The Federal Court of Justice (BGH) has dealt with the lawsuits filed by Facebook users in connection with the so-called scraping incident. A final ruling from the Karlsruhe judges is still pending, but they have already indicated a possible direction – one that Facebook users are likely to like.
Those affected by data theft on Facebook could hope for compensation. In an initial assessment, the Federal Court of Justice (BGH) indicated that the mere loss of control over one's own data could be sufficient for a claim. However, it must be proven that this loss actually occurred, not any immaterial damages such as fear or worry, explained Stephan Seiters, presiding judge of the Sixth Civil Senate in Karlsruhe. The final ruling of the Federal Court of Justice is still pending, however, and will be important for many future proceedings before German courts.
The background to this case is a 2021 data protection incident in which unknown perpetrators publicly published the data of approximately 533 million Facebook users from 106 countries online. This data was obtained by exploiting a friend search function on the platform. The Federal Court of Justice stated that the perpetrators benefited from Facebook's ability to search for users' profiles based on phone numbers—even if these were not publicly visible. The "scrapers" generated random phone numbers and found matches. This linked user ID, name, gender, country, and phone number, among other things.
Those affected accuse Facebook of having taken inadequate security measures. Due to the loss of control over their data and the resulting distress, they are demanding compensation, including for non-pecuniary damages. So far, the lawsuits before the regional and higher regional courts have largely been unsuccessful, but a final decision by the Supreme Court is still pending.
First leading decision of the Federal Court of Justice
In order to process the large number of individual lawsuits more efficiently, the Federal Court of Justice (BGH) designated the appeal procedure in the so-called scraping case as the first leading decision procedure – even though the appeal had since been withdrawn. This option was only introduced on the same day through a new provision in Section 552b of the Code of Civil Procedure.
With this case from North Rhine-Westphalia, the Sixth Civil Senate seeks to clarify fundamental legal questions, including whether the default setting of "all" for the so-called contact import function violates the General Data Protection Regulation. Other issues include whether the mere loss of control over scraped data constitutes non-material damage, how this damage should be assessed, and how a claim for damages would need to be substantiated accordingly (Case No. VI ZR 10/24).
Judge Stephan Seiters explained that in this specific case, the plaintiff stated that he had only deliberately shared his phone number. After the theft, the man felt, among other things, severe discomfort and developed a growing distrust of emails and text messages.
Based on a preliminary assessment, the Senate is also considering a user-friendly interpretation with regard to possible future damages. After all, the incident violated the rights to informational self-determination and the protection of personal data, according to Seiters.
The Bonn Regional Court partially upheld the claim in the first instance and awarded the plaintiff €250. However, the Cologne Higher Regional Court dismissed the claim in the second instance.
Meta: Complaints are baseless and unfounded
Christian Rohnke, a lawyer for Facebook's parent company Meta, warned against lowering the burden of proof for plaintiffs too much. In his view, the mere loss of control over one's own data is not sufficient to claim damages. "If anything, non-material damage could consist of harassing calls," he explained. In this case, however, it would have to be proven that the number of calls had increased.
According to Rohnke, the plaintiffs would also have to provide evidence that they were anxious or worried about the incident—for example, by changing their phone number. However, the plaintiff failed to do so. "If he had genuine concerns, it would have been obvious to change his number," Rohnke said.
Meta considers the lawsuits to be unfounded. Attorney Martin Mekat of the law firm Freshfields, which represents Meta, emphasized after the hearing that no Facebook systems were hacked in this incident and therefore did not constitute a data protection violation. He pointed out that Meta has already won over 6,000 similar lawsuits in German courts.
The Karlsruhe judges are now deliberating based on the oral hearing and will announce the verdict at a later date. The exact date for the verdict has not yet been set.
English 
German 
Dutch