Netherlands

Lawsuit against X over disclosure of user data and access rights in automated moderation decisions (No. 200.346.613/01)

On 14 April 2026, the Amsterdam Court of Appeal ordered X to provide a user with extensive access to their personal data under the General Data Protection Regulation, following an appeal concerning a temporary, automated account restriction that reduced the user’s visibility. The judgment clarifies the obligations of social media platforms and other platform intermediaries that process personal data and deploy automated decision-making systems. The Court held that internal system records, inc...

Amsterdam Court of Appeal ordered X to disclose user data and clarified access rights in automated moderation decisions

The Amsterdam Court of Appeal ordered X to provide a user with extensive access to their personal data under the GDPR, clarifying that internal system records including moderation labels and security logs constitute personal data.

Dutch AP presents vision for values-based generative AI

The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, presents its vision on generative artificial intelligence (AI) today. The supervisory authority outlines how generative AI can be used safely, responsibly and in line with fundamental rights. Looking ahead, the AP sees opportunities, but at the same time warns for real societal risks.

Dutch AP warns autonomous AI agents expose users to cyber dangers

The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, warns users and organisations against the use of OpenClaw and similar experimental systems. The reason for this warning is the rapid pace at which OpenClaw has gained popularity. This type of open-source systems typically do not meet basic security requirements. The use of such systems poses major risks of data breaches and account takeovers.

Authority for Consumers and Markets investigation into Roblox over alleged risks to minors under Digital Services Act

On 30 January 2026, the Netherlands Authority for Consumers and Markets (ACM) opened an investigation into the online game platform Roblox concerning possible risks faced by minors in the European Union. The investigation will examine whether Roblox has taken sufficient measures to protect minors, including measures addressing exposure to violent or explicit content, contact by bad actors, and the use of misleading techniques to stimulate purchases. The investigation follows a preliminary inq...

Guidelines on targeting and delivery of political online advertising

On 21 November 2025, the Dutch Data Protection Authority (AP) closes the public consultation, which had been open since 9 October 2025, on the guidelines on targeting and delivery of political online advertising. The consultation concerns AP’s guidance clarifying the rules on targeting and delivery of political online advertising under the Regulation on Transparency and Targeted Political Advertising (VPR). The VPR entered into force on 10 October 2025. The guidance explains requirements for ...

Dutch DPA flags risks in EU proposals on AI and data rules

De Autoriteit Persoonsgegevens (AP) heeft kennisgenomen van het officiële Omnibusvoorstel van de Europese Commissie. De Commissie zegt hiermee verschillende wetten, waaronder de Algemene verordening gegevensbescherming (AVG) en de AI-verordening, te willen aanpassen om digitale regelgeving te vereenvoudigen. Dat streven is te begrijpen, zolang het de rechten van mensen niet aantast.

US introduces Pax Silicia Initiative (with coalition of other countries)

Pax Silica is a U.S.-led strategic initiative to build a secure, prosperous, and innovation driven silicon supply chain—from critical minerals and energy inputs to advanced manufacturing, semiconductors, AI infrastructure, and logistics. Rooted in deep cooperation with trusted partners, Pax Silica aims to reduce coercive dependencies, protect the materials and capabilities foundational to artificial intelligence, and […]

Data Protection Authority inquiry into AI chatbots as voting assistants

On 21 October 2025, the Netherlands Data Protection Authority (DPA) issued a report examining the risks of using AI chatbots as voting aids for elections. The DPA found that chatbots provide strongly biased and polarised political advice, misrepresenting the Dutch fifteen-party system. In an experiment testing four chatbots with fictional voter profiles based on Kieskompas and StemWijzer data, two parties, GroenLinks-PvdA and PVV, dominated first-place recommendations, while parties such as C...

Data Protection Authority issues a report examining risks of using AI chatbots as voting aids for elections

Steeds meer kiezers gebruiken AI-chatbots om te bepalen op welke partij zij gaan stemmen bij de Tweede Kamerverkiezingen van 29 oktober. Maar deze adviezen zijn onbetrouwbaar en duidelijk gekleurd. Dat blijkt uit onderzoek van de Autoriteit Persoonsgegevens (AP).

