Limitation of Meta’s ability to process data for targeted advertising purposes

Limitation of Meta’s ability to process data for targeted advertising purposes

On October 4, 2024, the Court of Justice of the European Union (CJEU) handed down a ruling reiterating the obligation for Meta, when collecting personal data on and off the Facebook social network, to comply with the principle of data minimisation and the prohibition of processing sensitive personal data in the absence of the data subject’s consent.

Meta collects data on the activities of its users both on its own services, such as Facebook, Instagram and WhatsApp, and through third-party websites and applications connected to Facebook, on which “social plug-ins” are “embedded” to record the personal data of their visitors, such as the URL of the page visited, the time of visit and the visitor’s IP address. This data is processed by Meta for the purpose of targeted advertising on Facebook.

In the present case, Maximilien Schrems, known for his role in the CJEU’s invalidation of the Safe Harbor in 2015 and the Privacy shield in 2020, received advertisements on Facebook related to his sexual and political orientation after he visited political party pages aimed at a homosexual audience that contained Meta’s plug-ins. However, he had never indicated his sexual orientation on his Facebook profile.

Subsequently, Maximilien Schrems filed a complaint against Meta, accusing it of having processed sensitive data without his consent. Meta, on the other hand, argued that it was entitled to process such data, as Maximilien Schrems had spoken publicly about his homosexuality in videos and podcasts accessible online, which constituted proof of his consent to the processing of such personal data.

The Court held that Meta’s collection of its users’ personal data, both on and off the Facebook social network, without limitation as to the data retention period, the categories of data processed, and the purposes of the processing, violates the data minimisation principle, according to which only personal data that is adequate, relevant and limited to the purposes of the processing, may be processed. In addition, the Court ruled that a user’s public declaration at a panel discussion of their sexual orientation did not constitute explicit consent allowing Meta to process other data relating to their sexual orientation obtained from partner websites and apps for the purpose of sending personalized advertising to that user. This decision is a reminder that data minimisation, one of the five founding principles governing the implementation of data processing, must not be neglected, even when the processing is used for advertising purposes. Advertisers and other players in the online advertising sector will need to take into account this reminder, at a time when they are seeking to obtain as much data as possible on Internet users, in order to target them as accurately as possible.