The Court of Justice of the European Union (CJEU) has ruled that Meta, the parent company of Facebook, must limit its use of personal data for targeted advertising purposes.
This decision was made following a case brought by privacy advocate Max Schrems, who alleged that Facebook misused his personal data, particularly regarding his sexual orientation, to serve him personalised ads.
Schrems initially raised his complaint in Austrian courts in 2020, claiming he was targeted with ads for gay individuals despite never disclosing his sexuality on the platform. On Friday, the CJEU clarified that EU data protection laws do not allow companies to freely use personal data for targeted advertising without restrictions.
The court stated, “An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data.” It also noted that sensitive data, such as sexual orientation, race, ethnicity, or health status, is subject to strict requirements under EU law.
In response, Meta claimed it does not use this kind of special category data for ad personalisation. A spokesperson for the company said they take privacy “very seriously” and have invested over five billion euros to integrate privacy protections into their products. They emphasised that Facebook users have tools to manage how their information is used.
Katharina Raabe-Stuppnig, Schrems’ lawyer, expressed satisfaction with the ruling, saying, “Following this ruling, only a small part of Meta’s data pool will be allowed to be used for advertising, even with users’ consent.”
Experts like Dr. Maria Tzanou, a senior law lecturer at the University of Sheffield, believe the ruling underscores the importance of data protection laws. Will Richmond-Coggan, a partner at law firm Freeths, said the decision poses a “significant challenge” to Meta’s data-driven advertising model, and that the company may face similar hurdles in other jurisdictions.
The CJEU also addressed whether Schrems’ public acknowledgment of his sexual orientation implied consent for data processing. While it is up to Austrian courts to determine if this information was made “manifestly public,” the court ruled that such public references do not imply consent for broader data processing.
The Austrian Supreme Court is expected to issue a final judgment in the coming weeks, in line with the CJEU’s decision. Schrems has previously challenged Meta on several occasions over its handling of EU user data.