A German consumer group said [press release, in German] Monday that the Berlin Regional Court [official website, in German] ruled [judgment, PDF, in German] that Facebook’s use of personal data was illegal because it did not adequately secure the informed consent of its users.

The Federation of German Consumers Organisation (vzbv) [advocacy website], which brought the suit, stated that Facebook’s default settings and some of its terms of service were in breach of consumer law by denying consumers of a “meaningful choice.” The Federal Data Protection Act [text, PDF] permits personal information to be recorded and used by a company only with explicit agreement from the individual.

According to Heiko Duenkel, litigation policy officer, “Facebook hides default settings that are not privacy-friendly in its privacy center and does not provide sufficient information about it when users register.” The main issues brought were regarding how it tracks which sites sites its users access; its app, which had a pre-activated service that revealed an user’s location to the person they chatted with; and default settings permitted search engines to link to the user’s timeline making it easier to find an user’s profile.

In accordance, the court found that the default settings were invalid as declarations of consent and eight clauses in the terms of service were declared invalid, such as the terms allowing Facebook to transmit data to the US and use personal data for commercial purposes and the “authentic name” policy which required users to use their real names. Additionally, the court held that Facebook needed to obtain explicit consent from its members before using their names and profile pictures in com mercialand sponsored materials.

Facebook plans to appeal, stating that it has made significant changes to its terms of service and data protection guidelines since the case was originally brought, and will be in accordance with the General Data Protection Regulation [text], which provides significant changes [text] in privacy laws.

vzbv also plans to appeal to the Berlin Court of Appeal [official website] on claims that were rejected.

Facebook in the past has faced various complications with its services and privacy concerns in Germany. In 2016, the Dusseldorf district court [official website, in German] ruled against the use of Facebook’s “like” button on an online shopping site, finding that consent from customers is required before transmission of their identities to Facebook. That same year, a federal court ruled that Facebook’s “friend finder” feature constituted as advertising harassment.