Meta Ordered by EU Court to Minimize Data Use for Personalized Ads

Meta, the parent company of Facebook, has been ordered by the Court of Justice for the European Union (CJEU) to significantly limit the data it uses for personalized advertising. This ruling came in response to a complaint filed by privacy advocate Max Schrems, who argued that Facebook misused sensitive personal data, including information related to his sexual orientation, to target ads.

Schrems’ complaint, which originated in Austrian courts in 2020, highlighted that he was shown advertisements aimed at gay users on Facebook, despite never voluntarily sharing such information with the platform. Schrems alleged that Facebook collected and utilized data about his personal life for targeted ads without his explicit consent.

On Friday, the CJEU sided with Schrems, stating that EU data protection laws do not give Meta the unqualified right to use all personal data for targeted advertising. The court ruled, “An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data.”

This landmark decision reaffirms the strict regulations governing the use of sensitive data under EU law. Data related to users’ sexual orientation, race, ethnicity, and health are classified as special category data, and their processing is subject to heightened legal requirements.

In response to the ruling, a Meta spokesperson reiterated that the company does not utilize “special category data” for ad personalization and emphasized that the platform takes user privacy seriously. Meta has invested over €5 billion to prioritize privacy in its products, the spokesperson added, and offers users a range of tools to control how their information is used.

Max Schrems' legal team welcomed the decision. His lawyer, Katharina Raabe-Stuppnig, stated, “We are very pleased by the ruling, even though this result was very much expected. Following this ruling, only a small part of Meta's data pool will be allowed to be used for advertising—even when users consent to ads.”

Major Implications for Meta

The court's decision could have far-reaching consequences for Meta's business model. Dr. Maria Tzanou, a senior law lecturer at the University of Sheffield, said the ruling reinforces that data protection laws in the EU are robust and enforceable, especially against large tech companies. "They do matter when big tech companies process personal data," she commented.

Will Richmond-Coggan, a partner at the law firm Freeths, further emphasized the implications of this judgment. He noted that Meta’s long-standing practice of collecting vast amounts of data to create detailed user profiles for targeted advertising is now under serious scrutiny.

While the CJEU’s decision may not be binding in UK courts post-Brexit, Richmond-Coggan highlighted that similar legal challenges could arise in other jurisdictions, as Schrems’ case was based on principles that exist in UK law as well.

Next Steps and Impact

The case initially came before Austria’s Supreme Court, which referred several questions regarding the applicability of the General Data Protection Regulation (GDPR) to Schrems’ complaint to the CJEU in 2021. One critical question was whether Schrems' occasional public reference to his sexual orientation on Facebook granted implicit consent for Facebook to process this data for personalized advertising.

The CJEU clarified that while it is up to the Austrian court to determine if Schrems made his data "manifestly public," his references to his sexuality in public settings did not authorize Facebook to process other personal information. Schrems’ legal team expects the Austrian Supreme Court’s final judgment in the coming weeks or months.

Schrems has previously taken Meta to court multiple times regarding its data processing practices, and this recent ruling represents a significant victory for privacy advocates. As Meta faces increasing pressure in the EU to limit the data it collects and processes, similar cases may emerge across other legal jurisdictions, further challenging the tech giant’s approach to personalized advertising.

Conclusion:

The CJEU’s ruling represents a significant shift in the landscape of data protection and online advertising in the EU. By limiting Meta's ability to use personal data for targeted ads, the decision reinforces the importance of privacy rights in an increasingly data-driven world. This ruling not only underscores the robustness of GDPR but also challenges Meta’s longstanding business model, which relies heavily on aggregating and analyzing user data for personalized advertising.

As this case progresses through Austrian courts, it could set a precedent for how tech companies handle personal data, both within the EU and globally. With similar legal challenges likely to arise in other jurisdictions, Meta and other tech giants may face increased scrutiny, prompting them to reassess their data collection and advertising strategies in the future.