AG: no GDPR damages for engineered mass Google Fonts claims

Advocate General Maciej Szpunar proposedEuropa on 5 November 2026 that engineered mass GDPR claims should fail: in his Opinion in Case C-654/25 [Undelam]Europa, on a reference from the Bundesgerichtshof, he concludes that a dynamic IP address sent to Google in the United States by a site using Google Fonts by default is personal data for Google directly, where Google can identify the visitor, and for the site operator indirectly, where the latter knows, or should have known, that this is the caseEuropa; and that no moral prejudice can be recognised where the data subject knowingly provoked a breach of the Regulation, in an automated and repeated manner, in order to obtain compensation for it.

The dispute is a business model: the visitor built crawler software that scans large numbers of sites for the dynamic Google Fonts configuration, then auto-visits them so his own dynamic IP is transmitted to Google in the United States. His lawyer then sent a formal demand seeking an undertaking, cessation of the breach and payment of 170 eurosEuropa, a routine repeated against thousands of operators, over 100,000 times according to the referring court. The operator paid, then sued for a refund. The first court ordered 70 euros refunded; the appeal court ordered the full 170 euros refunded jointly against the visitor and his lawyer for intentional immoral harm, without ruling on the question of the GDPR breach, holding that no moral harm exists where the transmission was knowingly provoked for money. The Bundesgerichtshof made the refund turn on whether the visitor held an Article 82 compensation claim at all.

On the first question, the Advocate General endorses the relative approach from the Court's case law since Breyer: whether a dynamic IP is personal data under Article 4(1) turns on the entity holding it, assessed concretelyEuropa. What matters is the recipient's perspective, since only the IP address, not any identity, is transmitted; an analogy is permitted with the transmission to a third party of pseudonymised data. The threshold is relatively low: not proven, certain identification, but a risk that is not insignificant. Google's vast collected data, from identifiers and browsing activity to IP and location, combined with the transmitted IP for service personalisation, can support such a risk, for the referring court to verify. But the operator should face controller duties only where it knew or should have known the recipient could identify the visitorEuropa; otherwise it would answer for a breach on purely external facts it may not even be aware of.

On the second question, Article 82(1) makes compensation conditional on three cumulative conditions, an infringement of the Regulation, damage suffered and a causal link between them, with damage never presumed. The Court counts a mere "loss of control" over their data, and founded fear of future misuse in the specific circumstances, as compensable moral damage. Neither fits here: the visitor lost no control, his data being used exactly as he planned, and repeated large-scale provocation with purpose-built software shows no founded fear of misuse, at most a readiness to run the riskEuropa.

Alternatively, should the Court find moral damage, the Advocate General would bar the claim as abusiveEuropa: the GDPR's objective was not achieved despite formal compliance, and the visitor primarily sought moneyEuropa, artificially creating the conditions through mass automated visits and thousands of 170-euro demands. The financial motive need only be the principal one, not the sole one, as with the copyright-troll practice in M.I.C.M.; any awareness-raising side effect for site operators does not cure the abuse.

Legal basis: Article 4(1) and Article 82(1) of Regulation (EU) 2016/679.