The statement was the latest in a German online gaming case that could pave the way for similar action across the EU.

Richard de la Tour, advocate general at the Luxembourg-based Court of Justice of the European Union (CJEU), said in an opinion that member states may allow consumer protection associations to bring representative actions against infringements of the protection of personal data.

Such actions must be based on infringements of rights derived directly from GDPR, he added, referring to the landmark EU privacy rules adopted three years ago.

GDPR stipulates that any requests to collect personal data should be subject to clear and informed consent.

De la Tour said consumer bodies that defend the collective interests of consumers are particularly suited to GDPR's objective of establishing a high level of personal data protection.

Facebook found itself in the dock after the Federation of German Consumer Organisations filed a lawsuit alleging that the social network had allowed operators of online games to improperly collect the personal data of gamers.

The games were offered on Facebook's App Center in 2012. By playing the games, users automatically agreed to share personal data including email addresses. At the end of the game, they would receive a message saying that the app could post their status, photos, and other information.

A German lower court had ruled in favour of the German federation, leading Facebook to appeal to a higher court, which subsequently sought advice from the CJEU.