Data Protection Authority investigation into Experian over alleged General Data Protection Regulation infringements

On 16 October 2025, the Dutch Data Protection Authority (AP) issued its decision maintaining the EUR 2.7 million fine imposed on Experian imposed 6 December 2023. In addition to the fine, the original decision issued two orders on Experian for infringements of Article 5(1)(a) in conjunction with Article 6(1) and Article 12(1) in conjunction with Article 14(1) and (2) of the General Data Protection Regulation (GDPR). These infringements related to Experian's failure to adequately inform data s...

Dutch Data Protection Authority and Netherlands Authority for Consumers and Markets joint statement on obligations for chatbot use in customer service

On 2 October 2025, the Dutch Data Protection Authority (AP) and the Netherlands Authority for Consumers and Markets (ACM) issued a joint statement requiring organisations that use chatbots in customer service to ensure that individuals are always able to communicate with a human representative. Organisations are required to clearly disclose when a chatbot is being used, and to guarantee that the chatbot does not provide incorrect, evasive, or misleading information. The regulators emphasised ...

Lawsuit concerning alleged violation of Digital Services Act (Bits of Freedom Foundation v Meta Ireland)

On 2 October 2025, the Amsterdam District Court ruled that Meta Ireland, the operator of Facebook and Instagram in Europe, violated the Digital Services Act (DSA). The court found that Meta's practice of automatically reverting to a profiling-based recommendation system, even after a user selected a non-profiling alternative, constitutes an illegal "dark pattern." The automatic switchback, which occurs when users navigate the app or close and reopen it, disrupts user autonomy and causes "choi...

Data protection authorities adopted joint statement on building trustworthy data governance frameworks to encourage development of innovative and privacy-protecting AI

Primary source (pcpd.org.hk) dated 17 September 2025 in NL. See linked source for full text.

Netherlands Authority for Consumers and Markets investigation into Snapchat over alleged violations of the Digital Services Act concerning illegal vape trade to minors

On 9 September 2025, the Netherlands Authority for Consumers and Markets (ACM) opened an investigation into the online platform Snapchat in connection with the illegal trade of vapourisers to minors, following an enforcement request submitted at the end of August by the Youth Smoking Prevention Foundation. The investigation focuses on whether Snapchat complies with the requirements of the Digital Services Act (DSA), in particular its obligations to take appropriate and proportionate measures ...

Dutch Data Protection Authority's whitepaper on meaningful human intervention in automated decision making

On 23 July 2025, the Dutch Data Protection Authority published guidance on implementing meaningful human intervention in automated decision-making systems under Article 22 of the General Data Protection Regulation. The guidance applies to data controllers across all sectors who deploy algorithms for individual decision-making that produce legal effects or significantly affect data subjects. The Authority establishes a four-pillar framework requiring human assessors to consider all relevant fa...

Data Protection authority inquiry into artificial intelligence and algorithms with a focus on emotion recognition systems

On 15 July 2025, the Dutch Data Protection Authority (AP) published its fifth edition report on Artificial Intelligence (AI and algorithms, highlighting the growing use yet contested effectiveness of AI emotion recognition systems across sectors, including customer service, healthcare, and wearables. The report warns these systems risk infringing fundamental rights, including privacy and autonomy and stresses organisations must critically assess, transparently deploy, and secure consent when ...

Dutch DPA publishes report on AI emotion recognition systems

De Rapportage AI & Algoritmes Nederland (RAN) gaat in op trends, risico’s en beheersing van de inzet van artificiële intelligentie (AI) en algoritmes. In deze vijfde editie gaan we in op overkoepelende ontwikkelingen, grondrechten en publieke waarden, beleid en regelgeving. Ook hebben we aandacht voor het belang van algoritmeregistratie.

Data Protection Authority inquiry on societal use of emotion Artificial Intelligence

On 6 May 2025, the Dutch Data Protection Authority closes a public consultation on the societal use of emotion Artificial Intelligence (AI) to inform its upcoming AI and Algorithm Risks Report. The consultation applies to emotion recognition technologies, including those embedded in consumer devices or used during customer service interactions. Such technologies interpret emotional states using biometric data including facial expressions or heart rate. The consultation aims to seek inputs to ...

