Use of personal data for AI Training does not violate DMA according to Higher Regional Court of Cologne

Authors of this article: Malgorzata Wojtas and Heiner Mecklenburg

The Higher Regional Court (OLG) of Cologne ruled on May 23, 2025 regarding the permissibility of using personal data for training artificial intelligence (AI) by Meta (Case No. 15 UKl 2/25). The core issues included data protection concerns of Meta’s practices and whether the planned use of publicly accessible data from European users on Facebook and Instagram for AI training purposes violates Article 5(2)(b) of the Digital Markets Act (DMA). 

Background of the decision

Since May 27, 2025, Meta has been using publicly posted content from adult users in Europe on Facebook and Instagram to train its AI models. The data is intended to be used for the language model “LLaMA” and the chatbot tool “Meta AI”, similar to ChatGPT. Users were informed either through in-app notifications or via email and had the opportunity to object to the use. Explicit consent under GDPR was not obtained.

The North Rhine-Westphalia Consumer Association considered this a violation of GDPR provisions as well as Article 5(2)(b) DMA and filed an application for an injunction on May 12, 2025, to prevent the use of the data. According to Article 5(2)(b) DMA, so-called gatekeepers are not allowed to combine personal data from a core platform service with data from other services unless they have specific consent from end-users.

The legal basis for the application of the Consumer Association NRW was Section 2(1) sentence 1 of the Act on Injunctive Relief (UKlaG), which states that anyone who violates consumer protection regulations in a manner other than through the use or recommendation of general terms and conditions may be sued for an injunction and removal in the interest of consumer protection. The DMA is considered a consumer protection law within the meaning of UKlaG under Section 2(2) No. 56 UKlaG.

Analysis

The OLG Cologne rejected the application of the Consumer Association NRW and, upon summary review, found that Meta’s planned use of the data does not violate Article 5(2)(b) DMA. Here are three aspects for interpretation of the decision:

• No Data Combination within the Meaning of the DMA: According to the court, the use of data for AI training does not constitute a combination of personal data from different services within the meaning of the DMA. There is no user-specific combination of the used data, as there is no targeted linking of data from the same user.
• Lack of Relevant Case Law: The OLG Cologne also noted that there is a lack of relevant higher court case law on the application of Article 5(2)(b) DMA. The decision is therefore to be seen as groundbreaking but not conclusive.
• Current Status of Non-Compliance Proceedings Against Meta: The OLG Cologne could not consider the European Commission’s penalty decision against Meta from April 23, 2025, for violating Article 5(2) DMA (see blog post from May 20, 2025) in its decision. The Commission’s decision has not yet been published. Due to urgency, the court was neither able to obtain a statement from the Commission nor to submit a referral to the European Court of Justice.

Consequences

Meta is temporarily allowed to use the personal data of (non-objecting) users of Facebook and Instagram for AI training purposes. The OLG Cologne’s decision is based on a summary assessment of the facts and law. The legal evaluation in a possible main proceeding could be different. However, the decision on the application for an injunction is final. According to Section 6(1) UKlaG, the Higher Regional Court has jurisdiction in the first instance, and an appeal is not provided for. An appeal to the Federal Court of Justice against decisions of a higher regional court in interim legal protection is excluded under Section 542(2) sentence 1 German Code of Civil Procedure. The further clarification of the interpretation of Article 5(2) DMA is reserved for the main proceeding. Whether such a proceeding will be initiated is at the discretion of the Consumer Association NRW.

Conclusion and Outlook

The decision of the OLG Cologne provides an initial important orientation for platform operators and gatekeepers in dealing with personal data for AI training purposes. Provided there is no combination of data from different services, and users are transparently informed and can object to the use of their personal data, AI training with public user data does not violate Article 5(2)(b) DMA according to summary legal review.

The legal review in a possible main proceeding is awaited with great interest. For example, Article 5(2)(c) DMA also prohibits the cross-use of personal data from a core platform service in other services provided separately by the gatekeeper. A possible point of contention could thus be whether the use of personal data from Facebook and Instagram for AI training constitutes such cross-use. It also remains to be seen whether the European Commission will initiate investigations against Meta. AI services themselves are not included in the list of core platform services under Article 2(2) DMA. Therefore, cases such as the present one, in which data from core platform services are leveraged for the development of AI systems, are likely to attract the Commission’s attention.

Given the provisional nature of the legal assessment emphasized by the OLG Cologne, companies should carefully check their data processing processes for compliance with the requirements of the DMA and GDPR in each individual case.