Meta Business Tools in Germany: damages for tracking without consent

German courts have ordered Meta to pay individual users damages over data the Meta Pixel and related tools collected on other companies' websites and apps. The users did not have to prove any harm beyond loss of control.

LG Leipzig, OLG Dresden and OLG Jena · GDPR Article 82 · Judgments July 2025 to March 2026

Mixed: OLG Dresden rulings final; OLG Jena ruling under appeal to the BGH; LG Leipzig status not confirmed

Regulator or court: LG Leipzig; OLG Dresden; OLG Jena
Jurisdiction: Germany
Framework: GDPR Articles 6, 9 and 82
OLG Dresden judgments: 3 February 2026

Undisclosed data exchanges · Consent before collection · Sensitive context in event data · International data transfers

The problem

Meta’s Business Tools are code that website and app operators install to send visitor data to Meta. Facebook and Instagram users sued Meta, saying it had no valid consent for that data. Several German courts agreed and awarded damages. Meta is the defendant, but the data comes from the sites that install the tools.

Case record

Meta Business Tools rulings
Court	Date	Award	Stage
LG Leipzig, 05 O 2351/23	4 July 2025	€5,000 to a Facebook user	First instance; appeal status not confirmed by Inth
OLG Dresden, 4th civil senate, four parallel cases	3 February 2026	€1,500 each to Instagram users, plus an order to stop further processing	Final; no further appeal allowed
OLG Jena, 3 U 31/25	2 March 2026	€3,000, plus disclosure and erasure of the claimant's data	Not final; appeal to the BGH allowed

What the courts found

These are court findings as the courts' press offices reported them. Inth translated them from German. Only the Dresden rulings are final.

OLG Dresden: the consents needed for the processing were not in place, and Meta could not rely on any other GDPR basis. The loss of control could create a feeling of comprehensive surveillance, which justified damages under Article 82 even without psychological harm. Users did not have to prove that they visited sites that sent their data to Meta (press release).
OLG Jena: the Business Tools allow far-reaching tracking of members' internet use, including sensitive health data, for example when a user researches mental disorders, looks for therapy on doctor portals or orders medicine from an online pharmacy. Collection happens even when users are not logged in and have not given valid consent. The court called it "a system of data collection without cause" (translated) (press release).
LG Leipzig: each user is individually recognisable to Meta on third-party sites and apps, even without logging in, and Meta sends the data to third countries, in particular the US. The court based damages on Article 82 alone and tied the amount to the value of personal data for personalised advertising (press release).

Technical issue

The Dresden court describes the Business Tools as programming interfaces that Meta offers companies to install on their websites, which collect visitor data that the companies then share with Meta.

Inth’s technical interpretation: a pixel that fires on page load sends Meta the page address and its own identifiers before any choice. On a health or pharmacy page, the address alone can reveal the sensitive part. A server-side feed can send the same events without anything showing in the browser.

// Risky: pixel initialised on every page
fbq('init', 'PIXEL_ID');
fbq('track', 'PageView');

// Safer: wait for marketing consent, and skip sensitive pages
consent.onGranted('marketing', () => {
  if (!page.isSensitive) {
    fbq('init', 'PIXEL_ID');
    fbq('track', 'PageView');
  }
});

Illustrative pattern, not the defendant’s code. Generic consent API, not a specific c15t call.

Timeline

4 July 2025LG Leipzig awards €5,000
3 February 2026OLG Dresden awards €1,500 each in four cases; no further appeal
2 March 2026OLG Jena awards €3,000 and allows an appeal to the BGH

Outcome

The four Dresden judgments are final because the court did not allow a further appeal. The Jena judgment is not final; the court allowed an appeal to the Federal Court of Justice (BGH). Inth found no BGH ruling on the Business Tools as of the source review date and has not confirmed whether the Leipzig judgment was appealed.

What it cost

Between €1,500 and €5,000 per claimant in the cited rulings. These are court damages to individuals, not regulatory fines. Small per person, but each user can sue.

Why it matters

German appeal courts now award damages for loss of control alone, which is the opposite of the UK position in Lloyd v Google. The defendant here is Meta, but the data comes from sites that install its tools before consent. It is the strongest European case so far for holding the pixel until the visitor agrees.

How Inth catches this

Code audit flags a pull request that adds an advertising tag, ad-cookie write or storage write outside the consent check, and can trace reviewed outbound data flows such as a server-side events feed.
Website audit records what loaded before a choice and after Reject, with the page, time, region and consent state.
Consent banner: under the EU opt-in policy, optional tags wait until the visitor chooses.

A banner cannot unload code that already ran, and a browser observation cannot establish what Meta does with the data. Server-side feeds are outside the banner; your back end must apply the choice there.

Checks for your own systems

In the repository

Find every Meta Pixel, SDK and Conversions API call, and check each reads the consent state.
List pages and app screens about health, finance or other sensitive topics, and check whether events fire there.

In the browser and network

Load a sensitive page in a clean German profile and look for requests to facebook.com or connect.facebook.net before any choice.

With the people responsible

Ask marketing which Meta events are sent server-side and whether those respect refusal.

Sources and limits

LG Leipzig press release, 4 July 2025 (German)
LG Leipzig judgment text, 05 O 2351/23 (PDF) (German, published by a law firm)
OLG Dresden press release, February 2026 (German)
OLG Jena press release, 2 March 2026 (German)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Meta’s current systems. Inth translated the German sources and wrote the technical checks; they cannot decide which laws apply or prove compliance.