Austrian litigation funder Padronus is financing the largest collective action ever filed in the German-speaking world. The case targets Meta’s illegal surveillance practices.

Together with the Austrian Consumer Protection Association (VSV) as claimant, the German law firm Baumeister & Kollegen, and the Austrian law firm Salburg Rechtsanwälte, Padronus has filed collective actions in both Germany and Austria against Meta Platforms Ireland Ltd. The lawsuits challenge Meta’s extensive surveillance of the public, which, according to Padronus and VSV, violates European data protection law.

“Meta knows far more about us than we imagine – from our shopping habits and searches for medication to personal struggles. This is made possible by so-called business tools that are deployed across the internet. The U.S. corporation is present on third-party sites even when we are logged out of its platforms or when our browser settings promise privacy. This breaches the GDPR,” explains Richard Eibl, Managing Director of Padronus.

Meta generates revenue by allowing companies to place paid advertisements on Instagram and Facebook. Which ad is shown to which user depends on the user’s interests, identified by Meta’s algorithm based on platform activity and social connections. In addition, Meta has developed tools such as the “Meta Pixel,” embedded on countless third-party websites, including those dealing with sensitive personal matters. The “Conversions API” is integrated directly on web servers, meaning data collection no longer occurs on the user’s device and cannot be detected or disabled, even by technically savvy users. It bypasses cookie restrictions, incognito mode, or VPN usage.

Millions of businesses worldwide use these tools to target consumers and analyze ad effectiveness. “Use of these technologies is now omnipresent and an integral part of daily internet usage. Every user becomes uniquely identifiable to Meta at all times as soon as they browse third-party sites, even if not logged into Facebook or Instagram. Meta learns which pages and subpages are visited, what is clicked, searched, and purchased,” says Eibl. He adds: “This surveillance has gone further than George Orwell anticipated in 1984 – at least his protagonist was aware of the extent of his surveillance.”

While Meta users can configure settings on Instagram and Facebook to prevent the collected data from being used for the delivery of personalized advertising, the data itself is nevertheless already transmitted to Meta from third-party websites prior to obtaining consent to cookies. Meta then, without exception, transfers the data worldwide to third countries, in particular to the United States, where it evaluates the data to an unknown extent and passes it on to third parties such as service providers, external researchers, and authorities.

Numerous German district courts (including Berlin, Hamburg, Munich, Cologne, Düsseldorf, Stuttgart, Leipzig) and more than 70 other courts have already confirmed Meta’s illegal surveillance in over 700 ongoing individual lawsuits. These first-instance rulings, achieved by lawyers Baumeister & Kollegen, are not yet final. Eibl notes: “The courts have awarded plaintiffs immaterial damages of up to €5,000. If only one in ten of the up to 50 million affected individuals in Germany joins the collective action, the dispute value rises to €25 billion. This is the largest lawsuit ever filed in the German-speaking world.”

Meta’s lack of seriousness about user privacy is well-documented. In 2023, Ireland’s data protection authority fined Meta €1.2 billion for illegal U.S. data transfers. In 2021, Luxembourg imposed a €746 million fine for misuse of user data for advertising. In 2024, Ireland again fined Meta €251 million for a major security breach. In July 2025, a U.S. lawsuit was launched against several Meta executives, demanding $8 billion in damages for systematic violations of an FTC privacy order. Richard Eibl notes: “This case goes to the heart of Meta’s business model. If we succeed, Meta will have to stop this unlawful spying in our countries.”

The new collective action mechanism for qualified entities such as VSV is a novel legal instrument. If successful, the unlawful practice must be ceased, and compensation paid to consumers who have joined the case.

The lawsuit is expected to trigger political tensions with the current protectionist U.S. administration. Only last week, the U.S. President again threatened the EU with new tariffs after the Commission imposed a €2.95 billion fine on Google. “We expect the U.S. government will also try to exert pressure in our case to shield Meta. But European data protection law is not negotiable, and we are certain we will not bow to such pressure,” says Julius Richter, also Managing Director of Padronus.

Consumers in Austria and Germany can now register at meta-klage.de and meta-klage.at to join the collective action without any cost risk. Padronus covers all litigation expenses; only in the event of success will a commission be deducted from the recovered amount.