DSB (Austria) - D130.200
Austrian DPA upholds complaint against Google LLC for YouTube data access.
The Austrian Data Protection Authority (DSB) upheld a complaint against Google LLC regarding an access request for YouTube data. The complainant argued that Google provided incomplete information, excluding data processed via cookies or Facebook pixels. The DSB ruled that Google LLC was the responsible controller and ordered them to provide the data subject with a full copy of their personal data on YouTube, emphasizing the importance of the right to access.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google LLC?
Get an email when a new story names Google LLC, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGoogle failed to fulfill a complete data subject access request (DSAR) under GDPR Article 15 by omitting personal data processed through cookies and third-party tracking pixels (e.g., Facebook Pixel) on YouTube. This partial disclosure violates the fundamental right of individuals to know what personal data is held about them and how it is processed. The Austrian DSB ruling reinforces that controllers must account for all data processing activities — including those facilitated by third-party technologies embedded in their platforms — when responding to access requests. Incomplete DSARs erode user trust, expose organizations to regulatory enforcement, and signal broader gaps in data inventory and governance practices.
