1. Skip to content
  2. Skip to main menu
  3. Skip to more DW sites
Live TV
Latest audioLatest videos
In focus
Russia's war in UkraineGerman election 2025COP29 climate talks
TechnologyGermany

Germany: Compensation for Facebook data breach victims

November 18, 2024

Germany's highest civil court has ruled that victims of a Facebook data breach could be entitled to compensation. The ruling could be good news for millions of users, but Facebook's parent company, Meta, remains bullish.

https://p.dw.com/p/4n7f2
Generic image of Meta, Facebook, Instagram and WhatsApp logos
The court found that users did not have to prove material damages to be eligible for compensation, merely that their data had been stolenImage: Jens Büttner/dpa/picture alliance

Millions of German Facebook users whose data was illegally obtained and leaked in a major security breach are eligible for compensation, Germany's Federal Court of Justice (BGH) ruled on Monday.

The court in the southwestern city of Karlsruhe, Germany's highest court for civil cases, said that the basic loss of control over data online was grounds for damages — without plaintiffs having to prove any specific financial losses, misuse of the data or even that they have been particularly concerned.

The BGH declared its ruling to be a guideline decision, meaning it can serve as a precedent for thousands of cases currently going through German courts.

Facebook 'scraping' scandal

The case revolved around a so-called "scraping" operation in 2018 and 2019 when unknown perpetrators accessed the data of millions of Facebook users via a loophole in the social network's search function.

At the time, users could be identified by entering their phone numbers into the search bar. Using automated searches for millions of randomly generated telephone numbers, hackers were able to access the data of around 533 million users, which they then leaked in April 2021.

In the specific BGH case in Karlsruhe, the complainant had demanded at least €1,000 ($1,056) in compensation from Facebook parent company Meta.

The higher regional court in the western city of Cologne originally rejected his claim, but will now be obliged to revisit the case and take into account the ruling of the BGH.

While the plaintiff is unlikely to be awarded €1,000 in damages, the BGH did suggest that it would consider a sum nearer €100 to be appropriate.

Meta: 'Facebook's systems were not hacked'

Meta, which has previously refused to pay compensation on the grounds that those affected had not been able to prove any concrete damages, is remaining bullish.

A spokeswoman claimed the BGH's ruling was "inconsistent with the recent case law of the European Court of Justice," the European Union's highest court.

"Similar claims have already been dismissed 6,000 times by German courts, with a large number of judges ruling that no claims for liability or damages exist," she said. "Facebook's systems were not hacked in this incident and there was no data breach."

A day without a smartphone — is that still possible?

mf/msh (Reuters, dpa)