Stichting Onderzoek Marktinformatie (SOMI) alleges that X failed to protect Dutch users’ data in leaks in 2021 and 2022 and used unlawful microtargeting. It also alleges breaches of the EU Digital Services Act (DSA) over hate speech. SOMI acts for about 8 million Dutch users and seeks injunctions and damages. In October 2026, the District Court of Amsterdam appointed it exclusive representative.
Latest development Oct 2026
In October 2026, the District Court of Amsterdam held that Stichting Onderzoek Marktinformatie meets all admissibility requirements and appointed it exclusive representative for Dutch X users. The court is next to set a period for users to opt out and a period for settlement talks with X.
Why it matters
The case pairs privacy claims with claims under the EU Digital Services Act. It will test whether X can be held liable in one Dutch action to about 8 million users for data leaks, microtargeting based on sensitive data, and hate speech.
Background
Stichting Onderzoek Marktinformatie (SOMI) has been on the EU list of qualified entities for cross-border representative actions since June 17, 2024. After a liability letter of July 3, 2024, it sued X Corp., X Internet Unlimited Company, and Twitter Netherlands in the District Court of Amsterdam on August 15, 2024. It acts for about 8 million Dutch users of X, including minors. It alleges that X failed to secure users’ data against leaks in 2021 and 2022 and let advertisers target users on the basis of sensitive data. It also alleges that X fails to curb hate speech as the Digital Services Act (DSA) requires. SOMI relies on the General Data Protection Regulation (GDPR), the DSA, unfair commercial practices law, and unjust enrichment. It seeks declarations, orders, and damages, including a symbolic €1 per user for hate speech.
X asked the court to stay the case until the Court of Justice of the European Union rules in Case C-523/25 on GDPR collective actions. It also sought a stay until EU proceedings over the DSA end. In December 2025, the European Commission fined X Internet Unlimited Company and related companies €120M under the DSA, a decision that is under appeal. After a hearing on April 2, 2026, the court refused both stays on May 27, 2026. It noted that SOMI also relies on grounds other than the GDPR and that only admissibility was at issue. It found that SOMI met most admissibility requirements but ordered it to explain its funding and its control over the claims.
In October 2026, the court held that SOMI meets all admissibility requirements of the Dutch Act on Collective Damages Claims (WAMCA) and appointed it exclusive representative. Its claims cover users whose data appeared in the leaked datasets and users on X since August 25, 2023. The court is to set a period for users to opt out and a period for settlement talks with X.
Timeline 4 events
-
JudgmentCourt declares the foundation admissible and appoints it exclusive representative
The court held that the foundation meets all admissibility requirements and defined the groups of Dutch X users covered by the claims.
-
JudgmentCourt refuses X’s stay requests and seeks more on funding
The court found that the foundation met most admissibility requirements but ordered it to explain its financial resources and its control over the claims.
District Court of Amsterdam, ECLI:NL:RBAMS:2026:6440IT & Recht
-
HearingDistrict Court of Amsterdam hears argument on admissibility
The hearing addressed whether the foundation could bring the action and how it is funded.
-
FilingStichting Onderzoek Marktinformatie sues X in Amsterdam
The foundation sued X Corp., X Internet Unlimited Company, and Twitter Netherlands for Dutch users over data leaks, microtargeting, and hate speech.
District Court of Amsterdam, ECLI:NL:RBAMS:2026:6440Rechtspraak register: summons extract