Social media giant Facebook did break the law in the way it processed the personal information of people residing in the Netherlands, judges in Amsterdam said on Wednesday.

The court ruled that Facebook Ireland had used the information for advertising purposes without legal grounds and had passed it on to other companies, even though there were no legal grounds to do so.

The case, brought by mass claims foundation Stichting Data Bescherming Nederland together with consumers association Consumentenbond, covers the period from April 2010 to January 1, 2020.

The court also ruled that Facebook had not properly informed users that their information would be shared, nor that data belonging to the Facebook friends of Facebook users would also be passed on.

A third claim, about the use of cookies on third party websites, was not upheld. The court said that it is not Facebook but the person in charge of the website who is responsible for asking visitors if they will accept cookies.

Wednesday’s ruling is the first stage in what is likely to be a long legal battle for compensation.

‘This ruling could allow consumers to claim compensation for Facebook’s privacy infringements,’ DPS chairman Dick Bouma told news website Nu.nl. ‘It is now up to Facebook to make an offer.’

The Consumentenbond described the verdict as ‘extremely important’. ‘Facebook should not have used data from all those millions of users in the Netherlands for advertising purposes,’ said director Sandra Molenaar. ‘That is a groundbreaking statement and a very strong signal, not only towards Facebook, but also towards other tech companies that flout privacy legislation.’

However, a spokesman for Facebook parent company Meta said that it planned to appeal.