DPF Litigation Tracker
Live tracker of every court case and regulatory challenge to the EU-US Data Privacy Framework. Status, next milestones, and what each outcome would mean. Updated monthly.
Every active challenge to the EU-US Data Privacy Framework, in one place. Last updated: June 12, 2026 · Next scheduled review: July 2026 · Get an email when this page changes: [form]
Current status, in one line
The DPF is in force. Transfers to certified US companies (including Google, Meta, Microsoft) are lawful. One appeal is pending before the EU's highest court. No ruling is imminent.
Active proceedings
1. Latombe v. Commission appeal (Case C-703/25 P)
| What it is | Appeal against the General Court judgment that upheld the DPF |
| Court | Court of Justice of the EU (CJEU) |
| Filed | October 31, 2025 |
| Status | Pending. No hearing date announced as of June 2026 |
| Realistic decision window | 2027-2028 (typical CJEU appeal duration: 1.5-2.5 years) |
| Stakes | The CJEU invalidated both previous frameworks (Safe Harbor 2015, Privacy Shield 2020). A successful appeal invalidates the DPF with immediate effect |
| Background | Full plain-language explainer ↗ |
History of this case: filed by French MP Philippe Latombe as a direct annulment action in September 2023 (T-553/23) → interim suspension rejected (October 2023) → General Court dismissed the action and upheld the DPF (September 3, 2025) → appeal filed.
2. Prospective noyb challenge
| What it is | Max Schrems' organization stated after the September 2025 judgment that it is considering its own, broader challenge to the DPF |
| Status | Not yet filed as of June 2026 |
| Why it matters | noyb's two previous campaigns produced Schrems I and Schrems II. Its complaints engine (the 101 complaints of 2020) is also how abstract rulings became concrete enforcement against Google Analytics |
3. The structural wildcard: US executive orders
Not a court case, but the DPF's foundation: the US redress mechanism exists by executive order, amendable by any US administration without notice. A material change on the US side could trigger Commission review or give the CJEU fresh grounds. We track public developments here as they occur.
Recently closed
| Proceeding | Outcome | Date |
|---|---|---|
| Latombe v. Commission, first instance (T-553/23) | DPF upheld by the General Court | September 3, 2025 |
| Latombe interim measures request | Rejected | October 2023 |
What each outcome would mean
- Appeal dismissed, no new challenge : status quo holds until at least the DPF's next periodic review. US analytics tools remain lawful under it.
- Appeal succeeds (full or partial invalidation) : no transition period, transfers lose their basis immediately, and the 2022 enforcement playbook against US tools reactivates ↗. The prepared migrate in days; the unprepared relive 2022.
- noyb files separately : a second front with a slower clock but the strongest track record in this field.
How to be ready regardless
The two-step insurance, detailed in our guide ↗ : know which of your tools send personal data to US companies, and keep your analytics history exportable. Or make the question moot: EU-owned, cookieless analytics has no stake in this docket ↗.
Changelog
- 2026-06-12 : Page created. Status: C-703/25 P pending, no hearing date; noyb challenge not filed.
- (chaque mise à jour s'ajoute ici : le changelog EST la preuve de fraîcheur)
Measure the money,
not the pageviews
Cookieless, EU-hosted analytics that ties every visit to real Stripe revenue. Free in beta.