Amazon wins when a Luxembourg court waives a record $854 million privacy fine

Amazon on Friday won its appeal against a record €746 million ($854.4 million) fine imposed by Luxembourg’s data protection regulator, after a court ruled that the watchdog had not properly conducted its legal analysis and must reassess the case.

The penalty had originally been issued in 2021 by the National Commission for Data Protection (CNPD). The regulator accused Amazon of violating European Union privacy laws through its online behavioural advertising practices, arguing that the company’s handling of users’ personal data breached the General Data Protection Regulation.

The same Luxembourg court had previously upheld the fine in 2024, siding with the privacy regulator and supporting the CNPD’s decision. Amazon later appealed that ruling.

In its latest judgment, the court accepted Amazon’s argument that the regulator had failed to properly assess whether the company had intentionally violated the GDPR or whether any violation might have been the result of negligence. The judges also said the regulator had not considered alternative sanctions before imposing the large financial penalty.

According to the ruling, the CNPD had almost automatically issued the fine without conducting the full analysis required under EU law. As a result, the court annulled the regulator’s 2021 decision and ordered that the necessary legal analysis must now be carried out properly when the case is reconsidered.

Amazon welcomed the court’s decision. A company spokesperson said the firm had strongly disagreed with the original ruling and the size of the fine, which it believed was disproportionate, and therefore chose to challenge it through the appeal process.

The CNPD said it had taken note of the court’s judgment. The regulator added that its investigation had already led Amazon to bring its practices related to online behavioural advertising into compliance with the relevant privacy requirements under the GDPR.