AI training exemption saves Meta from DMA data combination penalties
German court rules AI development differs from advertising, allowing Meta to combine platform data for training purposes.
The Higher Regional Court of Cologne ruled on May 23, 2025, that Meta's proposal to incorporate partially de-identified data from two core platform services into an unstructured AI training dataset does not constitute a prohibited data merger under the Digital Markets Act (DMA). According to the court decision in case 15 UKl 2/25, neither the DMA nor GDPR provides a statutory definition of data combination that would restrict AI training practices.
The landmark ruling directly contradicts the regulatory position established by the Bundeskartellamt's 2019 Facebook decision, which prohibited data combination across platforms without user consent. According to the court's findings, Meta's approach to integrating decomposed data from platform services into AI training datasets cannot be equated with the data combination practices prohibited by Article 5(2)(1)(b) of the DMA.
Summary
Who: The Higher Regional Court of Cologne ruled in case 15 UKl 2/25 regarding Meta's data processing practices for AI training under Digital Markets Act provisions.
What: The court determined that Meta's proposal to incorporate partially de-identified and decomposed data from two core platform services into unstructured AI training datasets does not constitute prohibited data combination under Article 5(2)(1)(b) DMA.
When: The decision was issued on May 23, 2025, providing legal clarity on AI training practices under European competition law following ongoing regulatory scrutiny of gatekeeper compliance.
Where: The ruling applies to Meta's operations across European markets, establishing precedent for how German courts interpret DMA data combination restrictions in AI development contexts.
Why: The court found that neither DMA nor GDPR provides statutory definitions restricting AI training data aggregation, and legislators did not specifically consider unique aspects of AI development when drafting Article 5(2) DMA provisions.
Get the PPC Land newsletter ✉️ for more like this.
The regulatory perspective maintains that Article 5(2)(1)(b) DMA applies broadly to any purpose for data combination, including AI training. According to the Bundeskartellamt's established position, gatekeepers cannot combine personal data from different core platform services regardless of technical implementation or stated purpose, as such practices provide unfair competitive advantages through data accumulation.
The court's interpretation challenges the Bundeskartellamt's established precedent that comprehensive data processing requires voluntary user consent when conducted by dominant market players. According to the regulator's 2019 decision, Facebook's Terms of Service and Data Policy allowed collection, combination, and use of data "without restriction for all purposes," which could only be justified through genuine voluntary consent.
The Bundeskartellamt had determined that data combination across WhatsApp, Instagram, and Facebook Business Tools violated competition law regardless of technical methodology. According to the regulatory analysis, such practices provided Facebook with competitive advantages unavailable to rivals, creating barriers to market entry through data accumulation benefits.
The regulatory stance emphasizes that market dominance fundamentally alters data processing obligations under both competition and privacy law. According to the Bundeskartellamt's analysis, companies with dominant positions cannot claim that data processing benefits offset fundamental rights violations, as data protection provides users with "fundamental rights of freedom" rather than "mere economic assets."
This position directly conflicts with the court's technical distinction between AI training and personalized advertising. According to the regulator, Article 5(2)(1)(b) DMA contains no purpose-specific limitations, applying "in relation to any purpose for which the data is used, including for the purpose of serving personalized advertising to those end users."
The court's reasoning that legislators did not consider AI training when drafting DMA provisions contradicts the regulatory view that the law's broad language encompasses all data combination activities. According to the Bundeskartellamt's framework, data protection violations by dominant companies create "normative-causal connections" that strengthen market power through additional barriers to entry.
Regulatory authorities argue that allowing AI training exemptions would undermine the DMA's core objectives of preventing data accumulation advantages. According to this perspective, gatekeepers' enhanced access to personal data from multiple sources provides "potential advantages in terms of accumulation of data, thereby raising barriers to entry and hindering contestability in digital markets."
The regulatory approach treats data combination as inherently problematic when conducted by gatekeepers, regardless of technical implementation. According to the Bundeskartellamt's established precedent, partially de-identified or decomposed data still provides competitive advantages when aggregated across multiple platform services, as the insights derived enable superior targeting and service personalization.
This fundamental disagreement extends to consent mechanisms and user choice. According to the regulatory position, dominant companies cannot obtain valid consent when service provision depends on data processing agreement, as market dominance creates "clear imbalance" between users and controllers that prevents voluntary consent under GDPR principles.
The court's technical analysis distinguishes AI training from traditional advertising applications, arguing that partially de-identified data aggregation differs from direct personal data combination. However, this interpretation challenges regulatory warnings about "potential risks of data processing" and future technical capabilities that "may not be available currently but could well be in the future."
Competition authorities maintain that comprehensive data processing by dominant platforms cannot be justified through claimed benefits when fundamental legal protections are violated. According to the regulatory framework, "the breach of legal protection provisions which are intended to benefit users cannot be justified" by arguing that performance benefits offset privacy violations.
Why the court decision contradicts regulatory enforcement
The Higher Regional Court of Cologne's ruling fundamentally challenges the regulatory approach established by German competition authorities over the past six years. According to the Bundeskartellamt's 2019 Facebook decision, data combination practices by dominant platforms violated both competition law and data protection principles regardless of stated purpose or technical implementation.
