Cases

From March to June 2026 the Estonian GDPR regulator — Andmekaitse Inspektsioon (AKI) — discontinued proceedings on all sixteen of my complaints. Without a single exception.

Different countries. Different articles. Different facts. One result.

The “foreigners are out of reach” excuse explains nothing

Six of the sixteen companies are established in the EU: Adform (Denmark), Quantcast and Pinterest Europe (Ireland), Telia, DEPO DIY and ESPAK (Estonia). Here AKI has full jurisdiction and the entire set of enforcement tools.

All six were closed. So it is not about reach.

What they were closed with

In 13 of the 16 cases the basis is one and the same — Art. 57(1)(f) GDPR: the supervisory authority handles complaints “to the appropriate extent”. In those same 13 cases it is added that the GDPR does not oblige the authority to issue an order on every complaint.

Legally this is correct. The CJEU confirmed the regulator’s discretion (C-768/21, 26 September 2024): a supervisory authority is not obliged to apply corrective measures in every situation.

The question is not the right to discretion. The question is what exactly turned out to be the appropriate extent. The regulator wrote it itself:

“Complaints related to cookies are not among AKI’s supervisory priorities.”

“In exercising discretion in supervisory proceedings, AKI takes into account, among other things, what possibilities the person themselves has to resolve the situation.”

“AKI has no grounds to doubt the company’s explanations.”

The last sentence is from the case against Adform. The complaint cited the published policy, where the cookie retention period is stated as roughly ten years. In correspondence the company replied: thirteen months. The regulator believed the company without checking.

How to read this section

Each case is a separate card: what was in the complaint, what the regulator decided, and exactly how it justified the refusal. The decisions are published in full.

Including what speaks against me. In the The Trade Desk case, AKI noted that the complaint was filed before the correspondence with the company had concluded — and that is a fair point. It is published together with the rest.

The refusals here matter more than the wins: they show on what grounds supervision takes up a case — or does not.

All cases

Grounds for refusal

How many times each ground appears in the decisions. A single decision usually cites several.

• 14/19 Art. 57(1)(f) — handled "to the appropriate extent"
• 14/19 the GDPR does not oblige issuing an order
• 7/19 no public interest / an individual request
• 5/19 "we take into account that the person can resolve it themselves"
• 5/19 the lead authority is another country (Art. 56)
• 4/19 cookie complaints are not a supervisory priority
• 3/19 no means of enforcement (third country)
• 1/19 no representative in the EU (Art. 27)
• 1/19 no grounds to doubt the company's explanations