2026 is the year German courts got serious about Meta's Business Tools. Since February, several higher regional courts (Oberlandesgerichte, OLG) have ordered Meta to pay damages to users because data from third-party websites was collected via the Meta Pixel and the Conversions API. At the same time, Germany's Federal Court of Justice (BGH) is examining whether tracking providers themselves are liable when cookies are set without consent.
For advertisers this is not a reason to panic, but it is a clear signal. In this article we explain what was decided, who was actually sued, which questions are still open and what you should check in your own setup.
This article is not legal advice. It summarises publicly reported decisions (status: 15 October 2026). Whether and how your specific setup is affected is best clarified with your data protection officer or a lawyer specialising in data protection.
The rulings at a glance
The cases all follow a similar pattern: a Facebook or Instagram user sues Meta because Meta received data about their visits to third-party websites and apps via the Business Tools (Meta Pixel, Conversions API and SDKs) without valid consent.
- OLG Dresden, 3 February 2026: The 4th civil senate ordered Meta to pay 1,500 euros in damages in each of four parallel cases and prohibited further processing. According to the court's press release, the loss of control over one's own data is enough to constitute damage. The plaintiffs did not have to prove which websites they actually visited. An appeal on points of law was not allowed.
- OLG Jena, 2 March 2026 (3 U 31/25): 3,000 euros in damages, plus access to and deletion of the data. According to beck-aktuell, the court described it as data collection without cause. An appeal to the BGH was allowed.
- OLG Hamm, 9 March 2026 (8 U 21/25): 1,500 euros.
- Other higher regional courts: Rulings have also been reported from Naumburg (around 1,200 euros), Stuttgart (500 euros), Munich (750 euros) and Brandenburg (2,000 euros). We only know these amounts from secondary sources, such as law firms representing plaintiffs.
The range of 500 to 3,000 euros shows that the courts do not agree on the amount. Because an appeal was allowed in some cases, a BGH decision on the level of damages is likely.
Important: Meta was sued, not the website operators
In these cases the plaintiffs sued Meta, not the shops, agencies or companies whose websites ran the pixel. That is the key point for putting the rulings in context.
Still, the rulings concern you as an advertiser. The courts assume that data flows via the pixel and Conversions API without valid consent are unlawful. And that data originates on your website. Some law firms therefore argue that website operators and Meta are joint controllers under Art. 26 GDPR and that affected users could also go after the operator. That is not far-fetched: back in 2019, in the Fashion ID case, the CJEU ruled that a website operator embedding the Facebook Like button is jointly responsible for collecting and transmitting the data.
However, we could not reliably confirm a German court ruling that ordered a website operator to pay damages over the Meta Pixel. That question is open, which is exactly why it is worth getting your setup right now.
The BGH is examining the liability of tracking providers
In parallel, the Federal Court of Justice is hearing case I ZR 5/26, argued on 8 October 2026. There is no judgment yet.
The case: a user sued a technology provider whose cookies were set on a website without consent in March 2022. The Frankfurt regional court awarded 1,500 euros. The Frankfurt higher regional court reduced the amount to 100 euros but upheld the injunction. Its reasoning: the provider must make sure the website passes on the user's consent before it sets cookies.
According to beck-aktuell, the BGH senate shares the higher regional court's view on many points but has questions about the extent of liability. Referring the case back to the higher regional court is possible.
Why this matters for you: if the BGH confirms that tracking providers bear their own responsibility, providers will tie their scripts more tightly to verifiable consent. And the pressure on advertisers to show that their consent setup actually works technically, not just on paper, will grow.
Does this also apply to the Conversions API?
Yes. A common misconception goes: "If I switch to server-side tracking, I no longer need consent because no cookies end up in the browser." That is not true.
The cases against Meta explicitly concern the Business Tools as a whole, meaning pixel and Conversions API. What matters is not the transfer route but that personal data goes to Meta for advertising. Under the GDPR you need a legal basis for that, which in practice is consent.
On top of that comes Art. 5(3) of the ePrivacy Directive (§ 25 TDDDG in Germany): as soon as something is stored on or read from the device, such as the _fbp cookie or the click ID from local storage, you need consent for that too. In its Guidelines 2/2023 on the technical scope of Art. 5(3), the European Data Protection Board made clear that tracking pixels and tracking links fall under it too, not just classic cookies.
The advantage of the Conversions API lies elsewhere: it makes your data more reliable because ad blockers and browser restrictions interfere with it less. More on that in the article pixel vs. Conversions API.
What is changing at Meta itself
Things are moving on the platform side as well. In April 2025 the European Commission fined Meta 200 million euros under the Digital Markets Act over its "pay or consent" model. Meta appealed, but in December 2025 committed to offering EU users, from January 2026, a choice between full personalisation and less personalised ads using less data.
For advertisers this means Meta has less on-platform data for part of its EU users. That makes conversion signals you deliver from your website with consent all the more important, properly deduplicated and with good Event Match Quality.
What you should check now
- Does the pixel load before consent? Open your website in a private window, open the developer tools ("Network" tab) and filter for
facebook. Before you accept in the cookie banner, no request tofacebook.comorconnect.facebook.netmay go out. - Is rejecting as easy as accepting? A "Reject all" button on the first layer of the banner is the safest design.
- Does the Conversions API also only run with consent? Many setups gate the browser pixel but still send everything to Meta server-side. Check whether your server setup respects the consent status.
- Are events counted twice? If pixel and Conversions API run in parallel, you need event deduplication via a shared event ID.
- Is everything documented? Privacy policy, data processing agreements with your tools and a list of the cookies you use all belong here.
You can find a step-by-step walkthrough of consent, cookie banners and Consent Mode in the guide to GDPR-compliant tracking.
How LeadSignal handles this
LeadSignal comes with its own cookie banner. The script only loads the Meta Pixel, TikTok Pixel and LinkedIn Insight Tag after the visitor has consented to the Marketing category. Pixel and Conversions API run in parallel with a shared event ID.
If you want to interpret consent strictly for the server route as well, enable restricted consent mode in the project settings. Then nothing except the consent decision itself leaves the browser until marketing consent: no events, no Conversions API calls, and Google also loads only after consent. Given the current rulings, this is the mode most advertisers in Germany will sleep best with.
Conclusion
The 2026 higher regional court rulings are directed against Meta, not against website operators. But they confirm a line that applies to everyone: in the courts' view, sending data to Meta via pixel or Conversions API without valid consent from the visitor is a GDPR violation. Whether website operators are jointly liable is open, and the BGH will set important markers in the coming months.
The good news: the right setup is not rocket science. Pixel only after consent, tie the server route to consent as well, make rejecting as easy as accepting. That keeps you on the safe side, however the BGH decides.