The EU adopted Directive 2002/58/EC (the ePrivacy Directive), establishing sector-specific privacy rules for electronic communications (including confidentiality of communications and early EU-wide rules affecting cookies and tracking).
In Digital Rights Ireland, the Court of Justice of the EU invalidated the Data Retention Directive (2006/24/EC), a landmark decision limiting blanket retention of communications metadata and shaping later EU privacy and surveillance debates.
In Google Spain (C-131/12), the CJEU held that individuals can, under certain conditions, request search engines de-list links to personal information—an important privacy doctrine later reflected in GDPR-era practice.
In Schrems (C-362/14), the CJEU declared the European Commission’s Safe Harbor adequacy decision invalid, disrupting EU–US personal data transfers and intensifying scrutiny of platform data exports to the US.
The EU adopted the GDPR (Regulation (EU) 2016/679), creating a harmonized privacy regime with expanded data subject rights, stricter controller/processor duties, and major administrative fines—directly affecting global digital platforms serving EU users.
GDPR formally entered into force (starting the EU-wide transition period before full application), giving regulators, platforms, and businesses time to prepare compliance programs.
The Data Protection Act 2018 received Royal Assent, providing the UK’s domestic data protection framework alongside GDPR-era requirements (and later supporting the UK’s post-Brexit GDPR-style regime).
The GDPR became applicable EU-wide, enabling active enforcement (including large fines) and strengthening rights such as access, erasure, and transparency—significantly influencing platform data practices and moderation-related data handling.
The European Data Protection Board (EDPB) replaced the Article 29 Working Party, taking a central role in GDPR consistency, guidance, and dispute resolution across EU/EEA regulators—crucial for cross-border platform cases.
France’s data protection authority (CNIL) issued a €50 million GDPR fine against Google for transparency/consent failures related to ad personalization—one of the first major GDPR penalties against a global platform ecosystem actor.
The UK Information Commissioner’s Office announced its intention to fine British Airways under GDPR following a major breach affecting roughly 500,000 customers, underscoring regulators’ willingness to pursue large penalties for security failures.
In Schrems II, the CJEU invalidated the EU–US Privacy Shield adequacy decision, forcing platforms and other companies to reassess EU-to-US data transfers and tightening expectations around Standard Contractual Clauses and supplementary safeguards.
Germany’s Hamburg data protection authority imposed a €35.3 million GDPR fine on H&M over unlawful employee data processing/surveillance practices, demonstrating GDPR’s reach beyond consumer platforms into workplace data governance.
After the earlier notice of intent, the ICO published its final penalty notice for British Airways (reduced to £20 million), illustrating how GDPR enforcement can evolve through representations and procedural steps before final sanctions.
Norway’s data protection authority notified Grindr of its intention to issue a major GDPR-related fine for allegedly lacking valid consent to share user data with advertising partners—highlighting regulatory focus on tracking ecosystems linked to social apps.
The EDPB adopted Binding Decision 1/2021 under GDPR’s consistency mechanism regarding Ireland’s draft decision on WhatsApp Ireland, showing how EU regulators coordinate in cross-border platform investigations.
Ireland’s Data Protection Commission adopted an infringement decision against WhatsApp Ireland and issued a €225 million fine for transparency-related GDPR violations—one of the largest GDPR penalties by 2021 and a key case for platform data disclosures.
Global regulatory actions targeting platform data and privacy (GDPR through 2021)
