Meta gets clarity from EU high court of use of personal data for targeted ads

Meta Platforms has received more clarity on how it can use personal data for targeted advertising from the EU's highest court, following a lawsuit filed by privacy campaigner Max Schrems against Meta.

The EU Court of Justice said social-media companies such as Meta aren't free to use all of the personal information they obtain for personalized advertising, even if a person has publicized that information, such as their sexual orientation (see here).

The case at the Court of Justice stems from a complaint against Facebook, since renamed Meta, that Schrems made in the Austrian courts in May 2018 — the month the General Data Protection Regulation took effect (see here).

The campaigner's complaint focused on the social media company's update to its terms of service in reaction to the new privacy law, and what he said was Facebook users suffering "forced consent" to targeted advertising to stay on the service.

He sought an order for Meta to “refrain from processing the applicant’s personal data for personalized advertising and for the aggregation and analysis of data for advertising purposes.”

An Austrian court referred a question on Meta's legal basis for processing data to the EU court along with three other questions that came up during its deliberations. It withdrew the legal basis question after EU judges ruled last July that Meta needed users' consent for targeted ads. But the other questions stood.

Data minimization

One question dealt with the GDPR's "data minimization" principle. In today's ruling, the EU court said Facebook can't use all the personal data it obtains from users for targeted advertising "without restriction as to time and without distinction as to type of data."

"The indiscriminate use of all of the personal data held by a social network platform for advertising purposes, irrespective of the level of sensitivity of the data, does not appear to be a proportionate interference with the rights guaranteed by the GDPR to users of that platform," the court said.

Katharina Raabe-Stuppnig, a lawyer representing Schrems, said in a statement that the ruling means only a small part of Meta's data pool will be allowed to be used for advertising, even when users consent to ads.

The court said it's up to a national court to determine whether Meta is making a distinction about the data it uses and how long it's retained for the purposes of targeted advertising.

Meta said in a statement that it takes privacy "very seriously." It has invested more than 5 billion euros ($5.5 billion) "to embed privacy at the heart of all of our products."

"Everyone using Facebook has access to a wide range of settings and tools that allow people to manage how we use their information," the company said.

Public disclosure

The second question concerns whether the public disclosure of someone's sexual orientation to compile and analyze data based on that revelation can be used for personalized ad targeting.

The question stems from Schrems' criticism during a public panel discussion in 2019 about Meta's data processing for targeted ads. He claimed that the social media company used the fact that he was homosexual to target him with ads, even though he never gave consent for personal data to be used for targeted ads.

Schrems said he received advertisements on the basis that he is gay, according to an analysis he commissioned. He argued that Facebook targeted those ads based on an analysis of his interests.

Under the GDPR's Article 9(1)(e), information that is "manifestly made public" may be processed by a company. The assumption is that the person has agreed to the data being used. Schrems argued that his public comments were made after Meta had processed other information concerned his sexual orientation.

The court gave a nuanced answer. It said that the fact that a user has manifestly made public data concerning his or her sexual orientation means that the data may be processed in compliance with the GDPR.

However, that public disclosure doesn't authorize a social media platform such as Facebook to process other personal data relating to their sexual orientation for the purposes of targeted advertising.

Meta said in a statement that it doesn't use special categories of data from users for personalized ads.

"We also prohibit advertisers from sharing sensitive information in our terms and our systems are designed to filter out any potentially sensitive information that we’re able to detect," the spokesperson said.

"Further, we've removed any advertiser targeting options based on topics perceived by users to be sensitive," Meta said.

That would include sensitive topics such as whether a woman is pregnant, MLex understands.

The case is C-446/21 — Maximilian Schrems v Meta Platforms Ireland Limited, formerly Facebook Ireland Limited

Please e-mail editors@mlex.com to contact the editorial staff regarding this story, or to submit the names of lawyers and advisers.

Dieser Artikel wurde am 4.10.2024 bei MLex veröffentlicht. MLex ist ein Nachrichtendienst von LexisNexis mit globalen News & Analysen zu regulatorischen Pflichten – jetzt kostenfrei testen.