OLG München - 36 U 1054/25 e

A German appellate court found that a social media platform acted as a joint controller under GDPR when its 'Business Tools' (e.g., tracking pixels, SDKs) collected personal data from third-party websites and apps without a lawful basis. The root cause is a failure to establish transparent, compliant data processing agreements and obtain proper consent before collecting data across external properties. This matters because businesses embedding such tools on their own sites may unknowingly become co-liable for GDPR violations, exposing themselves to regulatory action and civil damages. The €1,500 damages award signals that courts are willing to enforce individual data subject rights, raising the financial stakes for non-compliance significantly.