Data subject – Court Ruling (Germany, 2026)

The controller (the operator of multiple large social networking platforms) offered "Business Tools" that third-party website and app operators could integrate into their services. These tools transmitted visitors' personal data, such as identifiers, contact details, browsing information and interaction data, to the controller. The data subject had used the social network since 2021. He had not consented to the controller's use of personal data transmitted through these Business Tools. The data subject brought proceedings seeking, among other things, a declaration that the user contract did not permit the processing of such data, an injunction against further processing, restrictions on the use of already collected data, deletion or anonymisation of the data, and compensation under Article 82 GDPR. The first-instance court rejected the declaratory claim, partially granted an injunction concerning the storage of off-site data, and dismissed most of the remaining claims. Both parties appealed. The court distinguished between two types of processing: the collection of personal data on third-party websites and apps through the controller's Business Tools, and the storage and further processing of data after transmission to the controller. Regarding the collection of data on third-party websites and apps, the court found that the controller and the third-party website operators were joint controllers under Article 26 GDPR. The controller failed to prove that the data subject had consented. However, the court rejected the injunction request against the controller for this stage of processing because the immediate infringement resulted from the conduct of the third-party website operators. The controller had contractually required website operators to obtain a valid legal basis and had not breached any specific duties arising from Article 26 GDPR. Third, the court held that the controller unlawfully stored personal data received through the Business Tools. The controlle