Meta must limit data for personalized ads

The EU’s top court said Facebook owner Meta must minimize the amount of user data used for personalized ads.

The Court of Justice of the European Union (CJEU) has ruled in favor of privacy campaigner Max Schrems, who complained that Facebook misused personal data about his sexual orientation to target him with ads.

In a complaint first heard by an Austrian court in 2020, Schrems said he was targeted with ads targeting gay people even though he never shared information about his sexual orientation on the platform.

The European Court of Justice said on Friday that data protection law did not explicitly allow the company to use such data for personalized advertising.

“Online social networks like Facebook cannot use all personal data obtained for targeted advertising purposes without time limits and without distinguishing between data types,” it said.

Meta said it does not use so-called special categories of data to personalize ads.

“We are awaiting the release of the court’s decision and will share more in due course,” a Meta spokesperson said Friday in response to a summary of the judgment.

They said the company takes privacy “very seriously” and has invested more than €5 billion “to embed privacy at the core of all our products.”

Facebook users can also access a variety of tools and settings to manage how their information is used, they added.

Schrems’ lawyer Katharina Raabe-Stuppnig said: “We are very pleased with the verdict, although this result was highly anticipated.”

They added: “Under this ruling, even if users agree to be served ads, only a small portion of the Meta data pool can be used for advertising.”

Dr Maria Chanu, a senior lecturer in law at the University of Sheffield, told the BBC that Friday’s judgment showed that data protection principles were not “empty”.

“When big tech companies process personal data, they do matter,” she added.

Will Richmond-Coggan, a partner at law firm Freeths, said that while the CJEU’s ruling was not binding on UK courts, it would still have a “significant impact”.

“Meta’s preferred business model encountered serious challenges: collecting, aggregating and leveraging large amounts of data on as many individuals as possible to generate rich insights and deeply personalized ad targeting,” he said.

He added that the company could face similar challenges in other jurisdictions based on the same concerns, noting that Schrems’ challenge was based on principles that exist in UK law.

Questions about how the GDPR applies to Mr Schrems’ complaint, which the Austrian Supreme Court referred to the EU’s top court in 2021, were answered on Friday.

It asked Mr Schrems whether mentioning his sexual orientation in public meant he gave the company permission to process the data for personalized advertising in a publicly visible way.

The EU court said that while it was up to the Austrian court to decide whether he disclosed the information “as public data”, his public reference to his sexual orientation did not mean that he authorized the processing of any other personal data.

Schrems’ legal team told the BBC that Austria’s top court was bound by the ECJ’s judgment.

They said they expected the Supreme Court to issue a final decision in the coming weeks or months.

Mr Schrems has taken Meta to court several times over the way it handles EU user data.

Additional reporting by Chris Vallance

The EU’s top court said Facebook owner Meta must limit the amount of user data it uses for personalized ads.

The Court of Justice of the European Union (CJEU) ruled in a judgment on Friday in favor of privacy activist Max Schrems, who complained that Facebook had misused his personal data.

Schrems, who has taken Meta to court several times over its handling of EU user data, said Facebook illegally processed data about his sexual orientation to serve him personalized ads.

Meta said it does not use special categories of data, including race, ethnicity or sexual orientation, to personalize ads.