Some weeks ago, the Higher Regional Court of Cologne (OLG Köln) rejected an application for an interim injunction seeking to prohibit Meta from using Facebook and Instagram data for AI training starting 27 May 2025. As a result, Meta may proceed with its plans, at least for now. A ruling on the merits is still pending. Legal commentator David Wasilewski has outlined further context at Legal Tribune Online.
Let us first review what can be inferred from the court’s reasoning — based on the press release, and then examine the case through the lens of three key provisions of the Digital Markets Act (DMA).
Narrow Understanding of Article 5(2) DMA by the Court
According to the press release, the Cologne court based its decision primarily on data protection law, holding that Meta has a legitimate interest in using personal data for training AI systems. This reading has been strongly contested, particularly by the Federal Commissioner for Data Protection and Freedom of Information (BfDI), who considers the decision incorrect.
Strikingly, the court rejected the argument that Meta’s practice violates Article 5(2) DMA, which prohibits data combination without consent. Based on the release, the court found that no “combination” occurred because Meta allegedly did not merge datasets of the same individual across services. The court further stated that no relevant case law exists and that it was unable to consult the European Commission.
This suggests the court interprets Article 5(2) as requiring the merging of identifiable data related to the same user — i.e., combining a dataset from Person A with another dataset from Person A. A combination of data from Person A with data from Person X would not, in the court’s view, constitute a violation.
However, this interpretation is at odds with the text and purpose of the DMA. The provision refers to “personal data” without requiring that it be linked to the same individual. The objective of the DMA is to prevent gatekeepers from amassing vast, unchallengeable data troves. The prohibition therefore extends to any cross-service combination of personal data, regardless of whether it relates to the same user.
The court’s refusal to address this is not excused by the lack of precedent. On the contrary, it should have provided a reasoned interpretation of the provision in light of its wording and regulatory purpose.
Three Further Provisions the Court Overlooked
Beyond Article 5(2), the court neglected three core principles embedded in the DMA. A cursory reading of Article 13 DMA would have made this apparent.
Clarification: The following arguments relate only to the DMA and apply exclusively to designated gatekeepers. They are not automatically transferrable to the GDPR, which applies more broadly.
1. Principle of Effectiveness
- Article 13(3) DMA requires that gatekeepers fully and effectively comply with Articles 5 – 7.
- Article 8(1) DMA provides that gatekeeper compliance must effectively achieve the objectives of the regulation and the specific obligation.
This moves beyond a purely textual approach: the regulatory objective must be fulfilled. This aligns with the prohibition of measures having equivalent effect, well established in competition law and acknowledged in the DMA’s recitals.
In this case, the court should have examined whether combining personal data from various individuals across services has similar competitive effects to combining data about the same individual. Arguably, the broader combination is even more harmful — it gives the gatekeeper access to richer, more diverse datasets that competitors cannot replicate.
2. Anti-Circumvention Rule
- Article 13(4) DMA prohibits gatekeepers from engaging in any behaviour — contractual, commercial, technical, or otherwise — that undermines compliance with Articles 5 – 7.
- Interface design, defaults, and nudging strategies are explicitly covered.
The court failed to consider whether Meta’s opt-out solution circumvents the opt-in requirement under Article 5(2). Meta aims to steer users away from active consent, preferring passive acceptance. Such design choices may undermine the obligation by substituting de facto acquiescence for genuine, informed consent.
3. Prohibition of Undue Friction and Manipulation
- Article 13(6) DMA prohibits gatekeepers from excessively hindering users in exercising their rights under the DMA.
- This includes manipulation of autonomy and choice through interface design, function, or interaction flow.
Where users have a right to consent, as in Article 5(2), the interface must not disempower them. An opt-out model, by design, deprives users of agency. Meta’s interface may therefore violate Article 13(6) by structurally restricting users’ control over their personal data.
Repeat Infringements and Escalating Fines
The Commission may now initiate non-compliance proceedings against Meta under Article 29 DMA. Such proceedings are also permitted for circumvention strategies under Article 13(7).
This would not be the first time: the Commission has already issued a non-compliance decision against Meta for breaching Article 5(2) DMA. A repeat or similar violation within eight years could trigger enhanced penalties. Under Article 30(2) DMA, fines of up to 20% of global annual turnover may be imposed.
Structural Remedies and Reversibility
The application for interim relief was based on the argument that Meta is creating irreversible facts. Once data has been used to train an AI model, technical rollback may be impossible. The court rejected the injunction, but the main proceedings are still pending.
Even if no interim order is issued, the Commission can intervene:
- Non-compliance decisions may include orders to cease or reverse specific behaviour.
- In the context of AI training, the Commission may test whether data deletion is technically feasible. If not, it may consider retrospective separation of models.
If violations persist, the Commission may also resort to structural remedies under Article 18 DMA. After three non-compliance decisions in eight years, it may initiate a market investigation into systematic non-compliance.
This can result in binding decisions requiring:
- Structural separation
- Divestiture obligations
- Open-access mandates
While such measures may not reverse past infringements, they would neutralise Meta’s competitive advantage and restore a level playing field through remedial obligations tied to data governance.
Conclusion
The Cologne court’s approach raises serious concerns regarding the interpretation and enforcement of the DMA. The reasoning suggests a narrow, overly textual reading of key provisions that fails to reflect the regulatory logic behind the new digital regime.
The Commission retains wide powers to ensure compliance, deterrence, and proportionality. Businesses and affected stakeholders should prepare for prolonged regulatory disputes, with private enforcement and structural remedies likely to gain prominence.
