OLG München - 36 U 1054/25 e
German court rules social media platform unlawfully processed user data via Business Tools, orders €1,500 damages.
The Higher Regional Court of Munich (OLG München) partially upheld a data subject's appeal against a social media platform operator for unlawful processing of personal data collected through Business Tools deployed on third-party websites and apps. The court held that the platform's processing of the data subject's personal data (including IP addresses, identifiers, visit times, and interaction data) violated the GDPR and the user contract, ordering cessation of processing, data erasure, and €1,500 in non-material damages. The ruling clarifies that data subjects need not identify every specific third-party website or app where their data was processed to substantiate GDPR violation claims.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Social Media Platform Operator?
Get an email when a new story names Social Media Platform Operator, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe OLG München ruling highlights the significant legal risk of deploying third-party 'Business Tools' (such as tracking pixels and SDKs) on websites and apps without ensuring GDPR-compliant data processing practices. The social media platform collected sensitive behavioral data—including IP addresses, identifiers, visit times, and interaction data—without a lawful basis, violating both GDPR and the user contract. This case matters because it confirms that individuals do not need to pinpoint every specific website or app where their data was misused to successfully claim damages. Operators and platform providers share accountability for how Business Tools process personal data across the web ecosystem, making diligent vendor and tool governance essential.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.