CJEU limits Meta's data use for ads

The Court of Justice of the European Union (CJEU) has issued a significant ruling that requires Meta Platforms Ireland, the operator of Facebook, to limit its use of personal data for targeted advertising. The judgment, delivered on October 4, 2024, addresses two key issues: the principle of data minimization and the processing of sensitive personal data.

In a landmark decision, the CJEU has interpreted Article 5(1)(c) of the General Data Protection Regulation (GDPR) to preclude Meta from using all personal data obtained from users or third parties, whether collected on or outside its platform, for targeted advertising purposes without time restrictions or data type distinctions.

According to the Court, the principle of data minimization applies regardless of the legal basis used for processing. This means that even when users consent to personalized advertising, their personal data cannot be used indefinitely. The ruling effectively challenges Meta's long-standing practice of aggregating vast amounts of user data for advertising purposes.

Katharina Raabe-Stuppnig, the lawyer representing Max Schrems in this case, stated, "Meta has basically been building a huge data pool on users for 20 years now, and it is growing every day. However, EU law requires 'data minimization'. Following this ruling only a small part of Meta's data pool will be allowed to be used for advertising - even when users consent to ads."

Limitations on processing sensitive data

The Court also addressed the issue of processing sensitive personal data, specifically in relation to information about sexual orientation. The CJEU ruled that Article 9(2)(e) of the GDPR, which allows processing of personal data manifestly made public by the data subject, must be interpreted narrowly.

The Court clarified that even if a person makes a public statement about their sexual orientation, this does not authorize the processing of other data related to that person's sexual orientation obtained from other sources. This interpretation prevents Meta from using such sensitive information for targeted advertising without explicit consent.

Background of the case

The ruling stems from a long-running legal battle initiated by privacy activist Max Schrems against Meta Ireland Platforms Limited. The case, originally filed in 2014, has gone through multiple stages in the Austrian court system before reaching the CJEU.

The Austrian Supreme Court referred four questions to the CJEU in 2021, two of which were addressed in this ruling:

1. The interpretation of the data minimization principle in Article 5(1)(c) of the GDPR.
2. The interpretation of Article 9(2)(e) of the GDPR regarding the processing of publicly disclosed sensitive data.

Implications for online advertising industry

This ruling has far-reaching implications for Meta and potentially the entire online advertising industry. Companies that rely on extensive data collection and long-term retention for targeted advertising may need to significantly alter their practices to comply with this interpretation of the GDPR.

Raabe-Stuppnig noted, "This ruling also applies to any other online advertisement company that does not have stringent data deletion practices."

Next steps

While the CJEU has provided clear guidance on the principles involved, it has left the specific implementation details to national courts. The Austrian courts will now need to apply this ruling to the specific circumstances of Schrems' case against Meta.

Meta Platforms Ireland will likely need to review and revise its data processing practices to ensure compliance with this interpretation of the GDPR. This may involve implementing more stringent data deletion policies and limiting the types of data used for advertising purposes.

Key Facts

• Ruling date: October 4, 2024
• Case number: C-446/21 (Schrems v. Meta)
• Key GDPR Articles interpreted: Article 5(1)(c) and Article 9(2)(e)
• Plaintiff: Max Schrems
• Defendant: Meta Platforms Ireland Limited

Summary of Key Points

• Meta must minimize the use of personal data for targeted advertising
• Data minimization applies even when users consent to personalized ads
• Public disclosure of sensitive information does not authorize processing of related data from other sources
• The ruling potentially impacts the entire online advertising industry
• National courts will determine specific implementation details