What is the issue?
On May 23, 2025, the Higher Regional Court of Cologne (Oberlandesgericht Köln, OLG Köln) ruled in summary proceedings that the parent company of Facebook and Instagram may use personal data from users’ public profiles to train its AI. “Summary proceedings” refers to proceedings for interim relief in which an application by the Consumer Advice Center of North Rhine-Westphalia (Verbraucherzentrale NRW e.V.) against Meta Platforms Ireland Limited (“Meta”) was rejected after summary examination. The consumer protection agency wanted to prevent Meta from processing publicly available user data, as announced for the coming week. However, the consumer association can still pursue the matter in separate main proceedings.
No data protection violation
This affects data from consumers and third parties in profiles publicly posted on Meta (i.e., Facebook, Instagram), unless users have objected. Meta does not obtain consent for this. Rather, this separate processing is based on the legal basis of “legitimate interest” under Art. 6 (1) (f) of the General Data Protection Regulation (GDPR). The Irish data protection authority responsible for Meta had already raised no objections to this, and the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragte für Datenschutz und Informationsfreiheit) also considered this to be legally possible for data made public on Meta from 2024 onwards. This has now been confirmed by the 15th Civil Division of the Higher Regional Court of Cologne (15 UKl 2/25). According to the court, there was no violation of the provisions of the GDPR or the Digital Markets Act (DMA).
Meta is pursuing a legitimate purpose with the use of artificial intelligence systems for training purposes. This purpose cannot be achieved by other equally effective means that would be less intrusive. There is no doubt that large amounts of data are required for training purposes, which cannot be reliably anonymized in their entirety. Therefore, when balancing the rights of users and Meta, the latter’s interest in data processing prevailed.
This legal opinion is also supported by a statement issued by the European Data Protection Board (EDPB) in December 2024. Meta has taken the EDPB’s concerns into account by implementing various measures. In particular, only publicly available data that can also be found by search engines will be processed, and the use of third-party data or data from minors will be minimized or mitigated. The data used does not contain any unique identifiers such as the name, email address, or postal address of individual users. The data subjects were also informed in advance by Meta and can switch the data processing by Meta to “non-public” or object to the planned use of their data for training purposes.
However, I believe that due to the large amounts of mostly very private data, such a balancing of interests and risks pursuant to Art. 6 (1) lit. f) GDPR may also result differently.
No violation of the prohibition to combine data
According to the OLG Köln, there is no violation of Art. 5 (2) DMA due to the lack of a “merging” of data (lit. b)), as Meta (as a provider of “central platform services,” a so-called “gatekeeper” within the meaning of Art. 2 and 3 DMA) does not, according to its own statement, combine data from user profiles on different services or from other sources with regard to a single specific user within the scope of the intended procedure. However, the court lacked sufficient references in the form of relevant case law and feedback from the EU Commission, who should be involved in such matters under the DMA, which simply is not possible or provided for in summary proceedings. Legally speaking, this is – inevitably – a rather weak basis for the decision.
Conclusion
As mentioned above, the decision of the Higher Regional Court of Cologne was initially based merely on a summary, i.e., “only” preliminary legal review. This is not the result of a thorough main proceeding and evidence hearing. If this happens, which I assume it will, the cards could be reshuffled.
