[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhoqOHakLAS2GllXusrg88wcyxX3qE4Tf-42Rp0Z6e0A":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"44324635-465d-43e1-822f-abbbce3d5477","german-court-orders-social-media-platform-to-cease-unlawful-third-party-data-collection-via-business","91759ca8-5d13-43d3-a920-1b2e9ed3bf4b","German Court Orders Social Media Platform to Cease Unlawful Third-Party Data Collection via Business Tools","A German appellate court found that a social media platform acted as a joint controller under GDPR when its 'Business Tools' (e.g., tracking pixels, SDKs) collected personal data from third-party websites and apps without a lawful basis. The root cause is a failure to establish transparent, compliant data processing agreements and obtain proper consent before collecting data across external properties. This matters because businesses embedding such tools on their own sites may unknowingly become co-liable for GDPR violations, exposing themselves to regulatory action and civil damages. The €1,500 damages award signals that courts are willing to enforce individual data subject rights, raising the financial stakes for non-compliance significantly.","**Immediate actions:**\n- Audit all third-party tracking tools (pixels, SDKs, scripts) currently embedded on your websites and apps to assess GDPR lawfulness.\n- Implement or update a Consent Management Platform (CMP) to ensure valid, informed consent is obtained before any Business Tool activates and transmits personal data.\n\n**Long-term improvements:**\n- Establish formal Joint Controller Agreements (Art. 26 GDPR) with any third-party platform whose tools you embed, clearly defining each party's responsibilities.\n- Conduct annual Data Protection Impact Assessments (DPIAs) for all third-party integrations that process personal data at scale.\n- Embed privacy-by-design principles into the software development lifecycle so tracking tools are evaluated for compliance before deployment.\n\n**Detection & Monitoring measures:**\n- Deploy continuous website scanning tools (e.g., cookie crawlers) to detect unauthorized or undisclosed data collection by third-party scripts.\n- Monitor regulatory databases and court rulings in relevant jurisdictions to proactively identify compliance risks tied to tools you use.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 4(7) – Definition of Controller","GDPR Article 26 – Joint Controllers","GDPR Article 6 – Lawfulness of Processing","GDPR Article 82 – Right to Compensation and Liability","GDPR Article 35 – Data Protection Impact Assessment","NIST Privacy Framework PR.CO-P3 – Data Processing Transparency","NIST SP 800-53 PT-1 – Privacy Policies, Agreements, and Terms of Use","CIS Control 3 – Data Protection","CIS Control 12 – Network Infrastructure Management","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)",{},"published","2026-07-27T08:20:21.770557+00:00","2026-07-27T08:20:21.507+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=OLG_M%C3%BCnchen_-_36_U_1054\u002F25_e&diff=52504&oldid=0","olg-munchen-36-u-1054-25-e-53f01f","OLG München - 36 U 1054\u002F25 e",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":56,"name":57,"problem":58},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":60,"name":61,"problem":62},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]