Court case 3 U 31/25 – Court Ruling (Germany, 2026)

The controller is a company that operates several social media platforms, as well as software products grouped under the term “Business Tools“. Third parties can integrate the Business Tools into their websites and apps (subject to the controller’s Terms of Use) to track data subjects and display personalised advertising on data subjects’ social media platforms. Third parties process data subjects’ personal data (such as their IP address, operating system or time zone) and transfer this data to the controller. The data is processed regardless of whether the data subject is logged into one of the controller’s platforms. The business tools are used on a wide range of high-traffic websites and related apps. A data subject brought a case to the Mühlhausen Regional Court. According to the data subject, the “M Pixel“ (part of the Business tools) is designed to identify them, track their internet use outside of the social media platform, and draw inferences about their political views, health status or sex life/sexual orientation without their consent. In addition, the data subject claimed that the controller denied any data processing in relation to the Business Tools, following an access request from the data subject. The data subject argued that they could never know with certainty whether the controller is tracking them, and has therefore lost control over their data. The data subject requested the court to order the controller to provide access in accordance with Article 15 GDPR.This includes the data processed on third party websites and apps, what data the controller disclosed to third parties, the storage period, and whether the data was used for automated decision-making. In addition, the data subject requested the court to order the controller to completely erase and anonymise all data and to pay the data subject at least €5,000 in damages. The controller argued that the data subject had not provided substantiated evidence to support their claims (including the claim for damages). In addition, the data subject could exercise control over their activity-related data through the settings in their social media account. The controller argued that the third parties acted as controllers within the meaning of Article 4(7) GDPR. According to the controller, third parties are primarily responsible for processing the data and obtaining the consent from data subjects. Finally, the controller argued that the data processing was lawful because it was based on data subjects’ consent, and that it fulfilled its information obligations following the data subject’s access request. The Regional Court dismissed the claim in December 2024. According to the court, the controller fulfilled its information obligations. In addition, the data subject was not entitled to erasure under Article 17(1) GDPR, because they did not demonstrate that the processing was unlawful. Specifically, there was no evidence that the controller processed sensitive personal data (Article 9(1) GDPR). Similarly, the data subject did not have the right to anonymisation under Article 17(1) GDPR. Therefore, the data subject was not entitled to compensation. The data subject appealed the case to the higher regional court in January 2025, requesting a minimum of €1,500 in damages. The data subject amended their claim to exclude the request for anonymisation. The data subject added that they could not provide evidence of tracking through the Business Tools because they do not know when they are being tracked. The court first clarified that the company operating the Business Tools was the controller in accordance with Article 4(7) GDPR, as it had the authority to determine the scope of data processed using the tools. The court stated that it was irrelevant that the controller does not decide how third parties use the tools. At most, the company could be considered a joint controller with third parties (Article 26(1) GDPR), which would not limit data subjects from asserting their rights against the controller. == The court found a violation of Article 15 GDPR, as the controller had failed to fulfil its information obligations in relation to the data subjects access request. The data subject did not need to object to the processing in order to exercise the right to access, and the argument that the tools are an integral part of the Internet could not be used to dismiss the data subjects request. In addition, the court stated that the controller could not refuse an access request on the grounds that thousands of other data subjects had also requested access to their data. Finally, the court stated that the controller deliberately misunderstood the access request, and failed to provide information on the data storage periods and safeguards, the existence of automated decision-making, and disclosure of data to third parties. According to the court, the self-service tools of downloading your own data provided largely meaningless information that was not individualised. The court ordered the controller to provide the data subject access to information related to their off-site data, as well as the storage periods (including the country), and the existence of automated decision-making and logic involved. == The court found a violation of Article 17 GDPR. The court dismissed the previous courts ruling, and stated that its reasoning on the data subjects burden of proof risked violating the right to a fair trial under national law. According to the court, it is virtually impossible for data subjects to account for all their internet activities, especially if they regularly delete their browser history. In addition, the court considered that the average data subject would inevitably come in contact with the controller's Pixel, based on the fact that it is active on 30 to 40% of all websites. Therefore, the controller's involvement is beyond doubt, and this is sufficient to answer the question of the legality of the tools. Finally, the controller has the burden of proof, in accordance with the principle of accountability (Article 5(2) GDPR). This extends to demonstrating compliance with GDPR principles, such as purpose limitation. The court found that the controller processed personal data unlawfully through its Business Tools. The court found that the controller could not rely on any of the legal bases under Article 6(1) GDPR. Specifically, it could not rely on consent (Article 6(1)(a) GDPR), as the controller indiscriminately processed data subjects' data even if they do not consent. Similarly, it could not rely on contract (Article 6(1)(b) GDPR), as it did not explain why it is necessary to process data subjects' internet usage outside of its social media platforms for the performance of the contract. In terms of legitimate interests, the court stated that the controller failed to explain why the processing was necessary, and therefore it was not necessary to determine whether its interests outweigh data subjects' rights. Nonetheless, it referred to CJEU case law, stating that data subjects' fundamental rights and interests outweigh the controllers interest in enhancing profits through personalisation of advertising.See Case C‑252/21 (Meta Platforms Inc and Others v Bundeskartellamt), margin 117, https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62021CJ0252 or the GDPRhub summary of the case: CJEU - C-252/21 - Meta Platforms and Others (General terms of use of a social network) Finally, the court found that the controller had unlawfully processed sensitive personal data (Article 9(1) GDPR) by linking sensitive data on websites visited by the data subject to their profile on the social media platform. The court found it sufficient that the websites and apps are related to sensitive information and that it is only possible to infer aspects such as political orientation when considering the data collected as a whole. The court stated that the data subject had the right to have their data erased in relation to the Business Tools, as none of the grounds for exclusion under Article 17(3) GDPR applied. The court noted that a self-service tool was not sufficient to fulfil this right, and that the data subject was not required to use it or accept the complete deletion of his social media platform profile. The court ordered the controller to erase all personal data on third party websites and apps used to identify the data subject within six months. == The court found that the conditions under Article 82(1) GDPR were met; the controller processed data unlawfully, the data subject suffered damage (loss of control over their data), and there is a link between the infringement and damage. The court noted that the controller could not avoid liability by referring to its terms of use with third parties. Therefore, the court considered the amount of €3,000 in non material damages as appropriate. The court took into consideration the potential sensitive data processed (Article 9 GDPR), the loss of control and the duration of the violation.