The return of a Dutch social media pioneer in a modern legal landscape
Please confirm you are human to start the audio.
Good news for Dutch Millennials and Gen X. On 22 September 2026, exactly 22 years after its original launch, Mediahuis relaunched Hyves. Hyves was once the largest social network in the Netherlands with 7.6 million Dutch users at its peak. In 2010, it was even larger than Facebook in the Dutch market. However, less than three years later, Hyves disappeared after being overtaken by Facebook.
Hyves is now returning to an almost unrecognisable legal landscape. The current European regulatory framework for digital services and online social media platforms did not yet exist when Hyves was shut down in 2013. The General Data Protection Regulation ("GDPR") was still in development, while the Digital Services Act ("DSA"), the Digital Markets Act ("DMA") and the AI Act were still a long way off. Also, the Dutch supervisory authority had considerably more limited enforcement powers, and private enforcement through class actions, as we have known it since the Dutch Class Action Mass Claims Settlement Act (Wet afwikkeling massaschade in collectieve actie, or "Wamca"), had not yet emerged.
Thirteen years later, social media platforms operate in a fundamentally different environment. European regulation has developed rapidly, regulators have been granted far-reaching enforcement powers, and regulatory scrutiny may increasingly go hand in hand with class actions. This is particularly relevant in the Netherlands, which has emerged as a key jurisdiction for mass claims. The return of Hyves provides an interesting opportunity to reflect on how the legal landscape for social media platforms has changed since 2013 and what developments lie ahead.
From privacy to broader digital regulation
At its peak, Hyves was still subject to rules that had been written at a time when the internet was in its early stages. Howver, this did not mean that platforms were free to act as they pleased, for example when processing personal data. Many familiar privacy principles such as lawfulness, purpose limitation (personal data may only be used for the purposes for which it was collected), data minimisation and appropriate security measures for personal data already existed.
A key difference from today's situation was that the Dutch regulator at the time, the predecessor of the Dutch Data Protection Authority ("AP"), had significantly limited enforcement and sanctioning powers. The GDPR – which entered into force on 25 May 2018 – changed this. The GDPR harmonised European privacy law and introduced the "one-stop-shop" mechanism, under which a single lead supervisory authority is responsible for cross-border processing activities, replacing the fragmented approach that had previously existed. It also significantly strengthened regulators' enforcement capabilities. Fines may reach EUR 20 million or 4% of a company's worldwide annual turnover, and regulators may, in certain circumstances, restrict or prohibit the processing of personal data altogether, with potentially far-reaching consequences for businesses.
The GDPR marked only the beginning of a broader regulatory shift. While early concerns primarily focused on the processing of personal data, social media platforms evolved into complex digital ecosystems with a growing presence in our day-to-day lives. This led to policymakers and regulators turning their attention to broader issues such as online safety, the transparency of recommender systems, the impact of algorithms on user behaviour, the market power of large technology companies and the use of artificial intelligence. The GDPR and other rules in place provided only limited answers to these concerns.
New obligations for digital service providers
Against this backdrop, the EU has in recent years adopted a broader digital regulatory framework, most notably through the DSA and the AI Act. The DSA, which has applied in full since February 2024, seeks to create a safer and more transparent online environment. Amongst other things, it requires social media platforms to explain content moderation decisions, increase transparency around online advertising, provide users with greater insight into recommender systems, and refrain from manipulative design practices known as dark patterns. Non-compliance may result in fines of up to 6% of worldwide annual turnover or temporary suspension of the service.
The AI Act, which entered into force on 1 August 2024 and is being phased in gradually, is likely to become increasingly relevant as platforms make greater use of AI for recommender systems, content moderation, advertising and personalisation. This regulation introduces transparency obligations and additional requirements for certain high-risk applications, backed by significant penalties of up to 7% of worldwide annual turnover.
The regulation of social media platforms has expanded considerably in the past thirteen years. Whereas the initial focus was largely on the lawful processing of personal data, platforms must now comply with a much broader regulatory framework in which transparency, online safety, algorithmic accountability and the prevention of manipulative design practices play a central role.
Increase in public and private enforcement
The increase in regulation has gone hand in hand with significantly stronger public enforcement. Regulators actively use their enforcement powers and regularly impose substantial fines on technology companies for violations of EU digital regulations. For example, earlier this year, the Dutch Data Protection Authority imposed a EUR 825 million fine on Uber for automated deactivation of driver accounts in breach of the GDPR. The Irish regulator imposed a EUR 530 million fine on TikTok, while the European Commission fined X EUR 120 million for violations of the DSA.
