The Court of Justice for the European Union (CJEU) has delivered a significant ruling impacting Meta, the parent company of Facebook, stating that the tech giant must limit the use of individuals’ data for personalized advertising. This decision comes in response to privacy advocate Max Schrems, who accused Facebook of misusing his personal information, particularly regarding his sexual orientation, to target ads.
The case originated in Austrian courts in 2020 when Schrems claimed he was served advertisements aimed at the LGBTQ+ community despite never disclosing his sexual orientation on the platform. The CJEU ruled that data protection laws do not unequivocally allow companies like Facebook to use all personal data for targeted advertising without restrictions.
The court emphasized, “An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data.” Sensitive personal data, such as information related to sexual orientation, race, or health status, is subject to stringent processing requirements under EU data protection law.
In a statement regarding the judgment, a Meta spokesperson affirmed the company’s commitment to privacy, mentioning investments exceeding €5 billion to integrate privacy into its products. They also noted that users have various tools and settings to manage their information usage.
Schrems’ lawyer, Katharina Raabe-Stuppnig, expressed satisfaction with the ruling, stating it was expected. She noted that the decision would restrict Meta’s data pool available for advertising, even with user consent.
Legal experts believe the ruling could have far-reaching implications for Meta and similar tech companies. Dr. Maria Tzanou, a senior lecturer in law at the University of Sheffield, remarked that the ruling underscores the relevance of data protection principles. Will Richmond-Coggan, a partner at Freeths law firm, indicated that the decision poses a serious challenge to Meta’s business model, which relies on extensive data collection for targeted advertising.
The case, referred to the EU’s top court by Austria’s Supreme Court in 2021, also addressed whether Schrems’ public reference to his sexuality constituted consent for the processing of related personal data. The CJEU clarified that this does not imply authorization for further processing of any personal information.
Schrems’ legal team anticipates a final judgment from the Austrian Supreme Court in the coming weeks or months, as he has previously challenged Meta’s data processing practices multiple times.
