€80 Billion in claims, but no damage? lessons from dutch collective GDPR actions from 2020 to July 2026

This article examines the extent to which damage can be established in collective actions under the General Data Protection Regulation (GDPR), using a bottom-up analysis of Dutch collective cases between 2020 and July 2026. Since the introduction of the Dutch collective redress regime (WAMCA) in 2020, sixteen GDPR-related collective claims have been filed, with an estimated total value exceeding €80 billion. Despite the scale and apparent seriousness of the alleged infringements, it is uncertain whether these caused compensable damage. Drawing on publicly available case documents, this study analyzes the structure of these claims, the types of alleged infringements, and the forms of damage invoked. Then, the types of damage that may be claimed for such cases are discussed based on the current CJEU case law. The findings demonstrate that, although certain forms of harm—such as loss of control, fear of future misuse, and infringements of privacy—are theoretically recognized, they are difficult to substantiate in a collective context. Many alleged harms are either too abstract, insufficiently individualized, or lack a clear causal link to the infringement. As a result, even serious GDPR violations do not necessarily translate into compensable damage at scale. The article concludes that real life collective GDPR actions face structural evidentiary limitations in establishing damage. This raises broader questions about the effectiveness of collective redress as an enforcement mechanism under the GDPR and suggests a potential mismatch between the regulation’s protective aims and its practical capacity to deliver compensation.