Court puts brakes on WhatsApp: Data transfer to Facebook not permitted in Germany

Image: Markus Mainka/Sutterstock.com

A ruling from Berlin is causing a stir in the data protection dispute between consumer advocates and tech companies. On February 23, 2026, the Berlin Regional Court II ruled that WhatsApp may no longer pass on certain user data to Facebook without further ado – at least not if the users' consent is based on the controversial 2016 regulation.

This means that the Federation of German Consumer Organizations (vzbv) has been partially vindicated in a legal dispute that has lasted for years. The messenger service must significantly restrict its previous practices regarding the handling of user data in the future.

Point of contention: Changes to WhatsApp rules in 2016

The conflict stems from a major change in the terms of use. In the summer of 2016, WhatsApp informed its users about new privacy rules. Consent was obtained via notices in the app and information on the website.

The new terms enabled data sharing with Facebook, which had already acquired Messenger in 2014.

Consumer advocates were particularly critical of one point: users would have to allow WhatsApp access to all phone numbers in their smartphone's address book. This would also include contacts of people who do not have a WhatsApp account themselves.

At the same time, users should confirm that they are authorized to disclose these telephone numbers.

Court sees problems with consent

The Berlin judges have now clarified that this form of consent is not legally sufficient. WhatsApp is not permitted to pass on personal information of German users or data from non-users to Facebook if consent has been obtained according to this model.

In addition, the court prohibited the company from continuing to use certain passages from the former data protection policy in contracts with German consumers or from referring to them.

The court thus clarifies that a blanket consent field is not sufficient if it involves far-reaching data usage.

An important point of the lawsuit fails

Despite the ruling, a key demand of consumer advocates remained unfulfilled.

The vzbv wanted WhatsApp to actively oblige Facebook to delete data that had already been transmitted and to provide evidence of this. However, the court rejected this request.

This leaves unclear what happens to data that may have been transferred earlier.

Judgment not yet final

The case is not yet legally closed. The court's written reasoning is not yet available. Furthermore, the judgment is not yet final.

Both parties may appeal the decision.

However, the dispute already shows how difficult it is to resolve data protection issues on global platforms—especially when decisions about user data were made many years ago.

Critical commentary

The case is a typical example of how slow the law is compared to the speed of the tech industry. The controversial rules date back to 2016 – almost a decade later, a court is still dealing with their consequences.

For users, this means a strange reality: while apps have long since introduced new features and terms and conditions, decisions on old data protection practices are only made years later.

The ruling sends an important signal to large platforms. At the same time, however, it also shows how difficult it is to truly remove data from the digital world once it has been collected. This is precisely where the real problem of modern data use lies.

Sources: berlin.de/gerichte, heise.de