[Enforcement library](/enforcement)

# Federal Press Office fan page: a court said only Meta had to get cookie consent

VG Köln overturned the BfDI's order to shut the Federal Press Office's Facebook page, holding that only Meta had to obtain cookie consent and that there was no joint controllership. The BfDI has appealed.

## Key facts

- **Regulator or court:** Verwaltungsgericht Köln (challenge to a BfDI order)
- **Jurisdiction:** Germany
- **Framework:** TTDSG §25 (now TDDDG); GDPR Article 26
- **Record date:** 2025-07-17
- **Procedural status:** Under appeal

Germany's federal data protection regulator ordered the government's press office to shut its Facebook page over Meta's cookies. A Cologne court overturned the order. The regulator has appealed.

Verwaltungsgericht Köln · TTDSG and GDPR · Judgment 17 July 2025

- The problem
- Case record
- What the court found
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## The problem

Visiting the Federal Press Office's Facebook page could place cookies on visitors' devices. In 2023 the BfDI said Meta's cookie banner did not get valid consent, and that the press office, as page operator, also had to get consent and was jointly responsible with Meta. It ordered the page shut. The federal government and Meta both sued.

## Case record

| Field | Record |
| --- | --- |
| Court | Verwaltungsgericht Köln, 13 K 1419/23 |
| Parties | Federal Republic of Germany and Meta v the Federal Commissioner for Data Protection and Freedom of Information (BfDI) |
| Decision | Judgment after the hearing of 17 July 2025 |
| Law | TTDSG §25 on device access, now TDDDG; GDPR joint controllership |
| Stage | Under appeal. The BfDI appealed to OVG Münster on 22 August 2025. Inth found no appeal ruling |

## What the court found

These are first-instance findings, from the [court's press release](https://www.vg-koeln.nrw.de/behoerde/presse/Pressemitteilungen/Archiv/2025/08_22072025/index.php). They are under appeal. The BfDI's view above is what it alleged, not what a court found. Inth translated the German.

- Only Meta, not the press office, had to get users' consent for placing the cookies.
- There was no sufficient causal link between running the page and the access to users' devices. The cookies could be placed during a visit to the fan page, but equally during a visit to any other Facebook page.
- Under the GDPR, Meta and the press office were not joint controllers for the processing. The press office's contribution was limited to running the page, and it could not set parameters for the cookies or the analysis of the data.
- "Merely enabling data processing" does not amount to jointly determining its means, in the chamber's view (translated).

## Technical issue

The cookies were placed on visitors' devices through Facebook, under Meta's own cookie banner. According to the court, the press office only ran the page and could not set the parameters for the cookies or the analysis of the data. That is different from a site owner who installs a Meta pixel on their own website.

## Timeline

| Date | Event |
| --- | --- |
| 2023 | BfDI orders the press office to stop running the page |
| 17 July 2025 | VG Köln hearing and judgment; appeal allowed |
| 22 August 2025 | BfDI announces its appeal to OVG Münster |

## Outcome

The court largely granted the claims, so the press office may keep running its page. The BfDI said it respects the judgment but appealed, and published guidance for federal bodies using social networks in the meantime.

## What it cost

No fine. The case concerns a shutdown order, which the court overturned.

## Why it matters

It asks how far an organisation is responsible for a platform's tracking on a page it runs there. The answer may change on appeal. It does not cover tags an organisation puts on its own website, where the operator controls the code.

## How Inth catches this

It does not. Pages on third-party platforms are outside your website, your code and the Inth banner. Inth cannot decide who is a controller.

- On your own site, **Website audit** records what loaded before a choice and after Reject, with page, time, region and consent state.
- **Consent banner:** under the EU opt-in policy, optional tags wait until the visitor chooses.

## Checks for your own systems

### In the repository

- List social embeds and pixels on your own site and check each waits for consent.

### In the browser and network

- Check that links to your social pages are plain links, not embeds that load before consent.

### With the people responsible

- Track the OVG Münster appeal before relying on this ruling.

## Sources and limits

- [VG Köln press release](https://www.vg-koeln.nrw.de/behoerde/presse/Pressemitteilungen/Archiv/2025/08_22072025/index.php) (German)
- [VG Köln judgment, 13 K 1419/23](https://nrwe.justiz.nrw.de/ovgs/vg_koeln/j2025/13_K_1419_23_Urteil_20250717.html) (German)
- [BfDI press release on the appeal, 22 August 2025](https://www.bfdi.bund.de/SharedDocs/Pressemitteilungen/DE/2025/12_Fanpage-Verfahren-Berufung.html) (German)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit any party's current systems. Inth translated the German quotes and wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Bundeskartellamt v Meta](/enforcement/bundeskartellamt-meta), [Meta Business Tools damages](/enforcement/meta-business-tools-germany)