Meta faces yet more restrictions on its core ad business in Europe, following a ruling by the EU’s top court.
In its Friday ruling, the Court of Justice of the EU confirmed that the principle of “data minimization"—one of the many rules in the EU’s General Data Protection Regulation—means a social network like Facebook can’t simply use all of a user’s data, forever, for the purpose of targeting ads at them.
“Meta has basically been building a huge data pool on users for 20 years now, and it is growing every day,” said Katharine Raabe-Stuppnig, the lawyer representing the complainant in the case, Max Schrems.
“Following this ruling only a small part of Meta’s data pool will be allowed to be used for advertising—even when users consent to ads. This ruling also applies to any other online advertisement company that does not have stringent data deletion practices.”
Meta said in a statement that it would have more to share once it has read the court’s full judgment. “Meta takes privacy very seriously and has invested over €5 billion [$5.5 billion] to embed privacy at the heart of all of our products,” said a spokesperson.
Thorn in Facebook’s side
Schrems, an Austrian activist lawyer who has been a thorn in Facebook’s side ever since he was a law student 13 years ago, has been the catalyst for a series of Court of Justice rulings against the company.
Two of the rulings sank entire data-sharing agreements between the EU and the U.S.—owing to Meta’s inability to stop U.S. intelligence agencies from poking around its data.
A separate Schrems complaint last year led to a $1.3 billion GDPR fine against the company and left it perilously close to being unable to send Europeans’ personal data off to its U.S. data centers at all; the belated authorization of a third EU-U.S. data-sharing agreement provided a last-minute reprieve.
In a case involving German antitrust law rather than Schrems, the Court of Justice last year blew up Meta’s legal justification for targeted advertising, forcing it to rely on users’ consent. Meta then tried to force that consent by telling users they had to either agree to targeted advertising or pay a monthly fee, but the EU’s privacy regulators rejected that approach after Schrems complained.
Schrems told Fortune he was happy with Friday’s ruling as, until now, Meta and other online advertisers “simply used all data they could get, without limit as to the type or age of such data.”
This latest Schrems case revolved around his sexuality. The lawyer disclosed in a panel discussion, which was broadcast online, that he was gay—but he never mentioned that fact on his Facebook profile. Nonetheless, Facebook showed him ads targeting that attribute.
The GDPR classifies personal data about sexuality as being sensitive, meaning it must be more tightly controlled. However, if the data subject makes their own sexuality public, that can effectively remove the “sensitive” classification, making it easier to use the information for things like ad targeting.
Apart from what it had to say about data minimization, Friday’s ruling threw the issue of whether or not Schrems had made his sexuality public back to the Austria Supreme Court, which had referred the case. But the Court of Justice also said that, either way, Meta doesn’t get to target ads based on sexuality data it got through other means, such as tracking Schrems’s activities on other websites.
Meta’s spokesperson stressed that the company doesn’t use “special categories” of data, such as sexuality, for ad targeting.
“We also prohibit advertisers from sharing sensitive information in our terms, and we filter out any potentially sensitive information that we’re able to detect. Further, we’ve taken steps to remove any advertiser targeting options based on topics perceived by users to be sensitive,” the spokesperson said.
