August 29, 2025: Austria’s Data Protection Authority (DSB) has directed YouTube, part of Google, to provide a user with full access to the personal information it holds. The order follows a finding that the company’s earlier partial response violated the European Union’s General Data Protection Regulation (GDPR). YouTube must comply within four weeks, although the decision may be appealed.
The ruling originates from a 2019 complaint filed by the Austrian privacy group NOYB (“None of Your Business”) on behalf of an individual user. NOYB argued that YouTube’s initial reply to the data access request was incomplete and failed to provide all the information to which the user was entitled.
Under the GDPR, users have the right to see all personal data collected and stored about them. The DSB concluded that YouTube’s earlier response did not satisfy this requirement, reinforcing the obligation of companies to be fully transparent about data collection and processing.
NOYB has led multiple initiatives to ensure compliance with data protection rules, particularly targeting major technology platforms. This complaint against YouTube is part of a wider effort to hold global tech firms accountable for respecting user privacy in the European Union.
Max Schrems, the founder of NOYB, described the decision as a key reinforcement of user rights. Schrems has previously challenged the legality of international data transfers and highlighted privacy concerns regarding services like Google Analytics.
The DSB’s ruling sends a clear signal to technology companies operating in Europe: strict adherence to GDPR regulations is mandatory. Users are encouraged that their rights to access and control personal data are enforceable, and companies must respond fully and accurately to such requests.
This case emphasizes the ongoing scrutiny of digital privacy practices in Europe and demonstrates the authorities’ commitment to upholding data protection laws.