DPA opens consultation on tools for meaningful human intervention in algorithmic decision-making

De AP ontwikkelt handvatten voor betekenisvolle menselijke tussenkomst bij algoritmische besluitvorming. Om deze handvatten goed aan te laten sluiten bij de praktijk vraagt de AP organisaties, experts en belanghebbenden via deze consultatie om input.

Authority for Consumers and Markets' Focus on Digital Economy 2025 strategy outlining enforcement priorities

On 12 May 2025, the Netherlands Authority for Consumers and Markets (ACM) released its Focus on Digital Economy 2025 strategy, outlining enforcement priorities across the EU digital regulatory landscape. The strategy applies to dominant online platforms, cloud service providers, application developers, e-commerce operators, and data intermediaries. It focuses on fair market access, consumer protection, reliable data sharing, and coordinated oversight. Key measures include monitoring complianc...

Dutch DPA launches consultation on emotion AI

In de komende Rapportage AI- & Algoritmerisico’s Nederland (RAN) doet de Autoriteit Persoonsgegevens (AP) een verkenning naar de inzet van emotie-AI in de samenleving. Met de RAN geven we inzicht in trends en ontwikkelingen van de inzet van algoritmes en AI in Nederland.

Data Protection Authority guidance prohibiting artificial intelligence systems for risk assessment of criminal offences

On 3 April 2025, the Dutch Data Protection Authority closes the public consultation on guidance prohibiting artificial intelligence (AI) systems for risk assessment of criminal offences. The consultation applied to the prohibition of AI systems for risk assessments of criminal offences under the European AI Regulation (2024/1689). The regulation bans AI systems that assess an individual’s likelihood of committing a criminal offence solely based on profiling or personality traits while allowin...

Dutch Data Protection Authority investigation into DeepSeek's cross-border data transfers compliance with General Data Protection Regulation

On 3 February 2025, the Dutch Data Protection Authority (AP) announced an investigation into DeepSeek's data transfer compliance with the General Data Protection Regulation. The investigation will examine whether DeepSeek is in compliance with the privacy conditions required for transferring personal data from European citizens to countries outside the European Union. Concerns have been raised about the storage of personal data, including that of Dutch users, on servers in China. The AP is ex...

Dutch DPA launches consultation on prohibited AI systems used for criminal risk assessment

De Autoriteit Persoonsgegevens (AP) vraagt input over verbod D uit de AI-verordening: AI-systemen voor risicobeoordelingen strafbare feiten.

Dutch AP and ACM warns companies from overusing AI, citing ‘one of the biggest annoyances’ people are facing

Organisaties die in hun dienstverlening chatbots gebruiken, moeten mensen altijd de mogelijkheid bieden om met een medewerker te spreken. Ook moeten organisaties duidelijk maken wanneer je met een chatbot te maken hebt en erop toezien dat de chatbot geen onjuiste, ontwijkende of misleidende informatie geeft.

Data Protection Authority investigation into Coolblue's alleged unsolicited use of cookies

On 24 December 2024, the Dutch Data Protection Authority (AP) imposed a fine of EUR 40,000 fine on Coolblue for unsolicited use of cookies. The ruling highlights Coolblue’s failure to obtain explicit consent from website visitors before collecting personal data through cookies. The AP found that Coolblue assumed visitor consent and used pre-checked boxes, violating the General Data Protection Regulation (GDPR).

Dutch Data Protection Authority source on AI governance

Official source record dated 18 December 2024 for The Netherlands concerning Dutch DPA calls for input on prohibition on AI systems for social scoring. See the linked autoriteitpersoonsgegevens.nl source for the authoritative text, procedural context, and implementation details.

Data Protection Authority guidance on use of AI systems for emotion recognition in workplace or educational institutions

Official source record dated 2024-12-17 for The Netherlands concerning Data Protection Authority guidance on use of AI systems for emotion recognition in workplace or educational institutions. See the linked autoriteitpersoonsgegevens.nl source for the authoritative text, procedural context, and implementation details.

