Court case 4 U 353/24 – Court Ruling (Germany, 2026)

The controller is a company that operates several social media platforms, as well as software products grouped under the term “Business Tools“. Third parties can integrate the Business Tools into their websites and apps (subject to the controller’s Terms of Use) to track data subjects and display personalised advertising on data subjects’ social media platforms. Third parties process data subjects’ personal data (such as their IP address, operating system or time zone) and transfer this data to the controller. The data is processed regardless of whether the data subject is logged into one of the controller’s platforms. The business tools are used on a wide range of high-traffic websites and related apps. A data subject (who uses the controller’s platform for personal purposes) filed a claim with the Regional Court of Stuttgart. The data subject requesting the court to order the controller to stop processing their data through third party websites and apps, provide them with full access to their data, erase said data after providing complete access and pay the data subject a minimum of €5,000 in non-material damages. The Regional Court dismissed the claim, on the grounds that the data subject had not provided sufficient evidence to substantiate their claims. In addition, the court considered that the data subject actions were contradictory, as it demanded the controller to cease processing personal data while not accepting cookies. The court stated that the request for the erasure (Article 17 GDPR) and restriction (Article 18 GDPR) of the data subject’s data were not compatible with the injunction sought by the data subject. Finally, the court considered that the controller had provided the data subject with access in accordance with Article 15(1) GDPR. The data subject appealed the decision to the court. The data subject argued that the injunction against future data processing was justified, because the data is automatically transferred to the controller by third parties. Furthermore, the lower court interpreted the erasure and restriction requests too narrowly. Finally, the data subject argued that the “self help tool” of the controller did not fulfil their request for access. On the other hand, the controller argued that the data subject had not provided evidence on how third parties processed their data. The claim was also too vague and unfounded, as the data subject had not yet decided whether to consent to their data being processed for advertising purposes or pay an ad-free subscription (this is also known as “Pay or Okay”). According to the court, it must be assumed that the data subject visited websites that implemented the controller’s business tools, and therefore the data subjects’ data was collected and transferred to the controller. The data subject claimed this in general terms and specified it in relation to individual websites in the second instance; the court considered that the general claim in the first instance was sufficient to substantiate the data subject’s claims, including demonstrating that their personal data was unlawfully processed. The court also stated that the individual websites were responsible for obtaining data subject’s consent to process their data and transfer it to the controller. The court considered the controller and website operators as joint controllers, in accordance with CJEU case law.See C-40/17 (Fashion ID), margins 79, 81, 85, 102 However, as a joint controller, the company operating the social media platforms bore the burden of proof in demonstrating that the data subject consented to the processing. The court partially upheld the data subject’s claims. == The court dismissed three of the data subject’s claims on procedural grounds. First, the court dismissed the data subject’s request to declare that the user agreement did not allow the controller to process the data subject’s data through third parties. The court stated that it could bring an injunction and not a request for declaratory judgment. The court also dismissed the data subject’s request to order the controller to cease processing personal data on third party websites and apps without a legal basis (consent or legal bases under Articles 6(1)(b) to (e) GDPR). The court dismissed the data subject’s injunction claim for data erasure (Article 17 GDPR). According to the court, Article 17 GDPR does not grant a right to injunctive relief. However, the GDPR does not preclude national law from allowing these claims (e.g. Sections 823 and 1004 of the German Civil Code). In this case, however, the court considered that the controller lacked the conditions under national law to be liable for injunctive relief; specifically, the court considered the fact that the controller developed the business tools insufficient to consider that it had directly violated its obligations as a joint controller under Article 26 GDPR.This reasoning was the opposite to OLG Dresden, judgment of March 12, 2026, 17 U 625/25, p. 56 == The court first upheld the data subject’s request to order the defendant to not delete the processed data (Article 18 GDPR), but did not order the controller to leave the data at the location it is stored. Under Article 18(1)(b) GDPR, the data subject may request to restrict the processing if the processing is unlawful and they oppose the erasure of the data. The court considered that the data processing was unlawful, as the controller stored the data on security and integrity grounds without proving it had a legal basis under Article 6(1)(f) GDPR to do so. Specifically, the controller had not specified why it processed the data for security purposes, why it was necessary, or the storage periods. The court also upheld the data subject’s claim for access to information under Article 15(1) GDPR. The court stated that the controller had deliberately restricted the information provided through its “self help tools”, and had therefore not complied with its information obligations. The court considered these tools as particularly unsuitable to provide information on the processing of data outside the social network. Once this information obligation is fulfilled, the court stated that the controller had the obligation to fulfil the data subject’s request for erasure under Article 17(1)(d) GDPR (if the personal data is unlawfully processed). Finally, the court upheld the data subject’s claim for damages, but reduced it to €500. The claim for damages were well founded, as the controller violated the GDPR, and caused the data subject to suffer damage (loss of control over their data), and there was a causal link between the two.