Europe’s top court has ruled that Meta Platforms, the parent company of Facebook, must limit its use of personal data for targeted advertising.
The decision stems from a legal case initiated by Austrian privacy activist Max Schrems, who claimed that Facebook misused his personal data to serve personalized ads.
The case was brought to Austria’s courts after Schrems alleged that Meta had targeted him with ads based on his personal data without proper consent. This prompted Austria’s tribunal to seek guidance from the Court of Justice of the European Union (CJEU), which ruled in Schrems’ favor. The CJEU emphasized that Meta cannot use all the personal data it gathers for advertising purposes without restrictions on time or the type of data, in line with the General Data Protection Regulation (GDPR), a major privacy law in the EU.
Meta responded to the ruling by stating that the company takes privacy seriously and has invested over €5 billion to incorporate privacy protections into its products. Meta also noted that it does not use sensitive data categories, such as information related to users’ sexual orientation or health, to target ads.
Schrems’ legal team welcomed the court’s decision, with his lawyer Katharina Raabe-Stuppnig highlighting that Meta’s data pool for advertising would now be significantly reduced, even when users consent to personalized ads. She noted that this ruling would apply to other advertising companies that do not adhere to strict data deletion practices.
The court’s ruling underscores the importance of data minimization under GDPR, requiring companies to limit the collection and use of personal data to what is strictly necessary for their business purposes. Experts believe that this ruling could have significant implications for Meta’s business model and could inspire similar challenges in other jurisdictions.
