Berlin's data protection authority has found that four of Germany's largest political parties - the CDU, the SPD, Bündnis 90/Die Grünen and Die Linke - processed personal data unlawfully when they used Facebook to aim ads at voters based on their political interests during the 2021 Bundestag campaign. The privacy group noyb, which filed the complaints in March 2023, made the decisions public today. The letters are dated September 24, 2026, five years to the day after the satirical late-night show ZDF Magazin Royale broadcast the investigation that set the cases in motion. A sixth complaint, against the far-right AfD, is still pending after the party lost a court fight over the regulator's investigative powers.

In Short

Four big German parties showed Facebook ads to people because Facebook had guessed what they thought about politics, and a Berlin privacy regulator has now said that broke Europe's data protection law. It matters because political opinions are among the most protected kinds of personal data in the EU, and the same targeting tools are used by every advertiser on the platform. Nobody was fined and no ban was issued, so what changes is mostly the legal record: targeting voters on political interest without consent is now officially on file as unlawful in Germany.

What the Berlin authority decided

The Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), the data protection commissioner for the state of Berlin, sent four letters to noyb - European Center for Digital Rights in Vienna. Each is headed "Abschlussnachricht", a closing notice, and each refers to a complaint dated March 21, 2023. The case references are C061-03 for the CDU, C061-04 for the SPD, C061-02 for Bündnis 90/Die Grünen and C061-06 for Die Linke.

The core finding is phrased the same way in all four. In the CDU letter, the authority wrote: "Einen Verstoß gegen die Datenschutz-Grundverordnung (DSGVO) bei der Verarbeitung Ihrer personenbezogenen Daten durch die Christlich Demokratische Partei Deutschlands haben wir aufgrund der uns zur Verfügung gestellten Informationen aus folgenden Gründen feststellen können." In PPC Land's translation of the German original: "On the basis of the information made available to us, we were able to establish a breach of the General Data Protection Regulation (GDPR) in the processing of your personal data by the Christian Democratic Party of Germany, for the following reasons." The party's legal name is Christlich Demokratische Union Deutschlands; the letter uses "Partei" instead of "Union".

The SPD letter names "die Sozialdemokratische Partei Deutschlands", the Left letter "die Partei Die Linke" and the Greens letter "die Partei BÜNDNIS 90/DIE GRÜNEN". Each also opens by telling noyb that "das auf Ihre o. g. Beschwerde hin eingeleitete Überprüfungsverfahren abgeschlossen ist" - the review procedure opened in response to the complaint "has been concluded", in PPC Land's translation.

What the public record does not include is the reasoning. noyb published a four-page, redacted extract: the first page of each letter only. Each page ends at the opening of the grounds section, with the line "Wir haben folgenden Sachverhalt festgestellt" ("We have established the following facts"). File numbers, the case handler's details and a block below the address are blacked out. The authority's analysis of legal basis, the specific ads and any corrective measures sits on pages that have not been released.

noyb's reading of the decisions

The account of what the authority concluded beyond the opening paragraph therefore comes from noyb. According to noyb's media update, sent at 07:00 today, the Berlin authority "reprimanded" the CDU, SPD, Greens and Left "for using sensitive political interests to target internet users with personalised political advertising." noyb states that, according to the authority, "there was no legal basis (such as consent) for targeting users based on their personal political interests for advertising," and that the processing of personal data by the four parties was unlawful.

A reprimand is the mildest corrective tool available to a supervisory authority under Article 58 of the GDPR. The released pages do not contain the word, so the characterization rests on noyb's summary of the full letters.

Felix Mikolasch, data protection lawyer at noyb, said in the release: "We welcome the Berlin DPA's decision. Microtargeting poses a threat to democracy, so these decisions provide a level playing field for political parties. It is unfortunate, however, that it took the Authority more than three years. After all, there was another federal election in the meantime."

That election took place in February 2025. PPC Land reported days before the vote that the complaints were still unresolved as Germany headed to a snap election, with noyb warning that the same techniques remained in use.

