Landmark decisions

Google Android — illegal tying of Google Search and Chrome to Android OEM agreements, foreclosing competition.

Abuse of dominant position — self-preferencing Google Shopping results over rival comparison services.

Cambridge Analytica data misuse and deceptive consent practices. Largest consumer privacy fine in US history.

Transfer of EU Facebook user data to the US via SCCs found inadequate post-Schrems II. Largest GDPR fine to date.

Advertising targeting system without valid consent — GDPR consent and data minimisation violations.

Largest data fine in Chinese history. Illegal data collection, national security data risk, and unauthorised cross-border transfer.

Transparency failures in privacy policy — insufficient information on data processing and sharing with Meta companies.

Cookie rejection mechanism harder to use than acceptance — consent not freely given under French ePrivacy rules.

Same cookie refusal mechanism violation issued simultaneously with the Google decision.

Insufficient security led to breach exposing 400,000 customer records including payment data via Magecart attack.

339 million guest records exposed via inherited Starwood breach; failure to conduct adequate due diligence on acquisition.

Illegal biometric data collection of Italian residents from public web sources without any legal basis.

Spam telemarketing calls and failure to honour erasure requests — processing without valid consent.

Impermissible disclosure of 3M patient health records via Meta Pixel and Google Analytics tracking pixels on patient portals.

1.5 million patient records breached; PM Lee's data targeted. Singapore's most significant data breach enforcement.