For years, Amazon's €746 million fine sat in most rankings as the second-largest GDPR penalty ever issued, trailing only Meta's transfer fine. In March 2026, Luxembourg's Administrative Court annulled it. That word choice matters: annulled, not overturned on the merits. The court's decision did not say Amazon's ad-targeting practices were lawful. It said the CNPD's process in reaching its 2021 decision fell short of what due process requires, and sent the matter back for the regulator to redo its analysis.
It is tempting to read this as good news for whoever the next Amazon turns out to be, and in a narrow sense it is — a demonstrated path to challenge a large fine on procedural rather than substantive grounds. But the more durable lesson cuts the other way. Regulators issuing nine and ten-figure penalties are themselves bound by administrative law: reasoned decisions, proper evidentiary basis, a fair hearing before the fine lands. When a DPA skips a procedural step to move faster, the eventual fine becomes more fragile, not less, and the years spent litigating a flawed decision often outlast the years it would have taken to get the original decision right.
The same month, a separate case against OpenAI was annulled on comparable procedural grounds. Two high-profile annulments in the same window, both from process rather than merits, is a pattern worth watching rather than a coincidence to shrug off. As GDPR enforcement matures past its first wave of headline-grabbing fines, the next contest is less about whether the underlying conduct was unlawful and more about whether the regulator did its own job correctly on the way to saying so.