Meta Platforms Inc – Court Ruling (Germany, 2025)

The plaintiff is a consumer organisation registered as a qualified entity from another Member State of the European Union within the meaning [https://eur-lex.europa.eu/eli/dir/2020/1828/oj/eng Directive 2020/1828]. The respondent, and controller, is the subsidiary of Meta Platforms Inc., Meta Platforms Ireland Ltd. On 14 April 2025, Meta announced, via press release and via in-app notifications and emails, that from 27 May 2025 it would start using the public content of adult users and their interactions to train its AI models in its products. On 27 June 2025, the plaintiff filed a preliminary injunction application before the higher regional court (Higher Regional Court Schleswig-Holstein - OLG Schleswig). It requested that Meta stops, for the purpose of the development and improvement of AI technologies and regarding consumers in Germany, the processing of: 1. personal data published by users on their Facebook and Instagram accounts and personal data collected about them by third parties and transmitted to Meta on the basis of legitimate interest, 2. special categories of personal data published by them on the Facebook and Instagram services without their explicit consent, and 3. content created and shared by users on the Facebook and Instagram services for use outside of these services without providing for this in the General Terms and Conditions for the respective platform usage agreements. 4. in the alternative, to prohibit Meta from combining personal data from Facebook with personal data from Instagram and/or to further use personal data from Facebook and/or Instagram in other services provided by Meta without giving end users the specific choice and obtaining their effective consent. The plaintiff argued that the contested data processing violated Article 6 and Article 9 GDPR, as well as the prohibition of merging and the prohibition of further use under Article 5 DMA. It further claimed that no effective objection was made possible for the data subjects, especially if they were not registered users of Meta’s platforms. It also argued that data from advertising partners would also be used for the development of the AI applications. On the other hand, Meta claimed that compliance with the provisions of Article 6 and Article 9 GDPR was ensured by the de-identification and tokenisation of the individual learning data sets. Obtaining the consent of users to the processing of their data for the development and improvement of AI models was disproportionate. It further claimed that the likelihood that its AI model will extract personal data from private individuals is extremely low, due to the various protective measures taken. Lastly, Meta stated that "AI at Meta" is not a separate service, but an integrated function of all its platforms. The court rejected the interim injunction application as inadmissible. The court held that the element of urgency required for the issuance of an interim relief, under the Federal Act Against Unfair Competition (§12UWG), the Act on injunctions in consumer law and other infringements (§5 UKlaG) and ECJ case law ([https://curia.europa.eu/juris/liste.jsf?language=en&num=C-465/93 Case C-465/93]), was absent. The further questions of admissibility, in particular with regard to the active legitimation of the plaintiff for the injunction, and the question of the merits of the application are therefore irrelevant. First, it held that it remains undisputed that the plaintiff in the injunction was already aware of the conduct complained of due to Meta’s announcements some time before it began. In particular, the processing of personal data based on legitimate interest instead of consent, the processing of special categories of personal data, the use of the content published on Facebook and Instagram to develop and improve AI technologies outside these services (like Meta’s AI application ‘Llama’), the processing of personal data of data subjects appeared in institutional profiles and that the processing would affect more people, where all known from the emails sent by Meta. Insofar as the plaintiff claimed that Meta actually uses personal data of its users for AI training, which it receives from advertising partners, it has not made this disputed allegation credible. Second, the court held that the plaintiff waited for a month to file the application for a preliminary injunction after becoming aware of Meta’s alleged imminent infringement, so there was no longer any urgency with regard to the requested legal protection. The plaintiff also failed to demonstrate a valid reason as to why it waited until Meta had actually began the objectionable conduct to file the application. Nevertheless, the court pointed out that de-identification and tokenisation can be completely or partially reversed. Against this background, the processing of special categories of personal data covered by Article 9 GDPR cannot be processed under the legal basis of legitimate interest. It should also be borne in mind that it is not possible for data subjects to find out whether their data are being unlawfully processed in the AI’s learning data set and AI model itself.