Stichting The Privacy Collective (TPC) alleges that Oracle and Salesforce used cookies to build and sell profiles of about 10 million Dutch internet users. Under the Dutch Act on Collective Damages Claims (WAMCA), it seeks €5B from each company, which contest its standing. On July 17, 2026, the Supreme Court of the Netherlands quashed the ruling that TPC may proceed and sent the question to the Court of Appeal of The Hague.
Latest development Jul 17, 2026
On July 17, 2026, the Supreme Court of the Netherlands quashed the Amsterdam appeal judgments that had declared Stichting The Privacy Collective admissible. It held that the Court of Appeal had set too low a threshold for representativeness. The Court of Appeal of The Hague must now decide whether the foundation has the support of a large enough part of the group it represents.
Why it matters
The Supreme Court’s ruling sets how much support a foundation needs before it may sue for millions of people on an opt-out basis. It applies to privacy and other actions under the Dutch Act on Collective Damages Claims (WAMCA).
Background
Stichting The Privacy Collective (TPC), a foundation set up in May 2020, sued Oracle and Salesforce in the District Court of Amsterdam on August 14, 2020. It alleges that their data management platforms placed cookies, combined online and offline data, and sold detailed profiles for targeted advertising. It says this breached the General Data Protection Regulation (GDPR), the Dutch Telecommunications Act, and the EU Charter of Fundamental Rights. TPC seeks declarations, injunctions, and damages of €5B from each company, or €500 per person. Oracle says it has meritorious defenses, and Salesforce says it did not place cookies itself but only provided a data management platform.
On December 29, 2021, the district court held TPC inadmissible because it had not shown that it was sufficiently representative of the people it acts for. The Court of Appeal of Amsterdam reversed on June 18, 2024. On September 24, 2024, it sent the case back to the district court and allowed an immediate appeal to the Supreme Court. Salesforce later said it had closed Audience Studio, its tracking and profiling business. On May 2, 2025, the Amsterdam interim relief judge ordered it to preserve that business’s data and to list its customers.
Advocate General R.H. de Bock advised the Supreme Court on January 30, 2026, to dismiss the companies’ appeals. On July 17, 2026, the Supreme Court held instead that the Court of Appeal had set too low a threshold for representativeness. It quashed both appeal judgments and referred the case to the Court of Appeal of The Hague. That court must reassess representativeness as matters stand when it rules, and decide whether the claim for material damages meets the similarity requirement. If TPC is held admissible, the case may return to the District Court of Amsterdam. There, the Court of Justice of the European Union (CJEU) ruling in Case C-523/25 will decide whether Article 80 of the GDPR requires a mandate from each person.
Timeline 8 events
-
JudgmentSupreme Court quashes admissibility ruling and refers case to The Hague
The court held that the Court of Appeal had set too low a threshold for representativeness and sent the case to the Court of Appeal of The Hague.
Supreme Court of the Netherlands, ECLI:NL:HR:2026:1198Houthoff
-
OrderAdvocate General advises the Supreme Court to dismiss the appeals
Advocate General R.H. de Bock found that the Court of Appeal had applied the admissibility requirements correctly and assessed them as matters stood at its decision.
Opinion of the Advocate General, ECLI:NL:PHR:2026:129The Privacy Collective
-
HearingSupreme Court hears the admissibility appeals
The hearing followed written submissions by Oracle, Salesforce, and the foundation, which had also filed a cross-appeal.
-
JudgmentAmsterdam judge orders Salesforce to preserve tracking and profiling data
In interim relief proceedings brought by the foundation, the court ordered Salesforce to keep Audience Studio data and to list the business’s customers within two weeks.
District Court of Amsterdam, ECLI:NL:RBAMS:2025:2936The Privacy Collective
-
OrderCourt of Appeal remits the case and allows a Supreme Court appeal
The court sent the merits back to the District Court of Amsterdam and granted Oracle and Salesforce leave for an interim appeal in cassation.
-
AppealCourt of Appeal of Amsterdam declares The Privacy Collective admissible
The appeal court reversed the district court and allowed the collective action to proceed.
Court of Appeal of Amsterdam, ECLI:NL:GHAMS:2024:1651Rechtspraak news
-
JudgmentDistrict Court of Amsterdam holds The Privacy Collective inadmissible
The court found that the foundation had not met the representativeness requirement of the Dutch collective action law and did not reach the merits.
-
FilingThe Privacy Collective sues Oracle and Salesforce in Amsterdam
The foundation alleged unlawful cookie tracking and profiling of Dutch internet users and claimed €500 per person in non-material damages, among other relief.
Oracle Form 10-Q legal proceedings noteRechtspraak register: TPC summons