AI Models May Be Trained With Publicly Available Data From Social Networks, Says the Higher Regional Court of Cologne (Decision of 23 May 2025, Ref. 15 Ukl. 2/25)

Jun 26 2025

By: Dr. Thomas Nietsch and Andreas Müller

In proceedings initiated by a Consumer Protection Agency for a preliminary injunction against the operator of a social network to prohibit the use of publicly accessible user data for AI training, the competent court ruled that using such data is permissible under the General Data Protection Regulation (GDPR.)

The court held that, under certain conditions, the use of publicly available personal data may be based on legitimate interest (Art. 6(1)(f) GDPR), as the controller’s interest in training AI models outweighs the users’ interest in their privacy. The data that may be used for training includes publicly accessible account information and user-generated content. The court assessed the lawfulness on the following criteria:

Processing serves a legitimate purpose,
Is necessary, and
The data subjects’ interests do not prevail.

The court recognized AI development and economic opportunities as a legitimate interest and emphasized the controller’s compliance with the EDPB opinion on AI models (Dec 2024). Factors supporting admissibility included: use is limited to accounts of adults, only data voluntarily published is used and de-identification measures are applied (e.g., exclusion of addresses and license plate numbers).

The court also noted that data processing had been announced already in 2024, users had been informed of their right to object under Art. 21 GDPR and processing would not start before the end of May 2025.

Although the published data may include special categories of personal data (Art. 9 GDPR) and data relating to minors, the court still found that the controller’s interest prevails, which may give rise to criticism.

So far, only a press release has been issued but not the court’s full reasoning. For now, AI training with personal data based on legitimate interest is conditionally permissible under the GDPR, though this is only a preliminary ruling and does not bind other courts.