Meta, the owner of Facebook, is required to limit the amount of personal data it uses for personalized advertising, as determined by the European Union’s highest court. The ruling from the Court of Justice for the European Union (CJEU) favored privacy advocate Max Schrems, who alleged that Facebook improperly used his personal data regarding his sexual orientation to target him with specific advertisements.
The complaints, initially presented to Austrian courts in 2020, highlighted that Mr. Schrems was targeted with ads aimed at gay individuals without ever disclosing his sexuality on the platform. In its ruling, the CJEU emphasized that data protection law does not permit companies to use personal data for targeted advertising without strict limitations. “An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data,” the court stated.
Data concerning sensitive aspects like sexual orientation, race, ethnicity, or health status is subject to stringent processing requirements under EU data protection regulations. Meta has claimed it does not utilize so-called special category data for personalizing advertisements. A spokesperson stated, “We await the publication of the Court’s judgment and will have more to share in due course,” noting that the company takes privacy seriously and has invested over five billion Euros to prioritize privacy in its products. They also mentioned that Facebook users have access to various tools and settings to manage how their information is utilized.
Mr. Schrems’ lawyer, **Katharina Raabe-Stuppnig**, expressed satisfaction with the ruling, stating, “We are very pleased by the ruling, even though this result was very much expected. Following this ruling, only a small part of Meta’s data pool will be allowed to be used for advertising—even when users consent to ads.”
Dr. Maria Tzanou, a senior lecturer in law at the University of Sheffield, remarked to the BBC that the recent judgment underscores the importance of data protection principles, asserting that they are not “toothless.” She stated, “They do matter when big tech companies process personal data.”
Will Richmond-Coggan, a partner at the law firm Freeths, noted that the EU court’s ruling will have “significant implications,” even though it is not binding for UK courts. He explained, “Meta has suffered a serious challenge to its preferred business model of collecting, aggregating, and leveraging substantial data troves in respect of as many individuals as possible, in order to produce rich insights and deep targeting of personalised advertising.” He also mentioned that the company could encounter similar challenges in other jurisdictions, as Mr. Schrems’ case is rooted in principles that are applicable under UK law.
The Supreme Court of Austria had previously referred questions regarding the General Data Protection Regulation (GDPR) related to Mr. Schrems’ complaint to the EU’s top court in 2021. The court sought clarification on whether Mr. Schrems’ public reference to his sexuality implied consent for firms to process this data for personalized advertising. The CJEU concluded that while the Austrian court would need to determine if this information was “manifestly public data,” Mr. Schrems’ public acknowledgment of his sexual orientation did not automatically grant permission for the processing of any other personal data.
Mr. Schrems’ legal team indicated to the BBC that the Austrian Supreme Court is obligated to adhere to the CJEU’s ruling and anticipates a final judgment from the Supreme Court in the upcoming weeks or months. Mr. Schrems has previously taken Meta to court multiple times regarding its handling of EU user data.