Max Schrems, honorary chairman of noyb, set expectations for what follows: "These cases may be more about future compliance than fines. While it is unfortunate that the Berlin authority did not directly issue a ban on microtargeting, we hope that it will take swift enforcement action if political parties continue to rely on such activities."

The decisions, in other words, carry no fine and, according to noyb, no order to stop. Their weight is precedential.

The AfD case and the court ruling

The AfD complaint, reference C061-05, remains open. According to noyb, the party also engaged in political microtargeting but "fought the Berlin DPA's investigative powers in court." noyb's release links to a press release from the Verwaltungsgericht Berlin, the Berlin Administrative Court.

That court release, number 12/2026 dated March 11, 2026, reports that the 42nd chamber dismissed the AfD's lawsuit in case VG 42 K 13/25. According to the court, the case began with a complaint about a TV spot the AfD had run as a Facebook ad during the 2021 campaign, which the complainant said had been shown only to a narrow group of men interested in the FDP. The authority demanded full evaluations and billing records for that ad, plus the content, reach and audience characteristics of any other social media ads the party ran in 2021. The AfD argued it had already supplied enough and that further demands amounted to boundless probing that infringed party freedom.

The court disagreed. According to its release, the GDPR obliges the party to answer, and the authority may request information to understand processing risks or even to determine whether personal data is processed at all. Comprehensive information was needed specifically to examine political targeting, the court said, noting the authority had sent similar requests to every Berlin-based party represented in the Bundestag in 2021. The AfD can apply to the Higher Administrative Court of Berlin-Brandenburg for leave to appeal. noyb describes the AfD's challenge as unsuccessful "so far".

The ÖDP complaint

noyb's March 2023 announcement listed six complaints, not five. The sixth, C061-01, targeted the Ecological Democratic Party (ÖDP). Today's release does not mention it. PPC Land's February 2025 coverage reported that the complaints had been split between the Berlin and Bavarian data protection authorities, and the ÖDP is not among the parties covered by the Berlin letters. Its status is not stated in any of the attached documents.

How the complaints were built

The legal case rests on data that viewers of a satirical TV programme collected themselves. In April 2021, according to noyb's 2023 complaint announcement, ZDF Magazin Royale - the Friday-night show hosted by Jan Böhmermann on German public broadcaster ZDF - asked its audience to install a browser extension that logged which political ads Facebook showed them and why.

On the broadcast of September 24, 2021, two days before the federal election, the show said 17,451 viewers had taken part. The data was collected by the transparency initiative Who Targets Me, and the show said it had analysed 134,000 Facebook ads over the summer. (The auto-generated YouTube captions render the group's name and some figures incorrectly; the names here follow the TargetLeaks site and PPC Land's earlier reporting.)

The findings were published on a dedicated site, TargetLeaks, described as "Eine Aktion des ZDF Magazin Royale in Kooperation mit Who Targets Me" - a ZDF Magazin Royale project in cooperation with Who Targets Me. The site is organised into five sections: TargetLeaks, "Wer zielt auf wen?" (who targets whom), a "Lost Ads Library", a "Target-O-Mat" and "Stellungnahmen", the parties' responses. Its credits list quantitative data analysis by Luca Hammer, data visualisation by Fabio Votta and scientific expertise from Simon Kruschinski. Researchers interested in the underlying data are directed to Who Targets Me.

The site's summary is blunt. "Alle Parteien, die im Bundestag vertreten sind, nutzten im Bundestagswahlkampf 2021 auf Facebook sogenanntes Microtargeting - das gezielte Ausspielen von personalisierter Werbung an kleine Personengruppen," it states. In PPC Land's translation: "All parties represented in the Bundestag used so-called microtargeting on Facebook in the 2021 federal election campaign - the targeted delivery of personalised advertising to small groups of people." It adds that the parties had "in den vergangenen Monaten tausende Facebook-Werbungen gezielt an winzige Personengruppen gerichtet" - aimed thousands of Facebook ads at tiny groups of people over the preceding months.

