Making Friends Made Easy?
The Ruling of the Berlin II Regional Court dated December 2, 2025
The social network Facebook, which is part of the Meta Group, is designed to attract as many users as possible. The more people who use the platform, the more interesting and useful it becomes. This is known as the network effect. Facebook also aims to collect as much data as possible in order to generate as much revenue as possible through personalized advertising.
In order to attract people to the platform and collect data, Facebook violates data protection laws. This was determined by the Berlin Regional Court II in its ruling dated December 2, 2025 (Case No.: 15 O 569/18).
What was the case about?
The subject of the proceedings was the “Find Friends” feature. There are various ways to connect with people on Facebook. One of them is the so-called “Find Friends” feature. Using this feature, users can upload contact information stored on their devices to a Facebook server. This includes, for example, contacts saved on their cell phones or stored in email services. This works regardless of whether these contacts are registered on Facebook themselves or not. Facebook then uses the data for contact searches and contact suggestions.
The case also concerned user profiles of registered users that Facebook created for personalized advertising. To do this, Facebook analyzes Facebook activities, among other things, without the user’s consent.
What exactly is the issue?
The problem with the “Find Friends” feature is that data from individuals who are not even registered on the platform is stored on Facebook’s servers. These individuals have, consciously or unconsciously, chosen not to provide their data to Facebook. Nevertheless, their data ends up on Facebook and is processed there. In the court’s view, the average consumer should not have to expect this. Storing the data of people who do not use Facebook themselves also provides no added value for those individuals.
With regard to user profiles, the extensive data processing is problematic because it essentially serves to maximize Facebook’s profits rather than the users themselves.
So what does this mean?
The Berlin Regional Court II considers these practices to be unlawful. The court does not recognize any legal basis for such data processing. The Berlin Regional Court II has therefore ordered Facebook to refrain from accessing data belonging to individuals who are not registered with Facebook themselves. However, Facebook is not required to delete the data it has already collected.
You can find out whether your own data has ended up on Facebook even though you are not a Facebook user yourself. Under Article 15 of the GDPR, you have the right to access your data. To exercise this right, an informal request is sufficient. We’ve summarized more information about the right to access here (unfortunately, it’s currently only available in German). As a data subject, you also have the right to have your data deleted. We explain how to do that in this German article.
Regarding user profiles, the Berlin Regional Court II has ruled that Facebook requires users’ consent to create them. If such consent is not given, the creation of user profiles for advertising purposes is prohibited. In the court’s view, Facebook primarily pursues its own profit interests through this data processing. It is not necessary to create user profiles for users to use the platform.
The use of particularly sensitive data is covered by agreement
The plaintiff’s motion to prohibit Facebook from using particularly sensitive data for user profiles was denied. Examples of particularly sensitive data include religious or political views or health information. According to the plaintiff in the case, the consent obtained by Facebook for this purpose is invalid and not sufficiently transparent. The court, however, considers the consent obtained by Facebook to be sufficient and has dismissed the claim.
No Evidence of User Profiles for Unregistered Users
The plaintiff also accused Facebook of creating user profiles for unregistered users – a practice the plaintiff sought to have prohibited as well. This claim was dismissed as unfounded. The court had doubts that Facebook actually creates user profiles for unregistered users. Facebook had disputed this during the proceedings.
Good things come to those who wait – the course of the proceedings
The lawsuit has been pending since 2018. It first had to be determined whether the plaintiff even had standing to sue. The proceedings were stayed until this issue was resolved. In March 2025, the Federal Court of Justice ruled that consumer associations have standing to sue in cases of violations of the GDPR (judgment of February 27, 2025 – I ZR 186/17 in German). Following this clarification, the proceedings before the Berlin Regional Court II were resumed.
The judgment is not yet final. Facebook has filed an appeal. The plaintiff also intends to challenge the dismissed claims by filing a cross-appeal. Nevertheless, platforms and networks that use comparable features will now have to consider whether to continue this practice.
Are there similar cases?
Another case before the Berlin II Regional Court involves WhatsApp, which is also part of the Meta Group. In a ruling dated February 23, 2026 (Case No.: 52 O 22/17), the court prohibited WhatsApp from sharing data from WhatsApp and data from third parties who do not use WhatsApp with Facebook. The consent form provided by WhatsApp for this purpose was deemed invalid.
WhatsApp’s terms of service stipulated that WhatsApp and Facebook should have access by default to all phone numbers stored in the address book – including data from third parties who do not use either service themselves. WhatsApp and Facebook users were required to confirm that they were authorized to share this data.
Both cases demonstrate that the Meta Group wants to harvest data at any cost. In doing so, the company shows no regard for whether individuals use its services or not. These practices make it nearly impossible to avoid this data-harvesting frenzy and reveal the value that major tech companies place on data protection and fundamental rights.
Charlotte Werther, LL.M., is a lawyer and research associate at the Open Search Foundation e.V. As part of the PriDI project, she focuses on designing an open search infrastructure that complies with fundamental rights.
