An EU privacy watchdog, noyb, has filed a complaint against Whitebridge AI, a Lithuanian-based company, for selling illegal 'reputation reports' that scrape sensitive online data without consent.

Most of Whitebridge AI's data is claimed to come from 'publicly available sources,' but social media data that isn't indexed or searchable does not legally qualify as public data under GDPR.

The complaint alleges Whitebridge AI failed to inform individuals about data processing, citing exemptions that are not applicable, and violates multiple GDPR rights including access, rectification, and data protection principles.

Noyb, based in Vienna, is known for campaigning on data protection issues and enforcing GDPR compliance across Europe.

This action follows Noyb's history of legal cases against US tech giants like Meta and Google, emphasizing its broader effort to enforce GDPR and protect personal data rights.

Noyb filed the GDPR complaint against Whitebridge AI with Lithuania's data protection authority on September 29, 2025.

Whitebridge AI targets individuals with marketing slogans like 'this is kinda scary' and 'check your own data,' seemingly trying to scare people into paying for unlawfully obtained data, despite GDPR granting free access to personal data.

The reports contain sensitive and false information, including personality traits, background checks, political or religious content, and flags for nudity or political content, often based on unlawfully obtained social media data.

Noyb claims these reports include false and non-factual details, which individuals could not access or correct, highlighting violations of GDPR rights.

The personal details in the reports also include religious beliefs, alcohol consumption, toxic behavior, negative press, and flags for dangerous political or sexual content, all derived unlawfully from social media sources.