A consumer-rights group in the Netherlands sued Amazon on Wednesday over its alleged practice of tracking website visitors’ online activity, using recently expanded legal provisions allowing class actions.

The lawsuit, filed in a Dutch court by the Stichting Data Bescherming Nederland, or SDBN, said Amazon is violating the European Union’s privacy law by monitoring visitors to popular websites through cookies, the pieces of code that identify individual browsers to create targeted advertisements, without their permission.

An EU law that took effect in June requires the bloc’s 27 member nations to introduce legislation that will make it easier for consumer groups to bring class-action cases against companies. Corporate lawyers are bracing for a wave of similar complaints representing large groups of consumers.

SDBN said the class-action lawsuit represents around five million Amazon account holders residing in the Netherlands. The organization is seeking damages for consumers and a court order to put a stop to Amazon’s data tracking. The lawsuit partly mirrors a 2021 regulatory penalty that Amazon was issued by Luxembourg’s privacy regulator, which fined the company $887 million over its use of personal data for advertising. Amazon is appealing that penalty.

“We hope by adding to the pressure, Amazon will at some point realize it’s too costly to keep doing what it’s doing,” said Anouk Ruhaak, chair of SDBN.

Last month, SDBN sued X, formerly known as Twitter, in a Dutch court. The class-action lawsuit also focuses on consumer data collected to create targeted ads.

An Amazon spokesperson said, “We disagree with these claims, and we will defend ourselves through the legal process. Maintaining the privacy and security of our customers’ information is a top priority and Amazon follows all legal requirements in the countries and regions where we operate.”

Ruhaak said the lawsuit is a way to seek redress for consumers because Amazon hasn’t changed its practices to correct the violations identified by Luxembourg’s privacy regulator two years ago.

Many large companies appeal European privacy fines, which can stretch to sums totaling up to 4% of global revenue, or €20 million, equivalent to around $21.1 million—whichever is higher. On Tuesday, U.S. software company Clearview AI won an appeal against a $9.1 million fine from Britain’s privacy watchdog. The regulator issued the fine last year and ordered Clearview AI to delete image data that it collected on U.K. residents and stop scraping data from the internet.

European consumer groups and privacy advocates have raised concerns about the long process of concluding regulatory cases. When a business appeals a regulator’s penalty, companies can delay making any changes that regulators might demand to improve privacy.

There is a trend toward individuals suing over potential privacy violations, sometimes coming on top of fines from regulators and piling pressure onto companies, said Carlo Piltz, partner at the Berlin-based law firm Piltz Legal.

“I strongly expect that we will see more lawsuits by consumer protection groups regarding data protection law violations,” he said.

The lawsuit against Amazon alleges the tech giant collects personal data from cookies tracking consumers’ behavior across different websites as well as on its own platforms. It then sends that information back to the company, which helps it to sell advertising space targeted to individuals.

“We want Amazon to stop collecting data in this way and using data in this way. What that means is, basically, don’t follow me around,” said Ruhaak.European privacy regulators have focused on how large companies use consumers’ data to create targeted online ads. Ireland’s data protection regulator fined Meta more than $400 million in January and said it can’t use online contracts to justify sending consumers ads tailored to their online activity. Meta is appealing the lawsuit and recently proposed a plan to regulators that would introduce paid subscriptions to Instagram and Facebook for users who don’t agree to provide their personal data for ad purposes.

Write to Catherine Stupp at catherine.stupp@wsj.com