{"page":"/blog/eu-sovereign-ad-tech-stack","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Date","Authority","Company","Amount","What it was about","Source"],"rows":[["22 May 2023","Irish DPC","Meta Ireland","€1.2 billion","EU-US transfers under SCCs after Schrems II (Article 46(1)); transfers to be suspended within five months","DPC, 22 May 2023"],["15 June 2023","CNIL","Criteo","€40 million","Targeted advertising without proof of consent, transparency and joint-controller failures","CNIL sanctions list"],["7 March 2024","CJEU","IAB Europe (reference from Belgium)","n/a (judgment)","TC String is personal data; IAB Europe is a joint controller for it","CJEU C-604/22"],["23 April 2025","European Commission","Meta","€200 million","DMA Article 5(2): \"consent or pay\" did not offer a less-personalized equivalent","Commission, 23 April 2025"],["1 September 2025","CNIL","Google LLC and Google Ireland","€325 million","Ads between Gmail messages without consent; advertising cookies at account creation","Privacy Laws & Business, 4 September 2025"],["2 October 2026 (published 16 October 2026)","Norwegian Datatilsynet","Xandr (Microsoft)","€8.6 million (NOK 92 million)","RTB with Grindr users' advertising ID and IP; joint controller as SSP and DSP; could not rely on the app's consent","EDPB, 16 October 2026"]],"sourceUrls":[["https://www.dataprotection.ie/en/news-media/press-releases/Data-Protection-Commission-announces-conclusion-of-inquiry-into-Meta-Ireland"],["https://www.cnil.fr/en/sanctions-issued-cnil"],["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0604"],["https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085"],["https://www.privacylaws.com/news/cnil-fines-google-325-million-and-shein-150-million/"],["https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en"]]}