Europe’s top court has ruled that Meta Platforms must restrict the use of personal data harvested from Facebook for serving targeted ads even when users consent to their information being used for advertising purposes, a move that could have serious consequences for ad-driven companies operating in the region.
“An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data,” the Court of Justice of the European Union (CJEU) said in a ruling on Friday.
In other words, social networks, such as Facebook, cannot keep using users’ personal data for ad targeting indefinitely, the court said, adding limits must be set in place in order to comply with the bloc’s General Data Protection Regulation (GDPR) data minimization requirements.
It’s worth noting that Article 5(1)(c) of GDPR necessitates that companies limit the processing to strictly necessary data, preventing the collected personal data about an individual — whether gathered on or outside the platform via third-parties — from being aggregated, analyzed, and processed for targeted advertising without time-bound restrictions.
The case was originally filed by privacy activist and noyb (None Of Your Business) co-founder Maximilian “Max” Schrems in 2014 over claims that the social media giant targeted him with personalized ads based on his sexual orientation.
“The fact that a person has made a statement about his or her sexual orientation on the occasion of a public panel discussion does not authorize the operator of an online social network platform to process other data relating to that person’s sexual orientation, obtained, as the case may be, outside that platform using partner third-party websites and apps, with a view to aggregating and analyzing those data, in order to offer that person personalized advertising,” the CJEU said.
Noyb, in a statement, said it welcomed the ruling and that the result was along expected lines, stating the judgment also extends to any other online advertisement company that does not have stringent data deletion practices.
“Meta and many players in the online advertisement space have simply ignored this rule and did not foresee any deletion periods or limitations based on the type of personal data,” the Austrian non-profit said.
“The application of the ‘data minimisation principle’ radically restricts the use of personal data for advertising. The principle of data minimisation applies regardless of the legal basis used for the processing, so even a user who consents to personalized advertising cannot have their personal data used indefinitely.”
In a statement shared with Reuters, Meta said it has made monetary efforts to “embed privacy” in its products, noting it “does not use special categories of data that users provide to personalize ads while advertisers are not allowed to share sensitive data.”
The development comes as Texas Attorney General Ken Paxton has filed a lawsuit against ByteDance-owned TikTok for alleged violations of child privacy laws in the U.S. state, otherwise called the Securing Children Online Through Parental Empowerment (SCOPE) Act.
The lawsuit accused TikTok of failing to provide adequate tools that allow parents and guardians to control the privacy and account settings of children aged between 13 and 17.
“For example, parents or guardians do not have the ability to control [TikTok’s] sharing, disclosing, and selling of a known minor’s personal identifying information, nor control [TikTok’s] ability to display targeted advertising to a known minor,” the lawsuit reads.
“Texas law requires social media companies to take steps to protect kids online and requires them to provide parents with tools to do the same,” Paxton said. “TikTok and other social media companies cannot ignore their duties under Texas law.”
TikTok, which prohibits targeted advertising for anyone under 18, said it strongly disagreed with the allegations and that it offers “robust safeguards for teens and parents, including family pairing, all of which are publicly available.”