The European Data Protection Board (EDPB) has launched a Free and Open Source Software website auditing tool to help analyse websites’ compliance with the law. It allows the preparation, carrying out and evaluation of audits directly in the tool, the importation and evaluation of the audits’ results and the generation of reports. The tool can be used by legal and technical auditors at data protection authorities and by controllers and processors to test their own websites. The EDPB is planning a second version later in 2024.

MLex: The European Data Protection Board (EDPB) did not have the power to order Ireland's data regulator to open new investigations into Meta Platforms, the Irish watchdog told the EU's General Court 16 April 2024.

The European Data Protection Board (EDPB) has published its 2025 Annual Report, outlining its work to improve legal clarity, support compliance and strengthen cooperation in response to the increasing complexity of the EU’s digital regulatory framework. The report highlights the adoption of the Helsinki Statement on Enhanced Clarity, Support, and Engagement, which introduced measures to simplify the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) compliance, improve consistency and transparency, and enhance stakeholder dialogue through consultations, practical tools and guidance. The EDPB also contributed to EU legislative processes, including joint opinions with the European Data Protection Supervisor, and adopted adequacy-related opinions concerning the UK, Brazil and the European Patent Organisation.

The European Data Protection Board (EDPB) has published a one-stop-shop (OSS) case digest on the legal basis of 'legitimate interest'. This initiative is part of the support pool of experts programme, which aims to enhance cooperation among data protection authorities (DPAs) since the EU General Data Protection Regulation (EU) 2016/679 (EU GDPR) came into effect. The digest presents a range of OSS decisions that include both positive and negative compliance examples. It explains how DPAs apply the three-step test to determine whether a controller can lawfully rely on legitimate interests as a legal basis. Additionally, the digest outlines the practical application of Guidelines 1/2024 regarding the processing of personal data based on Article 6(1)(f) of the EU GDPR. It also references cases from the Court of Justice of the European Union, DPA decisions, and national court judgments, demonstrating developments in enforcement.

The European Data Protection Board (EDPB) has published a one-stop-shop case digest on security processing and data breach notification under Article 32 and Articles 33 and 34 of Regulation (EU) 2016/679 (EU GDPR) respectively. The case digest provides insight into how the provisions of the EU GDPR have been interpreted and applied by the Data Protection Authorities in situations dealing with hacking, ransomware and accidental disclosure, among others. It can also be used by organisations in assessing whether their security measures are appropriate.

The European Data Protection Board (EDPB) has published its contribution to the European Commission's evaluation of Directive (EU) 2016/680 (the Law Enforcement Data Protection Directive (LED)). The report identifies enforcement challenges, particularly in distinguishing the scope of the LED from Regulation (EU) 2016/679 (the General Data Protection Regulation (GDPR)). The EDPB also highlights the increasing use of artificial intelligence (AI), biometric technologies and facial recognition in law enforcement, warning that such tools pose heightened risks to fundamental rights where they are not subject to strict necessity, proportionality and appropriate safeguards under the LED. In addition, the report points to gaps in national transposition, the limited use of international data transfer mechanisms and growing calls from supervisory authorities for further EDPB guidance on high-risk law enforcement processing and operational data protection impact assessments (DPIAs).

The European Data Protection Board (EDPB) has adopted an Opinion addressing the validity of consent to process personal data for the purposes of behavioural advertising in the context of ‘consent or pay’ models deployed by large online platforms. This Opinion follows a request in terms of Article 64(2) of Regulation (EU) 2016/679, the EU’s General Data Protection Regulation (EU GDPR) by the Dutch, Norwegian and Hamburg Data Protection Authorities (DPAs). The EDPB is of the view that it will be impossible for large online platforms to comply with the requirements for valid consent if users are only confronted with a choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee. The EDPB considers that when developing alternatives, large online platforms should consider providing individuals with an ‘equivalent alternative’ that does not entail the payment of a fee and this free alternative should be without behavioural advertising. The EDPB will also develop guidelines on ‘consent or pay’ models with a broader scope and will engage with stakeholders on these upcoming guidelines.

The European Data Protection Board (EDPB) has published opinions 14/2026 and 15/2026 approving Europrivacy certification criteria under the General Data Protection Regulation (GDPR). Opinion 14/2026 approves version 82 of the Europrivacy certification criteria as a European Data Protection Seal pursuant to Article 42(5) GDPR, enabling controllers and processors to demonstrate compliance with GDPR requirements. Opinion 15/2026 approves an additional set of certification criteria intended to be used as a tool for transfers pursuant to Articles 42 and 46 GDPR. This enables data importers to demonstrate the existence of appropriate safeguards for transfers of personal data to third countries or international organisations, subject to binding and enforceable commitments.

The European Data Protection Board (EDPB) has published the report of the ChatGPT taskforce, which it created to promote cooperation between Data Protection Authorities (DPAs) investigating the OpenAI chatbot. The report provides preliminary views on certain aspects discussed between DPAs and does not prejudge the analysis that will be made by each DPA in their respective, ongoing investigation. It analyses several aspects concerning common interpretation of the applicable provisions of the EU’s General Data Protection Regulation, Regulation (EU) 2016/679, relevant for the various ongoing investigations, such as lawfulness, fairness, transparency and data accuracy. The report underlines that it is imperative that data subjects can exercise their rights effectively. Taskforce members also developed a common questionnaire as a possible basis for their exchanges with Open AI, which is published as an annex to the report. Also, the EDPB decided to develop guidelines on Generative AI, focusing as a first step on data scraping in the context of AI training.

The European Data Protection Board (EDPB) has published updated guidance on the EU–US Data Privacy Framework (DPF), including revised frequently asked questions (FAQs) for European individuals and businesses, an updated template complaint form for DPF-related commercial complaints, and updated rules of procedure governing the informal panel of EU Data Protection Authorities (DPAs), replacing the versions adopted in 2024.

The European Data Protection Board (EDPB) has published its Work Programme 2026–27, setting out its priorities under the four pillars of its 2024–27 Strategy and reflecting commitments in the Helsinki Statement to enhance clarity, support and engagement, with a focus on making Regulation (EU) 2016/679, EU General Data Protection Regulation compliance easier. The EDPB will simplify compliance by issuing practical guidance on key issues such as anonymisation, pseudonymisation, legitimate interests, children’s data and scientific research, updating existing guidelines, and developing ready-to-use EU templates for data breach notifications, data protection impact assessments, legitimate interest assessments, records of processing activities and privacy notices, alongside tools tailored to small and medium-sized enterprises. It will reinforce consistent enforcement by updating cooperation and complaint-handling procedures, implementing a coordinated enforcement action in 2026 on transparency obligations, strengthening the consistency mechanism, and improving cooperation tools and IT systems. The programme also addresses the interaction between data protection law and other EU frameworks, including the EU AI Act, the EU Digital Markets Act and the EU Digital Services Act, and foresees guidance on emerging technologies such as generative artificial intelligence and blockchain.

The European Data Protection Board (EDPB) has published the final version of Guidelines 2/2023 on the technical scope of Article 5(3) of Directive 2009/136/EC (the EU ePrivacy Directive) following a public consultation. These guidelines provide clarity on the applicability of Article 5(3) to new emerging tracking technologies, outlining key elements for the applicability of the legislation, namely information, terminal equipment of a subscriber user, and gaining access and storage of information and stored information.