Meta Faces Data Protection Scrutiny in Germany and Beyond
Recent legal rulings and ongoing investigations are intensifying scrutiny of Meta’s data practices in Europe, particularly concerning the use of personal data for artificial intelligence (AI) training and the handling of user information outside of explicit consent agreements. These developments highlight the complex interplay between data privacy, innovation, and the evolving regulatory landscape surrounding AI.
German Court Ruling on AI Training Data
In May 2025, the Higher Regional Court of Cologne ruled that Meta can utilize publicly available data from Facebook and Instagram profiles to train its AI models. This decision overturned a challenge from a consumer association that argued the practice violated the General Data Protection Regulation (GDPR). The court found Meta had a legitimate interest in using the data, and that users had options to prevent their data from being used, such as adjusting privacy settings or formally objecting.
The court’s reasoning centered on the fact that Meta was only processing data already publicly visible and indexable by search engines. This ruling is considered a significant development in European data protection law, potentially paving the way for broader use of publicly available data in AI development.
Damages Awarded in Separate German Ruling
As of March 2, 2026, Meta has been ordered to pay €3,000 in damages for secretly collecting user data through “business tools” even when users were not logged in. The Jena Higher Regional Court found this practice to be a violation of European data protection law, specifically citing concerns about transparency, data minimization, and the collection of sensitive information, including data related to mental health and medical inquiries.
The court mandated that Meta provide the plaintiff with comprehensive information about all stored data and delete it. An appeal to the Federal Court of Justice is permitted, leaving the final outcome uncertain.
Broader Regulatory Challenges for Meta in Germany
Beyond these specific rulings, Meta continues to navigate broader regulatory challenges in Germany. The Bundeskartellamt, Germany’s federal competition authority, concluded a proceeding in October 2024 concerning Meta’s data handling practices. This resulted in measures designed to give users more control over how their data is combined across different Meta services, including Facebook and Instagram.
The authority initially prohibited Meta from combining personal user data from different sources without user consent in February 2019. After years of legal challenges, including confirmations from the Federal Court of Justice and the Court of Justice of the European Union, Meta implemented changes deemed sufficient by the Bundeskartellamt to close the case.
Implications for the Future of AI and Data Privacy
These cases underscore the growing tension between the desire to foster AI innovation and the need to protect individual data privacy rights. The German courts’ rulings suggest a willingness to allow data use for AI training under certain conditions, particularly when data is publicly available and users have control over its use. Still, the damages awarded in the secret data collection case demonstrate that unauthorized or opaque data practices will not be tolerated.
As AI continues to develop, similar legal battles are likely to emerge across Europe, shaping the future of data protection and AI regulation. Companies developing AI models will need to prioritize transparency, user control, and compliance with GDPR to avoid legal challenges and maintain public trust.