Order designating ACM as competent supervisory authority for compliance with the European Data Governance Act (DGA)

On 19 November 2024, the designation of the Netherlands Authority for Consumers and Markets (ACM) as the supervisory body for the European Data Governance Act (DGA) came into force. The DGA mandates that that companies and platforms offering data mediation services (e.g. data-sharing platforms or PIMS) must register with ACM to continue operating. The DGA offers voluntary registration for data-altruistic organisations, including non-profits using data for public good, such as scientific resea...

Dutch DPA publishes Artificial Intelligence and Algorithmic Risks Report Summer 2024

Primary source (autoriteitpersoonsgegevens.nl) dated 11 September 2024 in NL. See linked source for full text.

Final recommendation on supervision of AI: sector and centrally coordinated

Dutch Data Protection Authority source on AI governance

Official source record dated 31 October 2024 for The Netherlands concerning Dutch DPA calls for input on prohibition on AI systems for emotion recognition in the areas of workplace or education institutions. See the linked autoriteitpersoonsgegevens.nl source for the authoritative text, procedural context, and implementation details.

Guide to AI Regulation

On 16 October 2024, the Government of the Netherlands adopted a guide on European Artificial Intelligence (AI) Regulation addressed to entrepreneurs and organisations involved in machine learning and AI development. The guide details the rules for responsible AI development and usage to safeguard public safety, health, and fundamental rights. The guide proposes steps for compliance with AI regulation, including a risk assessment, in order to determine if the AI system falls under prohibited, ...

Dutch DPA releases guidance on manipulative, deceptive and exploitative AI systems

De AP vraagt input op de eerste twee verboden uit de AI-verordening: manipulatieve en uitbuitende AI-systemen.

ACM statement on call-in competence to investigate smaller acquisitions

On 19 September 2024, the Dutch Authority for Consumers and Markets (ACM) issued a statement on its withdrawal of its request for the European Commission to investigate Microsoft's acquisition of the AI startup Inflection due to a recent ruling by the European Court of Justice. The Illumina/Grail ruling, issued on 3 September 2024, determined that the European Commission can only handle such requests if the national authority is also competent to investigate the acquisition domestically, whic...

Dutch Authority for Consumers and Markets guideline to implement Digital Services Act for intermediary service providers

On 12 September 2024, the Authority for Consumers and Markets (ACM) adopted its amended guidelines on the Digital Services Act (DSA) for providers of online services. The guidelines outline obligations for services under the Digital Services Act (DSA), which took effect on 17 February 2024 and clarify the rules that providers of these services must follow, and how they can comply. The guidelines explain DSA requirements for digital service providers. As a result of a previous round of consult...

Dutch Data Protection Authority Investigation into Uber's alleged transfer of drivers' data to the United States

On 26 August 2024, the Dutch Data Protection Authority (AP) issued a ruling in the investigation into Uber B.V. (Uber) for transferring European taxi driver's personal data to the United States of America in breach of the GDPR. The AP fined Uber EUR 290'000'000 for the failure to adequately protect personal data, which included sensitive information such as account details, location, criminal and medial records. The breach of the GDPR occurred over a period of more than two years.

AI Risk Report Summer 2024: turbulent rise of AI calls for vigilance by everyone

Data Protection Authority issues report on design requirements to mitigate risks in AI

Kunstmatige intelligentie (AI) maakt een stormachtige ontwikkeling door, maar staat als technologie deels nog in de kinderschoenen. Er wordt volop geëxperimenteerd: van een ‘rat race’ in generatieve AI door bigtechbedrijven tot op AI gebaseerde gedragsherkenningssystemen in supermarkten en sportscholen. De beheersing van de risico’s van AI-systemen gaat echter niet in hetzelfde tempo. Dat betekent voor Nederland dat zorgvuldige inzet voorop moet staan én dat we ons moeten voorbereiden op meer incidenten met AI. Waakzaamheid van burgers, bestuurders en volksvertegenwoordigers is daarom geboden.