{"id":5048,"date":"2026-08-22T23:51:56","date_gmt":"2026-08-22T23:51:56","guid":{"rendered":"https:\/\/dilicheckrep.com\/case-study-aepd-fines-tiger-media-over-a-gdpr-article-27-eu-representative-gap\/"},"modified":"2026-09-16T08:32:30","modified_gmt":"2026-09-16T08:32:30","slug":"case-study-aepd-fines-tiger-media-over-a-gdpr-article-27-eu-representative-gap","status":"publish","type":"post","link":"https:\/\/dilicheckrep.com\/de\/case-study-aepd-fines-tiger-media-over-a-gdpr-article-27-eu-representative-gap\/","title":{"rendered":"Fallstudie: AEPD verh\u00e4ngt Geldstrafe gegen Tiger Media wegen Versto\u00dfes gegen Artikel 27 DSGVO-Vertretungspflichten"},"content":{"rendered":"

Last updated: August 2026<\/em><\/p>\n

Fallstudie: AEPD verh\u00e4ngt Geldstrafe gegen Tiger Media wegen Versto\u00dfes gegen Artikel 27 DSGVO-Vertretungspflichten<\/h1>\n

In 2025, the Spanish Data Protection Agency (AEPD) confirmed sanctions against Tiger Media Inc. following an investigation into advertising-related data processing and the company\u2019s compliance with the GDPR Article 27 EU representative requirement<\/strong>. This AEPD fine is a concrete reminder of a point many non-EU businesses underestimate: appointing an EU representative is not a formality buried in a privacy policy. It is an enforceable obligation, and Spanish data protection enforcement is prepared to act on it.<\/p>\n

This article treats the decision as a 2025 enforcement example (not breaking news) and explains what went wrong, why the AEPD rejected Tiger Media\u2019s representative arrangement, and what the EU representative requirement<\/strong> means in practice for other non-EU organisations.<\/p>\n

What Happened in the Tiger Media Case<\/h2>\n

The AEPD investigated Tiger Media Inc., the operator of an advertising platform used by publishers and advertisers, after identifying potential data protection issues connected with personal data processed through advertising technologies. In its final resolution (AEPD proceeding PS\/00480\/2025<\/a>), the AEPD confirmed two separate sanctions: \u20ac70,000 for an Article 6 GDPR issue and \u20ac50,000 for an Article 27 GDPR issue, bringing the total to \u20ac120,000 before reductions. Tiger Media applied the available reductions for recognition of responsibility and voluntary payment, bringing the final amount paid to \u20ac72,000.<\/p>\n

The Article 6 element concerned the lawful basis for processing carried out through the advertising platform. The Article 27 element is the key lesson for privacy teams supporting non-EU organisations because it turns on governance rather than processing details: did the company actually have a representative in the EU, properly appointed?<\/p>\n

Why the AEPD Considered the Representative Invalid<\/h2>\n

According to the AEPD\u2019s findings, Tiger Media had identified a representative located in Northern Ireland and stated that it was in the process of appointing a replacement representative in an EU Member State. The AEPD concluded that, as a result, Tiger Media did not currently have a valid EU representative for GDPR purposes.<\/p>\n

The distinction matters. A representative \u201cin process\u201d is not the same as a representative properly appointed in writing, established in the correct territory, and available to act as the EU-facing point of contact. The AEPD\u2019s resolution also noted that Tiger Media offered adult advertising services on at least three Spanish websites, connecting the processing to individuals in Spain and supporting the territorial-scope analysis under Article 3(2) GDPR.<\/p>\n

The company\u2019s stated intention to appoint an EU-based representative did not prevent the finding. From a regulator\u2019s perspective, that outcome is predictable: the Article 27 obligation applies once the processing falls within scope, not only once an investigation is underway.<\/p>\n

The Article 27 EU Representative Requirement Is More Than a Contact Address<\/h2>\n

GDPR Article 27 applies, broadly, where a controller or processor has no establishment in the EU but is nonetheless subject to GDPR under Article 3(2) \u2014 typically because it offers goods or services to people in the EU or monitors their behaviour there. In those circumstances, the controller or processor must designate, in writing, a representative in the Union, unless a narrow exception applies.<\/p>\n

The AEPD was explicit that a representative for a non-EU controller or processor is not simply a contact point. The role includes cooperation with supervisory authorities and support for accountability operations, and the AEPD noted that the absence of a properly appointed representative can affect the GDPR compliance system as a whole.<\/p>\n

For a fuller explanation of the obligation, see GDPR Article 27 EU representative<\/a>. For broader background, see EU data protection representative<\/a>.<\/p>\n

How the Advertising and Cookie Context Surfaced the Gap<\/h2>\n

Although the Article 27 finding is the central lesson, the wider investigation began with advertising-related processing. The AEPD reviewed the platform\u2019s role in delivering and measuring advertisements and recorded categories of data including device details, operating system, browser information, IP address, website and referral URLs, clicks, impressions, IP-derived location, and cookie identifiers. The AEPD also identified cookies being installed without consent on websites using the platform.<\/p>\n

This pattern is common in AEPD enforcement: an authority opens a review focused on cookies, consent, or lawful basis, and the review then expands into governance obligations \u2014 including whether the organisation has a valid EU representative in place.<\/p>\n

Who Should Reassess Their EU Representative Position<\/h2>\n

Non-EU organisations should reassess their Article 27 position if they have no EU establishment but intentionally interact with people in the EU through websites, apps, subscriptions, SaaS platforms, marketplaces, advertising, analytics, or tracking technologies. The relevant question is not whether the company is \u201cEuropean\u201d in branding terms, but whether its processing falls within GDPR\u2019s territorial scope.<\/p>\n

A review is particularly worthwhile if any of the following apply:<\/p>\n