Facebook scraping: users can join data protection lawsuit from today

Facebook users can now join a data protection lawsuit that the Federation of German Consumer Organizations (vzbv) has filed against Meta after millions of data records containing personal data appeared online. The Federal Office of Justice has now opened the so-called register of complaints, in which those affected can register.

The background to this is a data protection incident in which unknown persons had automatically accessed personal data from hundreds of millions of Facebook users ("scraping"). In 2018, the company confirmed that user data could be systematically collected via Facebook's developer API through automated retrievals. In 2019, 419 million such data records appeared on the internet. Users in Germany affected by this can now secure their claims with the class action lawsuit.

After the Federal Court of Justice largely clarified the German legal situation regarding non-material damages last November in what is known as a landmark ruling in the Facebook scraping case, the loss of control in cases such as the mass reading of inadequately protected data is considered sufficient grounds for damages.

The basic prerequisite for joining the lawsuit is that public personal data was stored in a Facebook profile in 2018 or 2019. Anyone who meets these criteria can now join the lawsuit at the Federal Office of Justice $(LE https://www.bundesjustizamt.de/DE/Themen/Verbraucherrechte/VerbandsklageregisterMusterfeststellungsklagenregister/Verbandsklagenregister/Verbandsklagen/Klagen/202502/VRUG_2_2025.html?nn=14162:der).

vzbv: Up to 600 euros in damages

"With the BGH ruling behind it, the vzbv is committed to ensuring that those affected by the Facebook data leak are financially compensated," says Jutta Gurkmann from the vzbv. The consumer protection association filed the lawsuit in December, just one month after the Federal Court of Justice awarded immaterial damages to an individual plaintiff.

The consumer advocates consider up to 600 euros per affected person to be realistic. And this depends on how much data was accessed in the incident, i.e. whether an email address, Facebook ID, date of birth, place of residence or relationship status were affected in addition to a telephone number. The consumer protection organizations have published a guide that potentially affected parties can use to check whether and, if so, which claims they can assert.

If successful, it can be expensive for Meta

The so-called model declaratory action is conducted by consumer associations as a centralized procedure and does not involve any cost risk for consumers. At the end, a settlement or a declaratory judgment can be reached: If the proceedings end in favour of the plaintiffs, those affected can then assert their claims in a simplified procedure if the defendant does not voluntarily acknowledge the claims.

This route is possible regardless of the enforcement of data protection law by the data protection supervisory authorities: the Irish Data Protection Commission had already imposed a €265 million fine on Meta in 2022 for the incident. If many German Facebook users were to join the lawsuit, this could massively increase the costs for Meta as a result of the data leak.

(nie)