Facebook-owner Meta must minimise the amount of people’s data it uses for personalised advertising, the EU’s highest court says.
The Court of Justice for the European Union (CJEU) ruled in favour of privacy campaigner Max Schrems, who complained that Facebook misused his personal data about his sexual orientation to target ads at him.
In complaints first heard by Austrian courts in 2020, Schrems said he was targeted with adverts aimed at gay people despite never sharing information about his sexuality on the platform.
The CJEU said on Friday that data protection law does not unequivocally allow the company to use such data for personalised adverting.
Without distinction
“An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data,” it said.
Data relating to someone’s sexual orientation, race or ethnicity or health status is classed as sensitive and carries strict requirements for processing under EU data protection law.
Meta says it does not use so-called special category data to personalise adverts.
“We await the publication of the Court’s judgment and will have more to share in due course,” said a Meta spokesperson responding to a summary of the judgement on Friday.
They said the company takes privacy “very seriously” and it has invested more than five billion Euros “to embed privacy at the heart of all of our products”.
Facebook users can also access a wide range of tools and settings to manage how their information is used, they added. “We are very pleased by the ruling, even though this result was very much expected,” said Schrems’ lawyer Katharina Raabe-Stuppnig.
“Following this ruling only a small part of Meta’s data pool will be allowed to be used for advertising – even when users consent to ads,” they added.
Dr Maria Tzanou, a senior lecturer in law at the University of Sheffield, told the BBC that Friday’s judgement showed data protection principles are not “toothless”. “They do matter when big tech companies process personal data,” she added.
