Meta Platforms, the parent company of Facebook, suffered a major legal blow on Friday when the European Union's top court ruled that the company must limit its use of personal data for targeted advertising. The ruling, handed down by the Court of Justice of the European Union (CJEU), marks a significant victory for privacy activist Max Schrems, whose legal battles against Meta have helped shape EU privacy law under the General Data Protection Regulation (GDPR).
The case, originally brought before an Austrian court by Schrems, centered on Meta's practice of using personal data to personalize advertisements on Facebook. Schrems, a long-time critic of big tech's data practices, argued that Facebook had misused his personal data-specifically, information relating to his sexual orientation-to target ads at him without his explicit consent. The Austrian court referred the matter to the CJEU for guidance on how the GDPR applies in such cases, leading to Friday's decision.
In its ruling, the CJEU emphasized that Meta, or any online platform, cannot use all personal data collected for advertising purposes without appropriate restrictions. The court pointed to the principle of data minimization, a cornerstone of the GDPR, which mandates that companies only use personal data for specific purposes and with limitations. "An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data," the court stated in its judgment.
The court also highlighted that sensitive personal data-such as sexual orientation, race, ethnicity, or health status-cannot be processed for personalized advertising without meeting strict requirements. Meta has consistently denied using such sensitive data for ad targeting, a stance reiterated by the company in response to the ruling. "We await the publication of the Court's judgment and will have more to share in due course," a Meta spokesperson said, adding that the company takes privacy "very seriously" and has invested more than 5 billion euros to embed privacy into its products.
Despite Meta's reassurances, Schrems' legal team hailed the decision as a crucial step in ensuring that large tech companies respect user privacy. "Following this ruling, only a small part of Meta's data pool will be allowed to be used for advertising-even when users consent to ads," said Katharina Raabe-Stuppnig, Schrems' lawyer. The ruling is expected to have significant ramifications not only for Meta but for the broader digital advertising industry, which relies heavily on personal data for targeted ads.
Legal experts also weighed in on the wider implications of the ruling. "Meta has suffered a serious challenge to its preferred business model of collecting, aggregating, and leveraging substantial data troves," said Will Richmond-Coggan, a partner at law firm Freeths. He added that while the ruling is not binding for UK courts, similar challenges could arise in other jurisdictions with comparable privacy laws, particularly in the post-Brexit UK.
The case, known as C-446/21 Schrems, underscores the power of the GDPR in regulating the digital economy and enforcing individual privacy rights against large tech companies. The Austrian Supreme Court, which initially referred the case to the CJEU, is now bound by the EU court's decision. It will issue its final judgment in the coming months, but experts expect it to follow the CJEU's guidance closely.
This is not the first time Schrems has taken Meta to court over GDPR violations. The privacy activist has been a thorn in the side of big tech companies for nearly a decade, successfully challenging Facebook's data-sharing practices with U.S. authorities in previous cases. His ongoing legal battles have forced major tech companies to rethink their approach to handling European users' data.
The CJEU ruling also resonates with broader concerns about how personal data is used in online advertising. Dr. Maria Tzanou, a senior lecturer in law at the University of Sheffield, described the ruling as a reminder that data protection principles are not "toothless." "They do matter when big tech companies process personal data," Tzanou told the BBC. Schrems' victory highlights the growing scrutiny on digital platforms and could lead to increased regulatory action across the EU.
Meta's business model, which depends heavily on personalized ads, faces new uncertainty as the company navigates the post-ruling landscape. In the long term, the decision could lead to a fundamental shift in how Meta-and other digital advertising giants-collect and use data for targeted advertising in Europe. For now, Meta says it will continue to review the court's judgment and adjust its practices as necessary to comply with EU law.
