Federal Press Office fan page: a court said only Meta had to get cookie consent

Visiting the Federal Press Office’s Facebook page could place cookies on visitors' devices. In 2023 the BfDI said Meta’s cookie banner did not get valid consent, and that the press office, as page operator, also had to get consent and was jointly responsible with Meta. It ordered the page shut. The federal government and Meta both sued.

These are first-instance findings, from the court’s press release. They are under appeal. The BfDI’s view above is what it alleged, not what a court found. Inth translated the German.

• Only Meta, not the press office, had to get users' consent for placing the cookies.
• There was no sufficient causal link between running the page and the access to users' devices. The cookies could be placed during a visit to the fan page, but equally during a visit to any other Facebook page.
• Under the GDPR, Meta and the press office were not joint controllers for the processing. The press office’s contribution was limited to running the page, and it could not set parameters for the cookies or the analysis of the data.
• "Merely enabling data processing" does not amount to jointly determining its means, in the chamber’s view (translated).

The cookies were placed on visitors' devices through Facebook, under Meta’s own cookie banner. According to the court, the press office only ran the page and could not set the parameters for the cookies or the analysis of the data. That is different from a site owner who installs a Meta pixel on their own website.

1. 2023BfDI orders the press office to stop running the page
2. 17 July 2025VG Köln hearing and judgment; appeal allowed
3. 22 August 2025BfDI announces its appeal to OVG Münster

The court largely granted the claims, so the press office may keep running its page. The BfDI said it respects the judgment but appealed, and published guidance for federal bodies using social networks in the meantime.

No fine. The case concerns a shutdown order, which the court overturned.

It asks how far an organisation is responsible for a platform’s tracking on a page it runs there. The answer may change on appeal. It does not cover tags an organisation puts on its own website, where the operator controls the code.

It does not. Pages on third-party platforms are outside your website, your code and the Inth banner. Inth cannot decide who is a controller.

• On your own site, Website audit records what loaded before a choice and after Reject, with page, time, region and consent state.
• Consent banner: under the EU opt-in policy, optional tags wait until the visitor chooses.

In the repository

• List social embeds and pixels on your own site and check each waits for consent.

In the browser and network

• Check that links to your social pages are plain links, not embeds that load before consent.

With the people responsible

• Track the OVG Münster appeal before relying on this ruling.

• VG Köln press release (German)
• VG Köln judgment, 13 K 1419/23 (German)
• BfDI press release on the appeal, 22 August 2025 (German)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit any party’s current systems. Inth translated the German quotes and wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: Bundeskartellamt v Meta, Meta Business Tools damages