Meta tracking: 1,500 euros in damages for Instagram users

What the Higher Regional Court of Dresden decided

Four Instagram users sued the Meta group and won. In judgments of 3 February 2026 (case numbers 4 U 292/25 and three parallel proceedings), the Higher Regional Court of Dresden ordered Meta to pay each claimant 1,500 euros in damages. Meta is also barred from further processing the claimants' data obtained in this way. The case concerned the so-called business tools, through which Meta receives data about users' behaviour on third-party websites.

According to the court, these were the first four cases of this kind decided by the responsible panel. The court did not allow an appeal on points of law. The judgments are therefore final.

What business tools are

Business tools are software components that Meta offers companies for integration into their websites. The best known is the tracking pixel, an invisible element on the page that reports visitor data to Meta. Companies use it to collect personal data about their visitors and share it with Meta. The purpose is obvious: if you know which pages someone visits, you can show them matching advertising.

For users, all of this happens in the background. Anyone visiting a website with such a component notices nothing. The four claimants, all registered with Instagram, which also belongs to Meta, sued Meta over this data collection.

Why the data collection was unlawful

Personal data may only be processed if there is a legal basis for it. The best known is the consent of the person concerned. The panel satisfied itself that no such consent existed in the four cases. In the court's view, none of the other justifications offered by the General Data Protection Regulation (GDPR) applied either, and that list is not short. The data collection via the business tools was therefore unlawful.

That cleared the first hurdle. But a breach alone does not yet bring any money. That requires damage, and damage is hard to pin down in the case of covert data collection.

Damages without proven harm

What damage arises when someone collects data without the person concerned noticing? The court sees it in the loss of control. Anyone who no longer knows which data about them flows where may develop a feeling of comprehensive surveillance. For the panel, that is enough for non-material damage, that is, a disadvantage without financial loss. None of the claimants had to prove any psychological impairment.

The basis is Article 82 of the General Data Protection Regulation. Under it, anyone who suffers material or non-material damage as a result of an infringement of the Regulation can claim compensation. The court valued this damage at 1,500 euros per person.

Another point makes the judgment useful for those affected. The claimants did not have to show which websites with business tools they had visited. Anyone who first had to prove data flows in the background might as well not bother going to court, because those very flows are invisible to users. The court did not require that proof.

Meta damages: what users can do

The judgments apply directly only to the four claimants. For everyone else, however, they show how the Higher Regional Court of Dresden assesses such cases, and the hurdles for those affected are low. Anyone registered with Instagram who never consented to Meta's data collection via business tools may be in a comparable position to the claimants. Under the Dresden judgment, no one needs a list of websites visited, nor a medical certificate about emotional consequences.

A higher regional court does not, however, bind other courts. Other judges may assess the question of damage differently, and Meta will argue that in future proceedings. It therefore makes sense to have your own case reviewed first, rather than relying solely on the 1,500 euros from Dresden.

What website operators can learn from it

It was Meta that was ordered to pay, not the companies that installed the business tools. Even so, it is worth operators taking a look at their own site. Anyone using the Meta pixel or similar tools collects visitors' personal data and shares it with Meta. That is only permitted with valid consent, in other words only after a genuine yes from the visitor. A notice banner that starts the data transfer as soon as the page is opened is of no help here.