The YouTube upload of the segment, "Die schmutzigen Facebook-Tricks der Parteien" (The parties' dirty Facebook tricks), had 1,421,418 views, 34,412 likes and 1,702 comments when the page was captured, on a channel with 1.45 million subscribers.

What noyb took from the data

noyb used the donated data to identify specific individuals who had been shown ads, which is what allowed it to file complaints on behalf of named data subjects. Its 2023 announcement drew the legal line clearly. Showing political ads to Facebook users "is not unlawful per se," noyb wrote. "However, the users were selected because Facebook had evaluated their political views in the background." Political opinions are special category data under Article 9 of the GDPR, which prohibits processing them unless one of a short list of exceptions applies, the most relevant being explicit consent.

noyb's view in 2023 was that both the parties and the social network violated the GDPR. The complaints, however, were brought against the parties or their sub-organisations, "as they are responsible for the advertisements." That choice explains why the Berlin decisions address parties rather than Meta. An advertiser that selects an interest-based audience on a platform is, on this reasoning, responsible for the processing that follows.

Mikolasch framed the risk in 2023 in terms advertisers will recognise: "Any data on a person's political views is protected particularly strictly by the GDPR. Such data is not only extremely sensitive, but also allows large-scale manipulation of voters, as Cambridge Analytica has shown."

What the show said it found

The TV segment is satire, and its findings come wrapped in jokes, but it gave specific examples. All of the following are the show's claims; the Berlin letters do not address individual ads.

According to the show, the FDP in Bavaria targeted users interested in property investment and finance, and the CDU targeted members of shooting clubs. The show said the FDP ran contradictory climate messages to different audiences: users Facebook had sorted under interests such as environment, organic food, WWF and climate protection saw an ad calling for "einem klaren CO2-Limit" (a clear CO2 limit), while users classed as frequent business travellers saw an ad rejecting "restriktiven staatlichen Maßnahmen, Freiheitseinschränkungen und Verboten" - restrictive state measures, curbs on freedom and bans. The FDP is not among the parties named in today's decisions.

The show also said the CDU in Mecklenburg-Vorpommern, ahead of that state's 2021 election, had engaged an outside agency for more precise targeting, a Vienna firm led by Philipp Maderthaner, and linked him, citing a leaked email first reported by Netzpolitik.org, to an interest in Cambridge Analytica's services before Sebastian Kurz's first election win in Austria. PPC Land's February 2025 coverage identified the agency as Campaigning Bureau. The show stated that Maderthaner responded to press enquiries by threatening legal action. None of the attached documents independently support the Cambridge Analytica connection, and the Berlin decisions do not mention it.

On Die Linke, the show said MP Diether Dehm ran an ad about receiving the Sputnik vaccine in Moscow aimed at users interested in Russia, the broadcaster Russia Today and Vladimir Putin.

Ministries in the campaign

Two examples involved government bodies rather than parties. The show said the Federal Ministry of Labour and Social Affairs, then led by the SPD's Hubertus Heil, paid during the campaign for a cycle-to-work ad - "Öfter mal mit dem Rad zur Arbeit" - shown to users interested in politics, cycling, democracy and the SPD. It said the climate ministry of Rhineland-Palatinate, run by the Greens, targeted users interested in gardening, organic food, zero waste and Bündnis 90/Die Grünen. The show called both taxpayer-funded party advertising. PPC Land reported in 2025 that the labour ministry had described its targeting as an "error".

The missing ads

The segment's final claim concerned transparency. According to the show, Facebook had promised after the Cambridge Analytica scandal that political ads would be stored in its Ads Library for seven years, active or not. The show said it counted, and that thousands of ads in its dataset, including one from the federal government, were missing from the library. Those ads were published on TargetLeaks as the "Lost Ads Library".

The show also referred to a US researcher who had studied Facebook ads in the German campaign until Facebook blocked her access. Its YouTube description links an NDR report headlined "Wegen Facebook-Sperre: Aus für Datenprojekt für Bundestagswahl" - a Facebook block ends a data project for the federal election.