The court's acceptance of AI training as a legitimate exception contradicts the regulator's position that Article 5(2)(1)(b) DMA contains no purpose-specific carve-outs. According to the regulatory interpretation, the provision applies broadly to prevent data accumulation advantages that strengthen gatekeeper positions across all business activities.
This disagreement reflects broader tensions between judicial interpretation of technical AI requirements and regulatory concerns about market concentration through data control. The Bundeskartellamt's approach prioritizes preventing competitive advantages through comprehensive data restrictions, while the court emphasizes technical distinctions between different data processing applications.
European regulatory frameworks increasingly scrutinize AI training practices across multiple jurisdictions. The Dutch Data Protection Authority published comprehensive guidance on GDPR preconditions for generative AI, while German authorities issued detailed AI development guidelines covering the entire system lifecycle.
Meta faces ongoing regulatory challenges regarding DMA compliance across different aspects of its operations. The company formally appealed the European Commission's April decision regarding its choice between ad-free subscription and personalized advertising services in Europe.
The Court of Justice of the European Union previously established precedent supporting business models that offer paid subscription alternatives to consent for personalized advertising. According to the July 4, 2023 Grand Chamber judgment, dominant companies can obtain valid consent by providing users choice between subscription-based service and free, personalized ad-supported service.
Multiple national courts and data protection authorities have endorsed approaches providing paid subscription alternatives to consent for personalized advertisements. According to Meta's regulatory filings, France, Denmark, and Germany have all supported such business models, making the company's situation distinct among European technology platforms.
The Cologne court's decision creates important precedent for AI development under European digital competition law. According to legal experts, the ruling establishes that technical data processing for machine learning purposes requires separate analysis from traditional data combination practices targeted by the DMA.
AI training datasets typically involve billions of pieces of information from different data types including text, images, and audio. According to technical documentation, generative AI models learn relationships and associations between content types through studying aggregated information rather than creating individual user profiles.
The court acknowledged that data processing for AI development involves different technical and legal considerations compared to personalized advertising. According to the ruling, AI training typically requires large, diverse datasets to achieve effective performance rather than detailed individual user profiling.
Pattern recognition in AI models occurs through embedded numerical weights rather than explicit data representation. According to technical analysis, the information becomes implicitly integrated into weight collections rather than maintaining identifiable personal data characteristics.
For the marketing community, this decision provides clarity regarding AI-powered advertising tools and optimization systems. The Digital Markets Act has fundamentally altered the regulatory landscape for major technology platforms, requiring careful navigation of data processing requirements across different business applications.
Marketing technology providers can develop AI-powered targeting and optimization tools without violating DMA data combination restrictions, provided they follow appropriate technical approaches. The ruling distinguishes between data processing for personalized advertising delivery and data processing for AI system training and improvement.
The decision arrives amid broader European scrutiny of gatekeeper compliance with DMA obligations. Recent developments include investigations into Google's search result modifications and transparency requirements for advertising platforms.
European Commission enforcement of DMA provisions continues evolving as regulators address novel technical challenges presented by AI development. According to industry observers, the Cologne court's decision provides necessary clarification for technology companies developing AI systems while maintaining compliance with competition law.
The ruling emphasizes the importance of technical implementation approaches in determining DMA compliance. According to the court, partially de-identified and decomposed data processing differs substantially from direct personal data combination that would violate Article 5(2)(1)(b) restrictions.
Meta's approach involves preprocessing data to remove direct personal identifiers before incorporation into training datasets. According to technical documentation, this methodology ensures that individual user profiles cannot be reconstructed from the processed information used for AI training.
The court distinguished between data aggregation for machine learning purposes and data combination for targeted advertising applications. According to legal analysis, this distinction acknowledges the different technical requirements and objectives of AI development compared to personalized advertising delivery.
Industry stakeholders anticipate the decision will influence how other European courts interpret DMA provisions regarding AI development. According to regulatory experts, the ruling establishes important precedent for technology companies seeking to develop AI systems while maintaining compliance with European competition law.
The decision provides guidance for companies developing AI-powered marketing tools and advertising optimization systems. Marketing technology providers can proceed with AI development projects involving aggregated platform data, provided they implement appropriate technical safeguards and data processing methodologies.
European regulatory frameworks continue evolving to address the intersection of AI development and data protection requirements. TikTok's enhanced data portability measures and Apple's App Store policy changes demonstrate ongoing platform adaptation to DMA requirements.
The Higher Regional Court of Cologne's decision clarifies that AI training using aggregated, de-identified data does not automatically violate DMA data combination restrictions. This technical distinction enables continued AI development while maintaining the DMA's objectives of preventing anticompetitive data practices in personalized advertising contexts.
Timeline
- May 23, 2025: Higher Regional Court of Cologne rules Meta's AI training data practices comply with DMA requirements in case 15 UKl 2/25
- July 4, 2023: European Court of Justice Grand Chamber establishes precedent supporting subscription alternatives to personalized advertising
- March 2024: DMA obligations become legally binding for designated gatekeepers
- April 2024: European Commission issues decision stating Meta's European offering does not comply with DMA
- July 2, 2025: Meta announces formal appeal of Commission decision on DMA compliance
- May 2025: Dutch Data Protection Authority publishes GDPR preconditions for generative AI
- June 2025: German authorities issue comprehensive AI development guidelines