For example, before fast internet connections, people would borrow music CDs from libraries and copy them.
In some countries, such acquisition of a copy is legal on its own.
Traffic inspection by ISPs (let alone sharing of collected data with third-party entities) in the EU is required to have a legal/technical basis and/or user consent, depending on what is being done and for what purpose [1]. Even attempts at blanket (meta)data retention for law enforcement agencies have pretty much been ruled illegal in the EU [2] and Germany [3].
What probably happened is your friends were torrenting, and some entity acting on behalf of copyright holders got their IP from public trackers/DHT. Then they came knocking to the ISP with a cour order, asking for information about the person behind that IP address, and the ISP gave them that [4]. Finally, the entity sent a C&D to your friends.
[1] - See the EU DPS' opinion on how the existing EU legal framework affets ISPs' data inspection abilities: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...
[2] - See Directive 2006/24/EC, tl;dr https://en.wikipedia.org/wiki/Data_retention#European_Union
[3] - htps://www.bundesnetzagentur.de/DE/Sachgebiete/Telekommunikation/Unternehmen_Institutionen/Anbieterpflichten/OeffentlicheSicherheit/Umsetzung110TKG/VDS_113aTKG/VDS.html
[4] - https://blog.raychenon.com/file-sharing-violations-in-german...
I mean you can, we can do "anything" but there are repercussions for each action.
It’s literally just using the P2P nature of bittorrent to get peers’ IP addresses (you can do that too! Just start any torrent and look at the peers tab in your client), then using the legal tools to request data about a person breaking the law using such and such IP address.
If you extend this to everything you can have massive surveillance without cookies, MAC address of device, IP address for each package and you know who is accessing what kind of content on internet. So, why wait whenever someone reads article about class 1 drug just brake his door and arrest him, isn't it ?! I mean fork privacy, democracy, and judicial process, just lets immediately arrest everyone :/
Anyway, in German scenario how can you certify that someone was not hijacking your router?
(As per friends case, they had friend who was sleeping over and connected to their Wifi ...)
Some lawyers are even using sites similar to https://iknowwhatyoudownload.com/
It probably costs less to pay the amount than fighting it in court. I think it's capped at 450 Euro or something? But I know some people who got scot free by merely having a lawyer send a response.