The European Union’s highest court has ruled that Facebook-owner Meta must minimize the amount of people’s data it uses for personalized advertising. The Court of Justice for the European Union (CJEU) sided with privacy campaigner Max Schrems, who raised concerns that Facebook misused his personal data, specifically his sexual orientation, to target ads at him.
In a case first brought before Austrian courts in 2020, Mr. Schrems argued that he was targeted with ads aimed at gay people despite never sharing information about his sexuality on the platform. The CJEU’s ruling on Friday stated that data protection laws do not allow companies like Meta to use sensitive data, such as sexual orientation, race, or health status, for personalized advertising without restrictions.
Meta, however, claims that it does not use special category data for ad personalization and emphasized its commitment to privacy. A spokesperson for Meta stated that the company takes privacy seriously and has invested billions of Euros to embed privacy into its products. They also highlighted the tools and settings available to Facebook users to manage how their information is used.
Mr. Schrems’ lawyer, Katharina Raabe-Stuppnig, expressed satisfaction with the ruling, stating that only a small portion of Meta’s data pool will be allowed for advertising, even with user consent. Legal experts also weighed in on the significance of the CJEU’s decision, noting that it could have implications beyond the EU.
The ruling comes after Austria’s Supreme Court referred questions regarding GDPR application to the EU’s top court in 2021. The CJEU clarified that Mr. Schrems’ public reference to his sexual orientation did not authorize the processing of other personal data for advertising purposes. Mr. Schrems’ legal team expects the Austrian Supreme Court to issue a final judgment in the coming weeks or months.
This ruling marks another chapter in Mr. Schrems’ legal battles against Meta over its data processing practices. The decision underscores the importance of data protection principles, particularly when it comes to big tech companies handling personal data.
