Top EU Court Rules Against Meta, Limits Use of Personal Data for Targeted Ads

A smartphone displays Facebook CEO Mark Zuckerberg unveiling the META logo, in Los Angeles on Oct. 28, 2021. Chris Delmas/AFP via Getty Images

In a landmark decision, the top court in the European Union has ruled that Facebook parent company Meta cannot use personal data gathered from its own platforms or from external sources for targeted advertising without adhering to strict limits and restrictions under the bloc’s privacy laws.

The ruling, hailed as a victory by privacy advocates, was issued on Oct. 4 by the Court of Justice of the European Union. The decision was a response to a lawsuit brought by Austrian activist Max Schrems, who has long campaigned for stricter enforcement of the EU’s General Data Protection Regulation.

Schrems had accused Facebook of processing his sensitive personal data to serve him with targeted ads in violation of the GDPR, specifically the data minimization rule, which requires companies to limit the amount of personal data collected and stored to what is strictly necessary.

The court sided with Schrems, stating that Meta’s data practices violated GDPR principles. Meta, according to the court, aggregated and processed vast amounts of user data for advertising purposes without appropriate restrictions on time or the type of data involved.

The judges wrote in their ruling that the relevant provisions of the GDPR “must be interpreted as meaning that the principle of data minimisation provided for therein precludes any personal data obtained by a controller, such as the operator of an online social network platform, from the data subject or third parties and collected either on or outside that platform, from being aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time and without distinction as to type of data.”

The court’s decision highlighted that Meta cannot process user data indefinitely, as it had been doing—even data from users who consent to personalized ads.

Katharina Raabe-Stuppnig, Schrems’s lawyer, expressed satisfaction with the ruling, while emphasizing the wider implications of the decision for the online advertising industry. She noted that other companies operating without stringent data deletion practices will also be affected.

“Meta has basically been building a huge data pool on users for 20 years now, and it is growing every day,” she said in a statement. “However, EU law requires ‘data minimisation.’ Following this ruling, only a small part of Meta’s data pool will be allowed to be used for advertising—even when users consent to ads. This ruling also applies to any other online advertisement company, that does not have stringent data deletion practices.”

In response to the court’s decision, Meta issued a statement saying it was reviewing the judgment while reaffirming its stated commitment to privacy.

“Everyone using Facebook has access to a wide range of settings and tools that allow people to manage how we use their information,” the company said in the statement, adding that it “takes privacy very seriously.”

The ruling is the latest setback for Meta in Europe. The tech giant has faced numerous legal and regulatory challenges there in recent years, and has been at the center of multiple investigations, particularly regarding compliance with the GDPR.

The EU’s focus extends beyond data privacy to concerns about how digital platforms’ algorithms and system designs affect behavior. Meta’s recommender systems, which power its advertising-driven business model, are under scrutiny for potentially fostering addictive behaviors, particularly in minors.