Amazon's record €746M GDPR fine (Luxembourg)
€746M
≈ $806M at the time
Commission Nationale pour la Protection des Données
Luxembourg / EU · 2021
Status: Annulled
What happened
Luxembourg's CNPD fined Amazon for processing personal data for behavioural advertising without valid consent, the largest GDPR fine at the time. In March 2026 the Administrative Court annulled the penalty and remanded it, so no money is currently owed.
The annulment was procedural, not substantive. The Administrative Court confirmed that Amazon could not rely on legitimate interest for behavioural advertising and upheld the transparency and data-subject-rights breaches, but found the CNPD had not assessed whether the conduct was intentional or negligent, and had not considered whether a lesser measure would do. The case returns to the CNPD, which may issue a new penalty of a different size. Because the fine is annulled, it is excluded from every total in this directory.
How it affected users
Shoppers were profiled for advertising without a lawful basis.
Status timeline
Jul 16, 2021
CNPD imposed a €746M fine plus a daily coercive penalty.
Effective amount: ≈ $806M
Mar 18, 2025
The Administrative Tribunal dismissed Amazon's appeal.
Mar 12, 2026
The Administrative Court annulled the fine and sent the case back to the CNPD, while confirming the underlying GDPR breaches.
Effective amount: none owed
Sources
- Luxembourg Administrative Court: judgment on the CNPD decision (case 52757C)court
- CNPD statement on the Administrative Court judgmentregulator
Last verified 2026-07-02. Spotted an error? Report a correction.
Cite this entry
Deepak Gupta, "Amazon's record €746M GDPR fine (Luxembourg)," Tech Fines Directory, guptadeepak.com, 2021-07-16. https://guptadeepak.com/tech-fines/violation/amazon-luxembourg-gdpr-2021/