Facebook – Court Ruling (Germany, 2025)

The data subject is a user of the platform www.facebook.com provided by Facebook (now Meta), the controller. Facebook uses personalised advertising that is tailored to the online behaviour of network users. When the GDPR came into force, Facebook initially processed personal data for the placement of personalised advertising under the legal basis of Article 6(1)(b) GDPR, performance of a contract. From April 2023, Facebook changed the legal basis to Article 6(1)(f) GDPR, legitimate interest. Since November 2023, Facebook started implementing the pay or ok model, where users could choose to either consent to the use of their data for personalised advertising on its platforms or pay a subscription fee to prevent the processing. The data subject consented to the processing of his personal data for targeted advertising. In January 2024, the data subject demanded out-of-court compensation and deletion or restriction of his personal data due to unlawful processing of his personal data but he received no answer. The data subject filed a case before the Munich District Court (Amtsgericht München - AG München) claiming that Facebook processed his personal data unlawfully, in violation of Article 5(1)(a) GDPR because the processing was not necessary for the performance of the contract or to protect legitimate interests and he did not consent to the processing before November 2023. The data subject claimed that he was entitled to immaterial damages in the amount of €1,000 because receiving targeted advertising was unpleasant and frightening to him. He further demanded that Facebook would provide him with his personal data regarding his online behaviour collected before he consented to the processing in 2023, delete the data if it is processed exclusively for advertising purposes and restrict processing to purposes other than advertising, insofar as the data are necessary for platform use. First, the court held that the data subject had no claim against Facebook for n