Home / Issues / Luxembourg CNPD GDPR decision fining Amazon €746 million (2021)
Luxembourg CNPD GDPR decision fining Amazon €746 million (2021)
Decidedas of 31 Oct 2026Luxembourg / European UnionAmazon Europe Core S.à r.l.Amazon.com, Inc.draft
Current status
Confirmed fact · as of 30 Jul 2021
A CNPD decision dated 16 July 2021 imposing a €746 million fine and practice revisions on Amazon Europe Core S.à r.l. for alleged GDPR non-compliance is confirmed by Amazon's own SEC filing.
A Amazon.com, Inc. (filed with U.S. Securities and Exchange Commission), Form 10-Q for the quarterly period ended June 30, 2021 (Legal Proceedings note disclosing the CNPD decision) (30 Jul 2021) · retrieved 31 Oct 2026
Confirmed fact · as of 31 Oct 2026
This was an administrative/regulatory data-protection enforcement action; it is not a criminal matter and involves no criminal conviction.
A Amazon.com, Inc. (filed with U.S. Securities and Exchange Commission), Form 10-Q for the quarterly period ended June 30, 2021 (Legal Proceedings note disclosing the CNPD decision) (30 Jul 2021) · retrieved 31 Oct 2026
Unanswered question · as of 31 Oct 2026
The full text of the CNPD decision is not public and the authority does not comment on individual cases; the precise GDPR provisions found to be infringed, and the status and outcome of any appeal before the Luxembourg administrative courts, could not be confirmed from a primary official record in the checked sources.
C The National Law Review, Luxembourg DPA Fines Amazon 746 Million Euros for GDPR Violations (30 Jul 2021) · retrieved 31 Oct 2026
Last reviewed 31 Oct 2026. An initial allegation is not the final event; this block is always shown.
How it unfolded
Issue raised · 16 Jul 2021
Proposition: The Luxembourg data protection authority, the Commission nationale pour la protection des données (CNPD), issued a decision claiming that Amazon's processing of personal data did not comply with the EU General Data Protection Regulation, and imposed a fine of €746 million together with corresponding orders to revise certain practices.
Affected parties: Amazon Europe Core S.à r.l., Amazon.com, Inc., Commission nationale pour la protection des données (Luxembourg)
Originating record: A Amazon.com, Inc. (filed with U.S. Securities and Exchange Commission), Form 10-Q for the quarterly period ended June 30, 2021 (Legal Proceedings note disclosing the CNPD decision) (30 Jul 2021) · retrieved 31 Oct 2026
Response · Amazon.com, Inc. · 30 Jul 2021
Attributed claim · as of 30 Jul 2021
In its Form 10-Q for the quarter ended June 30, 2021, Amazon disclosed the CNPD decision and stated: "We believe the CNPD's decision to be without merit and intend to defend ourselves vigorously in this matter." The filing records that the decision imposes a fine of €746 million and corresponding practice revisions. — Amazon.com, Inc.
A Amazon.com, Inc. (filed with U.S. Securities and Exchange Commission), Form 10-Q for the quarterly period ended June 30, 2021 (Legal Proceedings note disclosing the CNPD decision) (30 Jul 2021) · retrieved 31 Oct 2026
Outcome · Commission nationale pour la protection des données (CNPD), Luxembourg · 16 Jul 2021
official findingbinding
Confirmed fact · as of 30 Jul 2021
Amazon's Form 10-Q for the quarter ended June 30, 2021 (filed with the US SEC on 30 July 2021) states that "On July 16, 2021, the Luxembourg National Commission for Data Protection (the 'CNPD') issued a decision against Amazon Europe Core S.à r.l. claiming that Amazon's processing of personal data did not comply with the EU General Data Protection Regulation," and that "the decision imposes a fine of €746 million and corresponding practice revisions." The CNPD's own decision was not published and, consistent with Luxembourg's statutory professional-secrecy rules, the authority did not comment publicly on the individual case; contemporaneous reporting indicates the matter related to Amazon's processing of customer data for targeted-advertising purposes. This is an administrative data-protection matter, not a criminal proceeding.
A Amazon.com, Inc. (filed with U.S. Securities and Exchange Commission), Form 10-Q for the quarterly period ended June 30, 2021 (Legal Proceedings note disclosing the CNPD decision) (30 Jul 2021) · retrieved 31 Oct 2026 · C The National Law Review, Luxembourg DPA Fines Amazon 746 Million Euros for GDPR Violations (30 Jul 2021) · retrieved 31 Oct 2026
Remedy: Administrative fine of €746 million plus corresponding orders to revise certain data-processing practices.
Appeal/review: pending — Amazon stated it believed the decision to be without merit and intended to defend itself vigorously. The CNPD does not comment publicly on individual cases and the decision was not published, so appeal steps are not available from a primary official record; no final judgment resolving any challenge has been identified in the checked sources. A Amazon.com, Inc. (filed with U.S. Securities and Exchange Commission), Form 10-Q for the quarterly period ended June 30, 2021 (Legal Proceedings note disclosing the CNPD decision) (30 Jul 2021) · retrieved 31 Oct 2026
How to read this. Allegation, response and outcome are separate, dated records. "Decided/resolved" appears only where a cited outcome supports it. Materially affected parties can request a correction via Corrections & response.