Key highlights of our 2026 results by season

We continue producing real change by challenging governments and corporations that use data and technology to exploit us.

2026 has been intense! And we have achieved some wins that we are excited to share with you.

This spring, France’s highest administrative court upheld a data protection fine against an ad company we targeted; the UK government took steps to better regulate the use of facial recognition technologies (FRT); we were featured by well-known musicians; and we saw further initiatives to regulate the use of FRT in Brazilian schools, driven by our partners.

Below is a quick overview of the main results we produced or contributed towards this spring.

Spring 2026

France’s highest administrative court confirms fine against Criteo for GDPR violations

On 22 June 2023, following our complaint, the French data protection authority (CNIL) imposed a €40 million fine on Criteo, one of the world’s largest AdTech companies, for unlawfully collecting personal data.

In the same year, Criteo appealed the decision before the Conseil d’État (France’s highest administrative court).

In March 2026, the Conseil d’État rejected the appeal and confirmed the regulator’s decision. In its decision the Court reiterated that pseudonymised identifiers may constitute personal data under the GDPR where individuals remain identifiable.

What it means in short: AdTech companies are accountable for privacy violations.

UK Government takes steps to regulate secret facial recognition searches

Following advocacy undertaken by PI and Big Brother Watch, in 2025 the UK Home Office published new guidance on “Handling facial image search requests from law enforcement organisations”; and deployed a consultation to develop a new legal framework.

In 2026, we’ve seen further results of our action.

On 8 April 2026, the UK Parliament’s Office of Science and Technology published their Facial recognition technology in policing report, which references our work and summarises our concerns about FRT.

What it means in short: Although the UK Government has taken steps to regulate use of facial recognition technology by law enforcement agencies, we remain committed to challenging this problematic practice.

New steps on better regulation of FRT use in Brazilian schools
Research by our partner InternetLab has informed a Brazilian proposed law to regulate facial recognition and other biometric technologies in schools.

In March, the Brazilian Ministry of Education also published a Framework for the Development and Responsible Use of Artificial Intelligence in Education. The document reflects some recommendations from InternetLab and discourages the use of FRT in educational settings.

What it means in short: Facial recognition technology in schools should be banned. PI partner InternetLab’s advocacy drove practical action by governmental bodies in Brazil.

Our demands in the new release by Massive Attack

In April 2026, the legendary English trip hop collective Massive Attack released its new single Boots on the Ground.

In this anti-war, anti-authoritarian song, the band criticises excessive militarisation of abusive state power. The official video features Privacy International as one of the sources that inspired the song’s manifesto.

What it means in short: We are proud to be a trusted source of information on data and technology for artists and cultural content producers around the world.

Please consider supporting us as we continue our work to protect privacy and human rights around the world.