December 23, 2025, 4:21 pm | Read time: 2 minutes
The Facebook and Instagram parent company Meta is once again in court over its handling of user data. The Austrian Consumer Protection Association (VSV) has filed a model declaratory action with the Hanseatic Higher Regional Court in Hamburg.
At its core, the case questions how extensive the company’s data collection truly was and whether it complies with European data protection law. The lawsuit is not intended to resolve individual cases of damage but to establish a binding legal basis that affected parties can later reference.
Data Collection Beyond Meta
According to the VSV, Meta’s data collection was not limited to activities within its own platforms. The company allegedly used technical tools to track which external websites users visited and what content they accessed there. Many affected individuals were unaware that this information was being collected and analyzed in the background.
Legally, this practice has already been partially assessed. In July 2023, the European Court of Justice ruled that such extensive data use without clear and voluntary consent violates the General Data Protection Regulation (Case C-252/21). The model declaratory action now aims to clarify the specific consequences of this ruling.
Class Action Against Meta Considers Settlement for Affected Users
ECJ Opens Door for More Advertising Without Consent
Inconsistent Rulings in German Courts
The lawsuit follows a multitude of individual cases in Germany. Courts have so far ruled inconsistently in these cases. About half of the lawsuits were dismissed, while in other cases, judges found data protection violations.
Attorney Max Baumeister, whose law firm is handling the lawsuit, sees a clear trend: “Judges increasingly recognize that these are significant violations of fundamental rights, not trivial matters that can be brushed off with 100 euros in damages.”
Possible Compensation for Affected Parties
If the court upholds the allegations, users could have concrete claims. Compensation demands of up to 5,000 euros are possible for adult affected parties. For minors, whose data enjoys particularly high protection, amounts of up to 10,000 euros could be possible.
Also of interest: ECJ Opens Door for More Advertising Without Consent
The key issue is how intensively Meta processed data and how severe the intrusion into privacy is in each case. The model declaratory action could pave the way for numerous further proceedings and increase pressure on Meta.