Other Developments
A new collective-redress standing for the CNPD entered into force on 25 November 2025. The Law of 20 November 2025 transposes Directive (EU) 2020/1828 and grants the CNPD status as a qualified entity able to bring collective consumer actions for GDPR-based harms, giving Luxembourg data subjects a mechanism, mediated through the regulator itself, to pursue GDPR-based redress collectively rather than only through individual complaints or CNPD-initiated enforcement. CNPD enforcement activity in 2025, reported alongside the Amazon ruling, concentrated on two recurring compliance topics: records-of-processing-activities obligations and the proportionality of video-surveillance systems under the GDPR, with seven corrective measures issued in total, including six fines ranging from EUR 1,277 to EUR 175,000. These figures sit well below the scale of the Amazon matter and describe the CNPD's ordinary enforcement cadence rather than a change in enforcement priorities.
Cross-Monitor Connections
The Amazon ruling's substantive finding on legitimate interests as an invalid basis for behavioural advertising is directly relevant to advennt's and world-payments' adjacent commercial-privacy exposure where similar consent architectures are used, though this brief does not re-analyse those domains. The fault/negligence reasoning demanded by the Luxembourg court following Deutsche Wohnen is also of interest to financial-integrity's compliance-technology tracking insofar as it raises the evidentiary bar regulators must clear before large administrative sanctions, a dynamic with parallels in financial-sector enforcement standards.
Outlook
The question left open by the March 2026 remand is whether the CNPD will issue a fresh fine against Amazon, and at what quantum, once it produces sanction reasoning that satisfies the fault-based standard the court has now required. Given that the substantive finding on legitimate interests was upheld, a renewed fine remains plausible, but its size and timing are unresolved this cycle. The new collective-redress standing for the CNPD is a structural development whose practical use will only become visible once the regulator brings, or declines to bring, its first collective action under the mechanism.
Standing brief · as of 23 August 2026
Written before the update above. Where they differ, the update is the more recent position.
Lead Signal
Luxembourg's Administrative Appeal Court overturned the CNPD's EUR 746 million fine against Amazon Europe Core on 13 March 2026, annulling the decision on procedural grounds: the court found the CNPD had failed to properly analyse intentionality or negligence in line with the Court of Justice of the European Union's Deutsche Wohnen line of authority. The case is remitted to the CNPD for reconsideration. Significantly, the CNPD has stated that the ruling's procedural annulment leaves intact its main substantive findings on unlawful behavioural-advertising practices; what is now unresolved is the fine's quantum, not the underlying finding of unlawful processing. This is Luxembourg's flagship GDPR enforcement outcome, and its remittal establishes a live procedural-rigour standard -- an explicit intentionality/negligence analysis -- that the CNPD must now satisfy before any reconsidered penalty can stand. The annulment does not resolve the underlying legal question of Luxembourg's compliance posture toward Amazon's advertising practices; it resolves a narrower procedural question about how the CNPD reached its penalty decision. For any controller relying on Luxembourg's one-stop-shop status under GDPR, the ruling is a reminder that even a substantively well-founded finding can be procedurally vulnerable if the regulator's decision-making record does not visibly address the intentionality-or-negligence question EU case law now requires.
Other Developments
CNPD concentrates 2025 enforcement attention on ROPA and video surveillance. The CNPD's enforcement focus in 2025 centred on the obligation to maintain records of processing activities and on GDPR compliance of video-surveillance systems, issuing seven corrective measures in total, including six fines ranging from EUR 1,277 to EUR 175,000. The concentration of enforcement attention on these two areas, rather than a broader sweep across all controller obligations, reflects a thematic-priority enforcement model.
A new collective-redress framework enters force. The Law of 20 November 2025 introduced a specific framework allowing class actions in Luxembourg, a new procedural avenue relevant to any future collective claims against controllers or processors operating in the jurisdiction.
CNPD joins EU-wide erasure-rights enforcement sweep. The CNPD joined the European Data Protection Board's 2025 Coordinated Enforcement Framework action on the right to erasure, following up with several organisations, aligning Luxembourg's data-subject-rights enforcement priorities with the wider EU coordinated approach.
CNPD launches children's data-literacy toolkit. On 5 June 2026, the CNPD launched the "Leonora" toolkit at a Geesseknäppchen Forum event attended by two government ministers, targeting children's data-protection awareness. The initiative is non-binding but signals an active CNPD priority on data-protection literacy for a vulnerable population.
Cross-Monitor Connections
The Amazon fine annulment and its behavioural-advertising substance connect to the crypto and world-payments monitors only insofar as adtech-driven commercial data practices increasingly intersect with digital-payments and crypto-platform user-tracking architectures; no LU-specific finding this cycle ties the Amazon matter to either monitor directly, and no such cross-domain analysis is asserted here. The new collective-redress framework under the Law of 20 November 2025 is a procedural development relevant to how future claims might be aggregated against any controller or processor operating in Luxembourg, including financial or payments entities tracked by the financial-integrity and world-payments monitors, though no specific collective action has been identified this cycle.
Outlook
The central marker to watch is the CNPD's reconsideration of the Amazon matter: whether it can satisfy the Administrative Appeal Court's intentionality/negligence-analysis standard and re-impose a fine, and at what quantum, will determine whether Luxembourg's flagship enforcement outcome is ultimately vindicated or further reduced. The CNPD's continued ROPA and video-surveillance enforcement focus suggests these will remain live inspection priorities into the next cycle, and the new collective-redress framework's first practical use in a data-protection context would be a significant development to track. A second-source, tier-1 corroboration of the CNPD's exact enforcement-tracker figures would strengthen confidence in the precise 2025 enforcement tally, which currently rests on a tier-3 secondary summary of the CNPD's own report.