Summary

• The dominant issue is not the underlying GDPR breach finding, but whether the regulator followed the right legal steps when setting the penalty.
• Courts in Luxembourg have emphasized that intent or negligence must be assessed before a large GDPR sanction is imposed.
• The Amazon case has become a reference point for proportionality review and procedural rigor in privacy enforcement.
• The dispute remains active because the fine was annulled, but the regulator can reassess the case and potentially issue a new sanction.
• The material is legally coherent and narrowly focused, with little evidence of broader privacy-topic fragmentation.
• Most of the signal is current and concentrated in March 2026 reporting, with only limited historical background from the original 2021 fine.
• Online behavioural advertising and legitimate-interest processing remain the substantive privacy practice at issue.