2 days Ago By Niall Kitson
29 April 2025 Operators of online platforms must set default settings so that users’ personal data is not easily accessible to the public or strangers. That is what the Oberlandesgericht Frankfurt (OLG) am Main ruled in a judgment against Meta, Facebook’s parent company. The court based its ruling on the principle of data minimisation, as set forth in the General Data Protection Regulation (GDPR).
Meta violated this obligation, according to the court. Indeed, users had to adjust default settings themselves in order to adequately protect their privacy, the Hessian court portal reported on the 8 April, which will be officially published soon. Meta must pay the plaintiff €200 in damages.
The plaintiff had originally demanded €1,000. The court in Wiesbaden had initially rejected the claim entirely, but on appeal the OLG recognised that the plaintiff rightly feared misuse of her data disclosed via the darknet, in addition to the general loss of control over her personal data. The Sixth Civil Chamber of the OLG considered it plausible that the plaintiff developed “psychological complaints” due to these concerns, justifying the amount of damages.
The Federal Supreme Court had previously ruled that just the loss of control over data could justify damages of about €100. Tens of thousands of Facebook users worldwide have sued Meta for the unauthorised collection (scraping) of personal data. Scraping involves reading and processing public information from websites or through open interfaces (APIs) via automated techniques.
Under GDPR, this is prohibited without explicit consent if personal data is involved. Many GDPR cases revolve around a large-scale data breach, such as in 2021 in which about 533 million datasets of Facebook users from 106 countries became public. Unknown persons took advantage of a Facebook feature in which user profiles could be found via phone numbers, depending on the search options set.
By uploading large numbers of phone numbers through the contact import function and linking them to publicly available information, they collected personal data on a large scale. In 2022, the Irish data protection authority DPC fined Meta €265 million for this. Under the ruling Meta must ensure that users’ personal data cannot be accessed by unauthorised third parties, such as data scrapers, through default settings.
Emerce Read More: law Meta.
