The European Union's top court ruled on Thursday that Germany's consumer protection association could bring a legal challenge against Facebook parent Meta over data privacy.

The Court of Justice of the European Union's (CJEU) verdict means that the Federation of German Consumer Organisations can seek an injunction against Meta Platforms Ireland in a German court.

The federation alleges that Meta infringed rules on data privacy, unfair competition and consumer protection related to free games by third parties available to Facebook users.

The gaming companies obtained certain personal data in the process.

The German court referred the case to the CJEU, asking if, under EU law on data protection that came into force in 2018, a consumer body could still take legal action over data privacy infringements or whether this was now a matter only for national supervisory authorities...

The EU court ruled that the EU General Data Protection Regulation (GDPR) did not preclude national legislation allowing consumer protection associations to bring legal proceedings.

It also said a consumer association, such as the German federation, counted as a body that could bring proceedings related to GDPR because it was acting in the public's interest.

It could also bring such action without having to identify the person or people whose rights had been infringed.