LiveRamp Holdings, Inc.
- Complaint filed
- 25.03.2026
- Decision
- 15.05.2026
- Time to decision
- 51 days
- Decision number
2.1-1/26/614-1269-2- GDPR articles
- 57
cde6bda2c4b6b34ee6791384059b1a783fa93d5df78178d7654cd04759dd9263The document is published in full. The complainant's personal data (email address) has been removed from the document.
Grounds for refusal
- Art. 57(1)(f) — handled "to the appropriate extent"
- the GDPR does not oblige issuing an order
- "we take into account that the person can resolve it themselves"
- no public interest / an individual request
- no means of enforcement (third country)
- no representative in the EU (Art. 27)
- cookie complaints are not a supervisory priority
- the lead authority is another country (Art. 56)
What was in the complaint
18 February 2026 — an Art. 15 request to privacy@liveramp.com and dpo@liveramp.com. Both letters immediately bounced with an error BOUNCE 550 5.1.1 — the addresses do not exist.
An attempt via the liveramp.uk portal — the portal is available only to UK residents. As a resident of Estonia, the complainant could not file a request.
20 March — repeat letters to ukprivacy@liveramp.com and cil@liveramp.com. By 25 March (35 days) — no reply.
The fact of processing is technically proven: a persistent LiveRamp identifier was found in the delfi.ee cookies.
Articles: 12(1), 12(2), 12(3), 37(7).
What AKI decided
Proceedings discontinued. Grounds: Art. 57(1)(f); the company has not appointed a representative in the EU (Art. 27) — and it is precisely for this reason that AKI has no means of enforcement. Separately: cookie complaints are not among the supervisory priorities.
Analysis
This case is the keystone of the whole construction. LiveRamp did not comply with Art. 27 (no representative in the EU), and AKI directly named this as the reason for its powerlessness: there is nothing to compel a controller in a third country with.
The result is a paradox: non-compliance with Art. 27 works as immunity. A company that has not set up a European representative turns out to be unreachable precisely because it has not set one up.
On top of that, the contacts for requests either do not exist (bounce 550) or are available only to UK residents. The right of access exists — but exercising it is physically impossible. This is itself a breach of Art. 12(1)/12(2), but it went without consequences.