The Court of Justice for the European Union (CJEU) has ruled that Facebook-owner Meta must reduce the amount of personal data it utilizes for personalized advertising.
This decision came in favor of privacy advocate Max Schrems, who alleged that Facebook misused his personal data regarding his sexual orientation to target ads at him.
Schrems initially raised his concerns in Austrian courts in 2020, claiming he received advertisements aimed at gay individuals despite never disclosing any information about his sexuality on the platform.
On Friday, the CJEU stated that data protection laws do not clearly permit the company to use such data for personalized advertising.
“An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data,” it said.
Data relating to someone’s sexual orientation, race or ethnicity or health status is classed as sensitive and carries strict requirements for processing under EU data protection law.
Meta says it does not use so-called special category data to personalise adverts.
“We await the publication of the Court’s judgment and will have more to share in due course,” said a Meta spokesperson responding to a summary of the judgement on Friday.
They stated that the company takes privacy “very seriously” and has invested over five billion Euros “to integrate privacy into the core of all our products.”
Additionally, they noted that Facebook users have access to various tools and settings to control how their information is utilized.
“We are very pleased by the ruling, even though this result was very much expected,” said Mr Schrems’ lawyer Katharina Raabe-Stuppnig.
“Following this ruling only a small part of Meta’s data pool will be allowed to be used for advertising – even when users consent to ads,” they added.
‘Significant implications’
Dr Maria Tzanou, a senior lecturer in law at the University of Sheffield, told the BBC that Friday’s judgement showed data protection principles are not “toothless”.
“They do matter when big tech companies process personal data,” she added.
Will Richmond-Coggan, a partner at law firm Freeths, said the EU court’s decision will have “significant implications” despite not being binding for UK courts.
“Meta has suffered a serious challenge to its preferred business model of collecting, aggregating and leveraging substantial data troves in respect of as many individuals as possible, in order to produce rich insights and deep targeting of personalised advertising,” he said.
He mentioned that the company might encounter similar challenges in other jurisdictions due to the same concerns, highlighting that Mr. Schrems’ case is based on principles also present in UK law.
In 2021, Austria’s Supreme Court referred questions regarding the application of the GDPR to Mr. Schrems’ complaint to the EU’s highest court.
The court sought clarification on whether Mr. Schrems’ public reference to his sexuality implied consent for companies to process this data for personalized advertising by making it public.
The CJEU stated that while it is for the Austrian court to determine if he had made the information “manifestly public data,” his public acknowledgment of his sexual orientation did not imply consent for the processing of any other personal data.
Mr. Schrems’ legal team informed the BBC that the Austrian Supreme Court is obligated to adhere to the Court of Justice’s ruling.
They anticipate a final judgment from the Supreme Court in the coming weeks or months.
Mr. Schrems has previously taken Meta to court multiple times regarding its handling of EU user data.