Aristotelis Zervos
Aristotelis Zervos, Editorial Director at 2B Advice, combines legal and journalistic expertise in Data protectionIT compliance and AI regulation.
In its ruling of 17.07.2025 (13 K 1419/23), the Cologne Administrative Court allowed the Federal Press Office to continue operating the Facebook fan page for the German government. The proceedings focused in particular on the question of whether the operation of a Facebook fan page by a federal authority is permissible under data protection law and to what extent there is joint responsibility with the operator of the network.
Federal Press Office takes BfDI to court over Facebook fan page
The Federal Commissioner for Data Protection and Freedom of Information (BfDI, since 3.09.24 The BfDI) had notified the Federal Press Office of February 17, 2023 the continued operation of its official Facebook fan page prohibited. At the same time, several Warnings due to breaches of data protection law.
The BfDI justified the order by stating that the operation of the fan page personal data of the users would be processed and transmitted to Facebook without a sufficient legal basis under Art. 6 GDPR or an effective Consent to § Section 25 (1) TTDSG is available. Specifically, the authority criticized:
- When calling up the fan page Cookies were set and read out, which made it possible to create a profile.
- The Federal Press Office had thus violated its Accountability pursuant to Art. 5 para. 2 GDPR violated.
- Despite discussions (including 2021/2022), no legal solution was found, even if Facebook deactivated the "Insights" statistics from April 2022.
The Federal Press Office defended itself against the decision and invoked its duty of publicity. Meta, as the operator of Facebook, considered its entrepreneurial freedom and freedom to provide services under the EU Charter of Fundamental Rights to have been violated.
Reading tip: Almost 800 million euros - EU imposes mega fine on Meta
No joint responsibility according to TTDSG
At the heart of the ruling was the prohibition of the operation of the fan page. The BfDI had argued that the Federal Press Office was obliged under Section 25 of the TTDSG to prohibit a Consent of the users. However, the Cologne Administrative Court found that the addressee of this standard is only the person who actually allows the setting or reading of Cookies initiated. These processes are controlled exclusively by the platform, in this case Meta, but not by the Federal Press Office. The shutdown of Facebook's "Insights" function in April 2022 also showed that the main technical means were outside the authority's sphere of influence. The court therefore came to the conclusion that the Federal Press Office was not a suitable addressee for such a ban.
The court also rejected the assumption of joint responsibility under Art. 26 GDPR. It is true that the Federal Press Office, by operating the fan page, was partly responsible for the Processing involved. For a Shared responsibility however, both the purposes and the means of the Processing be determined together. In the opinion of the court, this is not the case here. The mere use of the platform with the publication of own content is not sufficient.
The warnings of the Supervisory authority did not stand up to judicial review. It is true that the warning is generally permissible as a corrective measure and is intended to promote future legal compliance. However, it can only be issued to Responsible persons or processors who, at the time of their issuance, were still responsible for the contested Processing are responsible. As this was no longer the case at the Federal Press Office, the court declared the warnings to be unlawful. The action brought by the platform operator against these warnings was also inadmissible, as it was not the addressee itself.
Due to the fundamental importance of the questions raised, in particular whether fan page operators without their own influence are nevertheless considered jointly responsible, the Cologne Administrative Court allowed the appeal.
Significance of the decision for fan page operators
The ruling by the Cologne Administrative Court has far-reaching implications for the operation of social media fan pages by public bodies and companies. First of all, it makes it clear that the mere use of a platform does not automatically trigger joint responsibility under data protection law for all technical processes on the platform. The court thus limits responsibility much more narrowly than some supervisory authorities have previously assumed.
At the same time, the decision makes it clear that the provision of Section 25 TTDSG must be interpreted in a targeted manner: only the party directly responsible for setting or reading information on users' end devices is responsible. Authorities or companies that have neither influence on the technical process nor on the means used can therefore not be the addressee of drastic prohibition orders.
Particularly noteworthy is the restrictive interpretation of joint responsibility under Art. 26 GDPR. The court emphasizes that this requires a joint determination of both the purposes and the means. Mere contributory causation or the provision of content is not sufficient. This has significant practical consequences for all organizations that use social media offerings without being able to control the underlying technical processes.
Finally, the ruling also contains an important statement on the scope of the powers of the supervisory authorities: Warnings can only be issued effectively if the addressed body is actually still the responsible party at the time they are issued. The court thus restricts the possibility of sanctioning infringements solely on the basis of the past.
The decision thus strengthens legal certainty for public bodies and companies that operate social media fan pages without being able to influence the mechanisms of the platforms that are relevant under data protection law. At the same time, it forces the supervisory authorities to address their measures more precisely.
Joint responsibility: BfDI goes to appeal
It remains to be seen whether and to what extent higher authorities will confirm this line. The BfDI has lodged an appeal against the ruling of the Administrative Court of Cologne dated 17.07.2025. The proceedings will therefore be submitted to the next higher instance, the Münster Higher Administrative Court. The appeal is eagerly awaited.
Source: Cologne Administrative Court ruling 13 K 1419/23 from 17.07.2025
Aristotelis Zervos is Editorial Director at 2B Advice, a lawyer and journalist with profound expertise in data protection, GDPRIT compliance and AI governance. He regularly publishes in-depth articles on AI regulation, GDPR compliance and risk management. You can find out more about him on his Author profile page.
German 
English 
Italian 
French