CJEU ruling puts major restrictions on Meta's data practices

Privacy activist Max Schrems welcomes new laws

The Court of Justice of the European Union (CJEU) has sided with privacy activist Max Schrems against Meta, imposing significant limitations on the company’s data retention policies.

The court decided that platforms like Facebook cannot indefinitely retain users' personal data for targeted advertising, marking a pivotal moment for the ad-funded social network.

The judgement is rooted in the European Union's General Data Protection Regulation (GDPR), which mandates strict adherence to data minimisation principles. According to the court, personal data must not be “aggregated, analysed, and processed for the purposes of targeted advertising without restriction as to time and without distinction as to type of data.” This could have substantial implications for Meta's operations, potentially exposing the company to fines up to 4% of its global annual turnover, amounting to billions in penalties.

The ruling follows a prolonged legal battle initiated by Schrems in 2014, centred on claims that Meta unlawfully exploited his sexual orientation for ad targeting. While the Austrian courts had previously ruled that public statements about one’s identity could justify the use of sensitive data for advertising, the CJEU rejected this notion, reinforcing that consent is still required for processing such data.

Schrems expressed satisfaction with the court's decision, stating: “Now we know that if you're on a public stage, that doesn't necessarily mean that you agree to this personal data being processed.” His privacy rights non-profit, NOYB, hailed the ruling as a critical victory for data protection.

Meta, which generates about 10% of its global ad revenue from the EU, stated that it takes privacy seriously and is awaiting the full judgement before commenting further. The company has previously invested over €5 billion to enhance privacy features across its platforms.

The ruling not only affects Meta but also sets a precedent for other online advertising firms lacking stringent data deletion practices. Katharina Raabe-Stuppnig, a lawyer for Schrems, noted that “only a small part of Meta’s data pool will be allowed to be used for advertising,” stressing the importance of clear ground rules in the advertising landscape.

With the CJEU's decisions on data minimisation and the use of sensitive information for targeted ads, the landscape for online advertising is shifting, indicating that companies will need to rethink their data strategies or risk severe legal repercussions. As Schrems aptly puts it, “The walls are closing in” for Meta and its data practices.