On 24 February 2026, the Amsterdam District Court issued its ruling in a collective action against X Corp (formerly Twitter), holding that the Data Protection Netherlands Foundation (SDBN) is not admissible. The case concerns MoPub, an advertising platform formerly owned by Twitter. According to SDBN, user data from free mobile apps was unlawfully collected over an extended period via the MoPub SDK and then shared with numerous third parties for personalized advertising.
REPRESENTATIVENESS. The group that SDBN claims to represent comprises nearly all Dutch smartphone users, estimated at about 11 million people. However, only around 11,000 registrations have been made through the foundation’s website, so roughly 0.1% of that group. The Court finds this insufficient.
Its reasoning seems inconsistent, though. First, the Court approvingly cites the Amsterdam Court of Appeal in TPC v Oracle, stating that having “support from a non-negligible number of people” is both necessary and sufficient. However, it also cites the legislative history, the Explanatory Memorandum (MvT): “It must be evident beforehand that the claim organization represents a sufficiently large number of affected victims in quantitative terms,” and then concludes that 0,1% is, of course, too small to say that SDBN “represents a sufficiently large number of the affected victims.” “Not negligible” does not equate to “sufficiently large.”
However, that’s not all. The court also criticized the registration process, noting it does not automatically show that registrants actually supported the specific claims. Around 11,000 people allegedly showed their support by submitting minimal information through a website form. However, providing some basic details does not reliably indicate genuine support for the claims. This issue is compounded by the fact that the SDBN website registration process lacked transparency, failing to clearly and fairly disclose the details of the mass claim.
COMMONALITY. The Court also finds that the claims do not satisfy the WAMCA commonality requirement. Data processing occurred across more than 30,000 different apps. For each app, the methods of data collection, software configuration, and the manner in which consent was obtained can vary significantly. As a result, it must be assessed separately for each app and user whether personal data has been processed and whether that processing was lawful.
No final decision has been reached yet. The Court notes that the Rotterdam District Court has submitted preliminary questions to the Court of Justice regarding Article 80 GDPR. The responses to these questions may be relevant to determining whether the current proceedings are admissible.
(The Rotterdam Court has, among other things, asked whether the admissibility requirements under the WAMCA—specifically, commonality and representativeness—are consistent with Article 80 GDPR.)
