intend to vigorously defend ourselves on this matter.
At the same time, Amazon also disclosed in the document: Starting with the Frame-Wilson v. Amazon case accepted by the U.S. District Court for the Western District of Washington in March 2020, the United States and Canada have successively accepted a number of cases alleging price-fixing arrangements, monopoly and attempted monopoly between Amazon and third-party sellers in Amazon stores, as well as consumer protection and unjust enrichment claims. Some of these cases include allegations against several different so-called collectives, including consumers who purchased products through Amazon stores and consumers who purchased products provided by Amazon through other e-commerce retailers.
These complaints seek billions of dollars in actual damages, treble damages, punitive damages, and injunctive relief. Several individuals have also initiated arbitrations based on substantially similar allegations. We dispute the allegations of wrongdoing and intend to vigorously defend ourselves in these matters.
Amazon had called the CNPD's decision "unreasonable," but now finds itself in a situation where the dispute has been clearly lost and the fine is mandatory.
As of March 2025, one of the largest GDPR fines in history was the €1.2 billion fine imposed on Meta in 2023. The Irish Data Protection Commission (DPC) fined Meta for failing to provide adequate data protection when transferring the personal data of European users to the United States, in violation of the GDPR's international data transfer provisions. This remains one of the most high-profile cases to date.
