German Court Orders Social Network to Cease Unlawful Third-Party Data Collection and Pay Damages

A German appellate court (OLG München) found that an Irish social media operator had no lawful basis for collecting and processing personal data through business/tracking tools embedded on third-party websites and apps — a practice commonly associated with pixel tracking and similar technologies. This ruling underscores that passive, large-scale data harvesting without a valid legal basis (consent, legitimate interest, or contract) violates the GDPR, and courts are increasingly willing to award non-material damages to individuals. The €1,500 damages award, while modest, signals that Article 82 GDPR claims are actionable and scalable. Organizations deploying third-party tracking tools must ensure each data flow has a documented lawful basis before deployment, not after enforcement action.

Tactical Insight

Immediate actions

Audit all third-party tracking pixels, SDKs, and business tools currently embedded on your websites and apps to verify a documented lawful basis exists for each data flow.
Suspend or disable any data collection mechanisms lacking a valid GDPR legal basis (consent, contract, or legitimate interest) until compliance is confirmed.

Long-term improvements

Implement a formal Data Protection Impact Assessment (DPIA) process for any tool that collects personal data on third-party surfaces before deployment.
Establish a consent management platform (CMP) to capture, store, and respect user consent signals in line with ePrivacy and GDPR requirements.
Maintain a continuously updated Record of Processing Activities (RoPA) that maps every third-party data collection tool to its legal basis and data retention policy.

Detection & governance measures

Deploy automated website scanning tools (e.g., cookie crawlers) to detect undeclared trackers or pixels introduced via updates or third-party scripts.
Assign a Data Protection Officer (DPO) or privacy counsel to review and approve new business tool integrations before go-live.

Framework References

GDPR Article 6 – Lawfulness of processingGDPR Article 13/14 – Transparency and information obligationsGDPR Article 17 – Right to erasureGDPR Article 82 – Right to compensation and liabilityGDPR Article 35 – Data Protection Impact Assessment (DPIA)GDPR Article 30 – Records of processing activitiesNIST Privacy Framework PR.DS-P1 – Data processing policiesNIST SP 800-53 PT-1 – Personally Identifiable Information Processing and Transparency PolicyCIS Control 3 – Data ProtectionISO/IEC 27701 – Privacy Information Management System (PIMS)ITIL Service Design – Information Security and Privacy Management

Source

ThreatNoir coverageOLG München - 36 U 1054/25 e Read originalOLG München - 36 U 1054/25 e

PublishedJul 28, 2026