Two foundations allege that Google collects and commercially exploits Dutch users’ personal data in breach of privacy law. Stichting Bescherming Privacybelangen (SBP) claims €750 per user, and Stichting Massaschade & Consument (SMC) acts for more than 9 million Android users. The District Court of Amsterdam found both met the Dutch admissibility rules but stayed the case pending an EU ruling. SMC says the court will decide on November 4, 2026, whether to resume.
Latest development Dec 10, 2025
On December 10, 2025, the District Court of Amsterdam again refused to resume the privacy cases against Google brought by Stichting Bescherming Privacybelangen and Stichting Massaschade & Consument. The court later refused leave for an interim appeal. Stichting Massaschade & Consument reports that the court will decide on November 4, 2026, whether to resume the case.
Why it matters
The claims could cover most Dutch internet users and challenge Google’s core advertising model. Whether they go forward depends on the CJEU’s ruling on whether Dutch foundations may seek GDPR damages without each user’s mandate.
Background
Stichting Bescherming Privacybelangen (SBP), backed by the Dutch consumers’ association Consumentenbond, sued Alphabet, Google LLC, Google Ireland, and Google Netherlands in the District Court of Amsterdam on September 12, 2023. It acts for people in the Netherlands who have used Google services since March 1, 2012, and estimates the users of YouTube and Google Search at about 15 million. It alleges that Google collects and shares users’ data through online advertising auctions without a valid legal basis, misleads users, and transfers data to the United States. It seeks changes to these practices, €750 per person in non-material damages, and a share of Google’s profits as material damages.
Stichting Massaschade & Consument (SMC) sued on December 12, 2023, for Dutch users of Android phones since May 25, 2018, which it puts at more than 9 million people. It alleges that Google Play Services, which runs on nearly every Android phone and cannot be switched off, collects location and usage data unlawfully. Google asked the court to declare both foundations inadmissible.
On January 15, 2025, the court held that it has jurisdiction and that both foundations meet the admissibility requirements of the Dutch Act on Collective Damages Claims (WAMCA). It left for later Google’s defense that Article 80 of the General Data Protection Regulation (GDPR) requires a mandate from each user. The District Court of Rotterdam was then preparing to refer that question to the Court of Justice of the European Union (CJEU).
On April 23, 2025, the court stayed the case until the CJEU answers the Rotterdam questions, now Case C-523/25. It refused requests by the foundations to resume on July 21 and December 10, 2025, and then refused SBP leave for an interim appeal. SBP says the stay causes unreasonable delay. According to SMC, the court put off its decision on resuming the case until October 2026 and then until November 4, 2026. SMC also reported that Ireland’s Data Protection Commission announced a €403M fine against Google in September 2026 over location data.
Timeline 8 events
-
Scheduled orderDistrict Court of Amsterdam due to decide whether to resume Google cases
Stichting Massaschade & Consument reported that the court had put off its decision on resuming the stayed cases until this date.
-
OrderCourt again refuses to lift the stay
The foundations had pointed to appeal rulings allowing other privacy cases to continue. The court later refused the privacy foundation leave for an interim appeal.
Stichting Bescherming Privacybelangen: NewsClaimservice: Stand van zaken Google Claim
-
OrderCourt refuses the foundations’ first requests to resume
Both foundations had asked on May 30, 2025, for the case to restart or for leave to appeal the stay.
-
OrderDistrict Court of Amsterdam stays the Google case
The court suspended the proceedings until the EU Court of Justice answers questions on collective damages actions for privacy violations.
-
JudgmentCourt finds both foundations meet the Dutch admissibility requirements
The court held that it has jurisdiction and that both foundations meet the collective action requirements, leaving open Google’s defense under Article 80 of the General Data Protection Regulation.
District Court of Amsterdam judgment of January 15, 2025 (English translation)
-
HearingDistrict Court of Amsterdam hears Google’s preliminary defenses
The hearing dealt with jurisdiction and whether the two foundations meet the formal requirements to sue.
-
FilingStichting Massaschade & Consument sues Google over Android data
The foundation acted for Dutch users of Android phones since May 25, 2018, and targeted data collection through Google Play Services.
Rechtspraak register: SMC summons extractStichting Massaschade & Consument
-
FilingStichting Bescherming Privacybelangen sues Google in Amsterdam
The foundation sued four Google companies for users of Google services in the Netherlands, after early settlement talks failed.
Stichting Bescherming Privacybelangen: NewsRechtspraak register: SBP summons