These are obviously substantial amounts. From a litigation perspective, however, an equally important development, and one that may expose defendants to even greater risk, is the rise of private enforcement through class actions. Following the enactment of Wamca, representative organisations in the Netherlands may not only seek declaratory relief, but may also pursue claims for damages on behalf of large groups of affected individuals in an opt-out procedure, without requiring an explicit mandate from each claimant.
This has not only increased incentives to litigate, but it has also stimulated the funding of such class actions. As discussed in the CMS European Class Action Report, the Netherlands has rapidly become a preferred forum for class action litigation, a significant proportion of which concerns alleged privacy and data protection violations involving major technology companies. Representative organisations have initiated class actions in the Netherlands against, among others, Meta, X, Amazon, Oracle, Salesforce, TikTok and, most recently, Snap. In these cases, claimants typically seek several hundred euros in damages per affected individual, which can quickly translate into total exposure running into the billions of euros.
Broadened legal bases in Wamca class actions
Notably, the legal basis for class actions against technology companies continues to broaden. Whereas earlier Wamca proceedings against technology companies primarily focused on alleged GDPR violations, claimants are increasingly relying on the broader EU digital regulatory framework, including the DSA and the AI Act. This is illustrated by the recent proceedings against Snap, which extend beyond the processing of personal data and target the design and operation of the platform more broadly.
The proceedings centre on four main allegations:
- addictive design features, such as Snapstreaks, Snapscore, infinite scrolling and personalised recommendations;
- insufficient protection of minors and inadequate measures to combat illegal activities;
- unlawful processing of personal data and profiling; and
- insufficiently identifiable advertising, particularly advertising directed at minors.
As in other class actions against technology companies, the claimant foundations seek material and non-material damages (up to EUR 1,850 per user; Snap has approx. 6 million users in the Netherlands), as well as injunctive relief affecting the operation of the platform. This includes orders requiring Snap to discontinue certain design features such as infinite scroll and Snapstreaks, introduce effective age-verification mechanisms, take measures to prevent previously banned users from re-registering, and cease certain forms of profiling and targeted advertising.
For the time being, a significant number of class actions against technology companies in the Netherlands have been (partially) stayed pending the answers to preliminary questions referred by the Rotterdam District Court to the Court of Justice of the European Union ("CJEU") in proceedings against Amazon. These questions concern, among other things, whether the GDPR permits representative organisations to seek damages without an explicit mandate from the affected individuals and whether the Netherlands may, through the Wamca, impose additional admissibility requirements beyond those already provided for by the GDPR.
If the CJEU answers these questions in favour of claimants, we expect a number of pending Wamca actions against technology companies to proceed to the merits. An important question will then be how representative organisations substantiate their claims for non-material damages and how Dutch courts assess such claims. While the case law of the CJEU has confirmed in recent years that even limited privacy infringements may give rise to compensation for non-material damage, provided that the damage is sufficiently substantiated, many questions regarding the practical application of that principle (in a class action context) remain unanswered. We expect the courts to provide further guidance on these issues in the coming years.
Concluding remarks
In the meantime, the European digital regulatory framework continues to evolve. The European Commission is currently working on a Digital Fairness Act, an initiative aimed at issues such as manipulative and addictive design practices, misleading influencer marketing and unfair forms of personalised targeting. In addition, EU policymakers are discussing further protective measures for minors in digital environments, including initiatives such as the proposed EU KIDS Act (see our CMS colleagues' update for more information on the topic).
The return of Hyves is noteworthy against this backdrop. Hyves is explicitly presented as an alternative to the major international social media platforms. According to Hyves, the emphasis is on community building, personal interaction and a non-addictive user experience. For example, Hyves uses a chronological timeline rather than an algorithm-driven feed, does not incorporate the now familiar endless scrolling functionality, and relies primarily on a European technological infrastructure. User data is also said to be stored and processed within the EU.
On paper, this positioning aligns well with a number of societal and political concerns that have been raised in recent years regarding large technology platforms. Whether that approach will be sufficient to make Hyves relevant again in today's market remains to be seen. One thing is certain: the return of Hyves has, at the very least, rekindled a sense of nostalgia.
More information or advice
Would you like to know more or exchange ideas regarding developments in the digital regulatory landscape and Wamca litigation, and the potential implications for your business? Please contact us, we look forward to discuss this with you.
