Meta is not allowed to use personal data obtained at a public event for users’ targeted advertising, the EU Court of Justice said in a case involving Max Schrems and Facebook.
Meta is not allowed to use personal data on sexual orientation obtained from public sources outside its platform to personalise advertising aimed at its users, the European Court of Justice (ECJ) ruled today (4 October) in a case brought against the tech giant by Austrian privacy activist Max Schrems.
Schrems is gay and filed a complaint at an Austrian court in 2020 after he received ads on Meta’s Facebook directed at homosexuals. He had commented about his sexuality in public but objected to this information being used by Meta for targeted advertising online.
Schrems has succeeded in the past in actions challenging EU-US data transfer agreements.
If someone openly discusses their sexuality in a public forum, that data must be processed by third parties in compliance with the provisions of the EU’s General Data Protection Regulation (GDPR), the ECJ said in its ruling today.
This means that the online platform is “not authorised to process other data related to that person’s sexual orientation obtained outside the platform, with a view to aggregating and analysing those data, in order to offer that person personalised advertising.”
Opinion
In a non-binding opinion published in April, the court’s Advocate General Athanasios Rantos already sided with Schrems.
“The Court should rule that the GDPR precludes the processing of personal data for the purposes of targeted advertising without restriction as to time,” Rantos said at the time.
“A public statement by the user of a social network about his or her sexual orientation renders those data ‘manifestly public’, without, however, permitting their processing for the purposes of personalised advertising.”
Schrems’ lawyer, Katharina Raabe-Stuppnig, was “very pleased by the ruling, even though this result was very much expected”, she said in a statement.
“Meta has basically been building a huge data pool on users for 20 years now, and it is growing every day. However, EU law requires ‘data minimisation’. Following this ruling only a small part of Meta’s data pool will be allowed to be used for advertising – even when users consent to ads. This ruling also applies to any other online advertisement company, that does not have stringent data deletion practices,” she added.