Facebook – Court Ruling (Germany, 2025)

The data subject is a user of the platform www.facebook.com provided by Facebook (now Meta), the controller. Facebook uses personalised advertising that is tailored to the online behaviour of network users. When the GDPR came into force, Facebook initially processed personal data for the placement of personalised advertising under the legal basis of Article 6(1)(b) GDPR, performance of a contract. From April 2023, Facebook changed the legal basis to Article 6(1)(f) GDPR, legitimate interest. Since November 2023, Facebook started implementing the pay or ok model, where users could choose to either consent to the use of their data for personalised advertising on its platforms or pay a subscription fee to prevent the processing. The data subject consented to the processing of his personal data for targeted advertising. In January 2024, the data subject demanded out-of-court compensation and deletion or restriction of his personal data due to unlawful processing of his personal data but he received no answer. The data subject filed a case before the Munich District Court (Amtsgericht München - AG München) claiming that Facebook processed his personal data unlawfully, in violation of Article 5(1)(a) GDPR because the processing was not necessary for the performance of the contract or to protect legitimate interests and he did not consent to the processing before November 2023. The data subject claimed that he was entitled to immaterial damages in the amount of €1,000 because receiving targeted advertising was unpleasant and frightening to him. He further demanded that Facebook would provide him with his personal data regarding his online behaviour collected before he consented to the processing in 2023, delete the data if it is processed exclusively for advertising purposes and restrict processing to purposes other than advertising, insofar as the data are necessary for platform use. First, the court held that the data subject had no claim against Facebook for non-material damages under Article 82(1) GDPR because he did not present and prove concrete damage. It stated that the mere infringement of the provisions of the GDPR is not sufficient to justify a claim for damages. The court held that the impairments presented by the data subject were not sufficient to justify a claim for damages for pain and suffering. Second, insofar as the data subject requests Facebook to delete the data that is processed exclusively for advertising purposes, this is precluded by the fact that the Facebook can and does process the personal data that it has used for the placement of personalised advertising for other permissible purposes. Data that is processed solely for advertising purposes therefore does not remain with Facebook. Third, the requested restriction of the use of personal data to processing purposes other than advertising purposes is precluded by the data subject’s consent to further use, as the data subject has thus also consented to the continued use of the information from his account. Consequently, the court ruled that the case was unfounded.