DPA case Facebook/WhatsApp – Violation Found (Germany, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Germany's data protection authority found that WhatsApp's new privacy policy lacked a legal basis for processing user data. This ruling is significant as it challenges how companies can use personal data and emphasizes the need for clear consent.
What happened
WhatsApp requested users to accept new terms that allowed extensive data sharing with Facebook.
Who was affected
WhatsApp users who were asked to agree to the new terms and privacy policy.
What the authority found
The authority ruled that WhatsApp did not have a valid legal basis for processing user data under the new terms.
Why this matters
This decision indicates that companies must be transparent and have a legitimate reason for processing user data. It sets a precedent for how user consent should be obtained.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
WhatsApp requested its users to agree to the new terms and privacy policy by May 15, which grant WhatsApp far-reaching powers to share data with Facebook. That powers included among others the processing of location information, the transfer of communication data of users to third-party companies explicitly with reference to Facebook, the additional purpose of ensuring the integrity of the services, and the cross-company verification of the account in order to use the service in an "appropriate manner". Data can also be used to connect with products from Facebook companies. A legitimate interest is mentioned to be used as a basis for data processing related to minors, while the previously existing notice that WhatsApp messages are not shared on Facebook for others to see has been removed. The DPA states that there is no legal basis for processing by Facebook for its own purposes. The provisions on data transfers in the privacy policy are unclear and hard to distinguish while "the contents are misleading and show considerable contradictions" and the consequences of approval for the users are undefined. Furthermore, since WhatsApp demands acceptance of the new provisions as a condition for the continued use of the service's functionalities consent is not freely given. Facebook cannot claim a prevailing legitimate interest in processing the data of WhatsApp users because their interests are overridden by the rights and freedoms of the data subjects, while at the same time the processing is not necessary for Facebook to perform a contract. Moreover, data transfers are non transparent while the policy makes it possible to process data across companies for the purpose of sending direct advertising and marketing communications.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Facebook/WhatsApp in DE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Facebook/WhatsApp - Germany (2021). Retrieved from cookiefines.eu
Last updated: