“Localhost tracking” explained. It could cost Meta 32 billion.

 Zero Party Data, here. 

Meta darf, dixit Köln - and the ensuing discussion

The decision has sparked some genuinely fascinating debate, particularly in the comments under a post by Professor Louisa Specht-Riemenschneider. As to whether users of Instagram and Facebook had been adequately informed of their ability to opt out, one might suspect the judges had not conducted any informal enquiries within their own families. A quick test over the weekend revealed that none of the four relatives in my household who use both platforms were aware of such an option. Once it was explained, uncovering the relevant setting required a tedious number of clicks, and the process proved anything but seamless or user-friendly. This would be laughable were it not lamentable. What is also a bit disquieting is that this discussion seems to be largely confined to the data protection bubble, while a conspicuous laissez-faire persists in spheres ostensibly concerned with ensuring well-functioning markets and preventing exploitative practices—particularly those affecting consumers. The ruling also touches on the evolving relationship between the Digital Markets Act and the GDPR. While the judges held that, in their view, there had been no breach of Article 5(2) DMA, they also acknowledged that there had been no opportunity to engage with the European Commission on the matter, nor is there any established precedent. We are still awaiting publication of the Commission’s non-compliance decision specifically concerning Article 5(2) DMA which might well have offered the Court additional food for thought. Likewise, we are still waiting for the much-anticipated Guidelines on the application of the GDPR within the framework of the DMA—guidance that has been repeatedly promised but has yet to materialise.

The issue, in other words, remains entirely open.

In any case, on Tuesday Frau Professor and Andreas Mundt at re:publica (12:30)  - where you can pay 1000 EUR to enter the Speaker Lounge - will likely touch on precisely these matters. 

Oberlandesgericht Köln, hier.

Read also "The Veritable GDPR Private Enforcer in the Public Interest" here.