A class-action lawsuit filed by a Dutch privacy advocacy group against the US tech company AppLovin has brought to light significant concerns over the unlawful collection and trading of personal data in the Netherlands. The suit claims that AppLovin incorporated hidden tracking software within popular mobile applications like CapCut, Vinted, and Subway Surfers to gather data from millions of users, including approximately 1.5 million children, for advertising purposes. This legal challenge is supported by Amnesty International Netherlands, reflecting the broader unease about personal data protection.
The core of the lawsuit revolves around alleged breaches of the European Union’s General Data Protection Regulation (GDPR), a legal framework that sets stringent requirements for processing personal data. The Privacy Collective contends that the covert tracking software violated the GDPR’s requirement for lawful, fair, and transparent data processing as outlined in Article 5, as well as the need for explicit consent, which is essential under Articles 6 and 7. The case further underscores the importance of Article 8, which mandates additional protections for children’s data in the digital space. Past European court rulings emphasize that any collection or use of personal data must have a clear legal foundation. A more detailed overview of the legal actions is available here.
This legal action emerges amid intensified scrutiny of surveillance practices in the Netherlands. Recent criticisms have targeted Dutch authorities for engaging in extensive citizen monitoring without sufficient legal authorization. Privacy advocates argue that such profiling measures could discourage individuals from exercising democratic rights and diminish trust in digital platforms, a phenomenon described as the “chilling effect.”
The lawsuit not only seeks to address these concerns but also demands financial reparations, potentially amounting to billions of euros. Specifically, The Privacy Collective is pursuing compensation of €1,500 per affected child and €500 per adult involved. Claimant registration began in late May 2026, setting the stage for what might become one of the largest collective privacy-related actions in the Netherlands. More information on the implications of this legal proceeding can be found in this report by TechCrunch.