The European Court of Justice (ECJ) has ruled that Meta cannot process all personal data it obtains about users, including data from third-party apps, for advertising targeting purposes without temporal or data-type restrictions.
The case was initiated in 2014 by digital rights activist Max Schrems, who argued that Meta unlawfully targeted ads at him based on information he had publicly disclosed about his sexual orientation. The case was referred to the European Court of Justice in 2021 by the Austrian Supreme Court. The ECJ found that Meta violated its data minimization obligation by processing all available data. It also ruled that the fact Schrems publicly shared his sexual orientation in a roundtable discussion does not authorize Meta to use that sensitive personal data, especially if obtained from other sources, such as data collected through Facebook cookies and plugins embedded on third-party websites.
The data minimization principle limits the collection of personal data to only what is relevant and necessary for processing. The use of sensitive personal data for ad targeting is prohibited under the Digital Services Act. According to EU legal procedures, the case will now return to the Austrian court for a final decision.
