Meta’s Data Collection Practices Under Scrutiny: Millions of Non-Users Affected
The reach of Meta’s data collection extends far beyond its declared user base, impacting potentially tens of millions of individuals who have never even created an account on Facebook, Instagram, or Messenger. This practice, involving the harvesting of contact information through uploads by existing users, has been deemed unlawful by a German court, sparking legal challenges and raising serious privacy concerns across Europe. The case highlights the complex and often opaque ways in which social media giants gather and utilize personal data, even from those who actively avoid their platforms. The core issue revolves around whether Meta has been operating within legal boundaries when collecting data from individuals who have not consented to its use.
The Landgericht Berlin II (Berlin Regional Court II) ruled against Meta, ordering the company to cease the practice of collecting data from non-users. However, crucially, the court did not mandate the deletion of data already collected. The court initially found the claim brought against Meta to be justified, signaling a significant legal setback for the tech company. This ruling comes amidst a broader wave of scrutiny regarding Meta’s data handling practices and its impact on user privacy, with ongoing legal battles in multiple jurisdictions. The case was brought by the Verbraucherzentrale Bundesverband (VZBV), the Federation of German Consumer Organisations, on behalf of individuals whose data was collected without their knowledge or consent.
How Data is Collected from Non-Users
The controversial data collection occurs when users upload their contact lists to Meta’s platforms. This includes information such as names, phone numbers, and email addresses. Even if an individual does not have a Facebook, Instagram, or Messenger account, their information can be added to Meta’s servers if a contact of theirs uploads their address book. This practice allows Meta to create detailed profiles of individuals, even those who have intentionally chosen not to participate in its social networks. The implications of this data collection are far-reaching, potentially impacting individuals’ privacy and opening them up to targeted advertising and other forms of data-driven manipulation.
While Meta maintains that this data collection is necessary for certain functionalities, such as identifying potential connections and improving user experience, critics argue that it represents a significant overreach of privacy. The German court’s decision underscores the growing legal and regulatory pressure on tech companies to respect user privacy and obtain explicit consent for data collection. The ruling is part of a broader trend of increased regulation of data privacy, particularly in Europe, where data protection laws are among the strictest in the world.
Legal Challenges and Ongoing Litigation
The legal challenges facing Meta extend beyond the German court ruling. Two separate higher regional courts in Germany, in Dresden and Munich, have recently allowed lawsuits against Facebook to proceed, focusing on the company’s business practices and alleged surveillance of users. These cases represent a significant escalation in the legal battles against Meta, potentially leading to substantial financial penalties and further restrictions on its data collection practices. The potential for significant financial repercussions is substantial, with estimates suggesting that damages could reach into the double-digit billions of euros.
In Italy, a class action lawsuit filed in Milan by Studio A&C on behalf of the Italian Parents’ Movement (MOIGE) and several families is also underway. This lawsuit alleges that Meta and TikTok have harmed children through their platforms and continues to pose risks to minors. Meta and TikTok have responded by raising procedural objections and seeking a postponement of the hearing, which is now scheduled for May 14. The Italian case focuses on the alleged failure of the companies to adequately protect minors from harmful content and predatory behavior on their platforms.
Meta is facing increased scrutiny from the European Union. The EU Commission has criticized TikTok and, by extension, Meta, for failing to adequately protect minors and for insufficient age verification processes. This criticism comes as part of a broader effort by the EU to strengthen digital regulations and protect the rights of online users, particularly children. In February 2026, Meta and TikTok joined the class action lawsuit, citing procedural issues, in an attempt to delay proceedings.
What Non-Users Can Do
Individuals who believe their data has been collected by Meta without their consent are not entirely powerless. Meta provides a dedicated information page where users can check if their contact information is stored on its servers and request its removal. However, locating the removal form can be challenging, as it is reportedly hidden within a sentence about user rights on the information page. Once removed, Meta states that the data will also be blocked from future uploads. The process, while available, requires users to proactively seek it out and navigate Meta’s privacy settings.
The number of individuals potentially affected by this data collection is substantial. Estimates suggest that around 50 million people in Germany and 6 million in Austria may have had their data collected without their knowledge. This widespread impact underscores the need for greater transparency and accountability from social media companies regarding their data collection practices. The scale of the potential damages highlights the financial risks facing Meta as these legal challenges progress.
Broader Implications for Data Privacy
The legal battles surrounding Meta’s data collection practices are part of a larger global conversation about data privacy and the power of tech companies. The German court ruling, along with the ongoing litigation in Italy and the scrutiny from the EU, signal a growing willingness among regulators to challenge the practices of social media giants and protect the rights of individuals. This trend is likely to continue as governments around the world grapple with the challenges of regulating the digital economy and ensuring that data privacy is respected.
In July 2025, the Higher Regional Court Cologne (OLG Köln) in Germany ruled that Meta could use data from public social media profiles to train its artificial intelligence models. This decision, while seemingly separate, further illustrates the complex legal landscape surrounding data privacy and the ongoing debate about the permissible uses of personal information. The ruling highlights the tension between innovation and privacy, as companies seek to leverage data to develop fresh technologies while also respecting the rights of individuals.
Enrique Dans noted in July 2025 that Meta has a long history of privacy violations, dating back to the early days of Facebook. Dans argues that Meta consistently prioritizes profit over privacy, and that the company must be held accountable for its actions. This perspective reflects a growing sentiment among privacy advocates and regulators that tech companies need to be more responsible stewards of personal data.
The German court’s decision to impose a fine of up to €250,000 for violations of its order demonstrates the seriousness with which regulators are taking these issues. This financial penalty serves as a warning to Meta and other tech companies that they will face consequences for failing to comply with data privacy laws. The ongoing legal battles and regulatory scrutiny are likely to continue to shape the future of data privacy and the relationship between tech companies and their users.
As these legal proceedings unfold, it remains to be seen what the ultimate outcome will be for Meta. However, one thing is clear: the company’s data collection practices are under intense scrutiny, and it faces significant legal and reputational risks. The next key date to watch is May 14, the scheduled hearing date for the class action lawsuit in Milan. The outcome of this case, along with the other ongoing legal challenges, will have a significant impact on Meta’s future and the broader landscape of data privacy.
Have your say: What steps do you reckon social media companies should capture to better protect user privacy? Share your thoughts in the comments below.
Related reading