Two researchers on effects

Two unnamed experts interviewed on the programme offered the most measured claims in it. One said the research did not suggest targeting was mainly used to persuade people with different views: "Wir gehen eher von mobilisierender Wirkung aus, also dass die eigenen Gedanken und Weltanschauungen verstärkt werden und es auch in Extremfällen dann zu einer Radikalisierung kommen kann." In PPC Land's translation: "We assume more of a mobilising effect - that people's own thoughts and worldviews are reinforced, and that in extreme cases this can lead to radicalisation."

Another put the democratic objection in structural terms: "Im Kern ist politisches Online-Targeting zutiefst antidemokratisch, weil es auf dem Prinzip des Ausschlusses von Personengruppen basiert." In PPC Land's translation: "At its core, political online targeting is deeply anti-democratic, because it is based on the principle of excluding groups of people." Both quotes are taken from YouTube's automatic captions, lightly corrected for spelling.

The show contrasted Facebook with offline rules, noting that some German municipalities hang every party's election posters themselves at random, and that outdoor advertising company Ströer had stopped selling political advertising. Its description links a Tagesschau piece titled "Politische Anzeigen: Ströer verzichtet, Facebook macht weiter" - Ströer opts out, Facebook carries on.

Why five years matters to advertisers

The timeline is the story's uncomfortable centre. The ads ran in the spring and summer of 2021. noyb filed in March 2023. The decisions are dated September 24, 2026, three and a half years after the complaints and after a second federal election had come and gone.

In the meantime, the rules changed around the parties. Regulation (EU) 2024/900 on the transparency and targeting of political advertising - known as the TTPA - prohibits profiling based on special categories of personal data such as political opinions, according to Commission guidance PPC Land covered in July 2025. The TTPA has applied since October 10, 2025. Google had already said in November 2024 that it would stop serving political ads in the EU, and Meta followed, blocking political, electoral and social issue ads across the EU from October 6, 2025. PPC Land described the combined effect as regulation killing digital political advertising in the EU.

German industry guidance has since spelled out the consent requirement in operational terms. The BVDW's guide to political ads under the TTPA, dated April 13, 2026, states that where personal data is used for targeting, explicit consent must be collected before a campaign runs, and recommends a dedicated political-advertising category in a consent management platform.

So the Berlin decisions land in a market where the largest platforms no longer sell the product in question in the EU. Their practical relevance lies elsewhere.

First, they confirm in a German enforcement decision what noyb argued in 2023: that the advertiser, not just the platform, is answerable for targeting built on inferred sensitive interests. That reasoning does not depend on the ad being political. Interest categories that reveal health, religion, sexual orientation or political views sit in Article 9 territory for any advertiser who selects them.

Second, they follow a pattern. In December 2024, the European Data Protection Supervisor found the European Commission had unlawfully targeted ads on X using data on political views and religious beliefs, in a case also brought by noyb. That too ended in a reprimand rather than a fine, because the campaign had already stopped.

Third, they show how long enforcement takes and how little it costs the parties involved. Schrems's own framing - "more about future compliance than fines" - concedes the point. The question his statement leaves open is whether the authority would act faster, and with stronger tools, if a party repeated the practice now.

Timeline

Summary

Who: The Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI); the CDU, SPD, Bündnis 90/Die Grünen and Die Linke; noyb, which filed the complaints; the AfD, whose case is pending; ZDF Magazin Royale and Who Targets Me, which collected the original data.

What: The authority found that the four parties breached the GDPR by processing personal data to target Facebook users based on their political interests during the 2021 federal election. According to noyb, it found no legal basis such as consent and issued reprimands, but no fines or ban.

When: The closing notices are dated September 24, 2026. noyb published them today, October 21, 2026. The complaints were filed March 21, 2023, over ads from the 2021 campaign.

Where: Germany, with the decisions issued in Berlin and the targeting carried out on Facebook.

Why: Political opinions are special category data under Article 9 GDPR. Selecting voters by interests that reveal political views requires a legal basis the parties did not have, according to noyb's account of the decisions. The outcome confirms advertiser responsibility for interest-based targeting on sensitive data, after a delay that spanned a further federal election and the arrival of the EU's TTPA.