After a three-year battle, a regional court in Berlin has found that Facebook’s default privacy settings, terms of service, and requirement that users register under their own name violate Germany’s data privacy and consent rules.

Though based on German law, the January 2018 ruling on a case brought by The Federation of German Consumer Organisations (VZBV) could portend trouble for international technology companies under the EU’s far-reaching General Data Protection Regulation (GDPR) once it takes effect on May 25, 2018.