Setback for WhatsApp: Berlin Regional Court prohibits data transfer to Facebook

The years-long legal dispute between the Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband, vzbv) and the US company WhatsApp has reached a preliminary climax. Almost a decade after the controversial change to the terms of use in 2016, Civil Chamber 52 of the Berlin Regional Court II has now issued a ruling that significantly impacts the messenger service's data protection practices in Germany. At its core, the issue is how transparently and voluntarily users had to consent to their data being linked with the Facebook parent company. It was also disputed whether WhatsApp even had the right to request information about uninvolved third parties from users' address books.

With their decision of February 23, now made public, the Berlin judges ordered WhatsApp to cease and desist from transferring personal data of German users and information from non-users to Facebook (File No.: 52 O 22/17). This applies when such a transfer is based on the consent challenged in the proceedings.

The court thus criticizes the way WhatsApp attempted to obtain the consent of its user base in the summer of 2016. At that time, users were pressured via push messages and the website to agree to new terms. These provided for extensive data exchange between the platforms. The court viewed the inclusion of third-party data particularly critically. According to the policy at the time, users were to confirm across the board that they were authorized to provide all phone numbers from their contacts – including those of people who do not use WhatsApp at all.

Unzulässige Klauseln und Rechte Dritter

In addition to the ban on data transfer, the chamber also declared specific provisions of the then-current privacy policy inadmissible. WhatsApp may no longer use these clauses against consumers habitually residing in Germany or rely on them when processing existing contracts.

This strengthens the position of consumer advocates. They have been arguing for years that the linking of services occurred without a real choice for users. The ruling clarifies that global corporations cannot design their general terms and conditions independently of local consumer protection standards, especially when it comes to sensitive communication metadata.

Nevertheless, the ruling is not a complete victory for the vzbv. The judges dismissed an important aspect of the lawsuit: the request to compel WhatsApp to actively urge Facebook to delete already transmitted data and to prove this process. Here, the court apparently saw no legal basis. For those affected, this means the data flow that has already occurred in the past remains irreversible for now, even if the underlying consent is now considered unlawful.

Vorläufiger Teilerfolg für Verbraucherschützer

The role of data protection authorities likely also played a part in the court's reasoning. As early as September 2016, the former Hamburg Commissioner for Data Protection, Johannes Caspar, prohibited Facebook from collecting data from German users. At the time, WhatsApp argued that after this ban, no personal data had actually been transmitted to Facebook.

However, the court did not follow this view to the extent of dismissing the injunction claims. Rather, it upheld the finding that the contractual design and the demanded consent were inadmissible. In 2024, the Federal Cartel Office also ruled: Meta is not allowed to merge personal information of users from services of the platform operator such as Facebook, WhatsApp, and Instagram without their consent.

The proceedings show how tenacious legal disputes can be in the digital age. The current ruling, the written grounds for which are still pending, is not yet legally binding. Both parties have the option to appeal. For WhatsApp users in Germany, however, the decision is an important signal: Sovereignty over one's own address book remains a valuable asset that should not be undermined by blanket confirmation checkboxes.

(mho)