Facebook users in Germany will have to disclose their real names to register for and continue using the social network, after a German court ruled that German privacy law does not apply to Facebook, as the company is not located, and does not process data through a “permanent establishment,” in Germany. The ruling is a victory for Facebook, which requires users to register using their real names. More important, the ruling illustrates the confusion surrounding questions of jurisdiction under the existing EU Data Protection Directive. The draft General Data Protection Regulation would resolve many of these questions both by harmonizing EU member states’ data protection laws and by making clear that EU law applies to companies that are not established in the EU but provide services there. This will be a rude awakening for many American companies.