Austria Orders Meta to Give Users Full Data Access

The Austrian Supreme Court has ruled that Meta must provide users with complete access to all personal data it holds, including sources, recipients and processing purposes.
The decision concludes an 11‑year legal battle initiated by privacy activist Max Schrems and rejects Meta’s arguments about trade secrets and technical limitations.
The ruling also restricts Meta’s advertising practices and reinforces strict GDPR requirements for handling sensitive data.

Court Demands Full Transparency From Meta

The Austrian Supreme Court has ordered Meta to give users full access to every piece of personal data the company processes, along with detailed information about how each item is used. This includes the source of the data, the recipients and the specific purpose of processing, all of which must be provided within 14 days. Meta had previously offered only partial access through its download tool, which contained what it considered “relevant” information. The court rejected Meta’s claims that trade secrets or other limitations justified withholding data.

The ruling stems from a case brought by Max Schrems (pictured), who has sought full access to his data since 2011. Meta repeatedly declined to provide a complete dataset, referring users to its privacy policy instead of offering comprehensive disclosures. The court found that Meta failed to properly justify any restrictions on access rights under Article 15 of the GDPR. As a result, Schrems will receive unprecedented insight into Meta’s internal data practices.

Lawyers representing Schrems emphasized that the decision is enforceable across the European Union. They noted that Meta resisted full transparency for more than a decade, despite repeated legal challenges. The court’s ruling requires Meta to comply with the GDPR’s one‑month deadline for access requests, which had long since expired in this case. Schrems was awarded €500 in damages for delays and violations of his rights.

Advertising Practices Ruled Unlawful Under GDPR

The court also determined that Meta’s personalized advertising model lacked a valid legal basis under EU law. It held that Meta may only deliver targeted ads if users provide “specific, informed, unambiguous and freely given” consent. This finding aligns with a 2023 ruling from the Court of Justice of the European Union in case C‑252/21, which similarly concluded that Meta cannot rely on contractual necessity or legitimate interest for ad personalization. Schrems’ claims on this issue were largely supported by the earlier CJEU judgment.

Meta must therefore stop providing personalized ads to Schrems unless he explicitly opts in. The ruling reinforces that tracking and profiling for advertising require clear user permission. Lawyers involved in the case stated that the decision once again confirms the need for opt‑in consent for data‑driven advertising. This outcome may influence ongoing legal actions across Europe concerning Meta’s ad practices.

The court further addressed Meta’s handling of sensitive data under Article 9 of the GDPR. Information related to political views, health, sexual orientation or similar categories must be treated with heightened protection. Meta argued that it does not intentionally collect such data and cannot technically separate it from other information. The court rejected this position, stating that compliance is required regardless of technical challenges.

Schrems noted that platforms like Facebook and Instagram can influence users through content that reflects sensitive preferences. He argued that Meta’s denial of processing such data was implausible given the nature of its systems. The ruling clarifies that explicit consent is required before sensitive data can be used in any form of processing. This interpretation strengthens protections for users whose online activity may reveal personal characteristics.

A Long Legal Battle With Broader Implications

The case took 11 years to resolve and involved multiple courts. The Regional Civil Court in Vienna initially refused to hear the case twice, questioning whether Schrems qualified as a consumer under the GDPR. Jurisdictional issues further delayed proceedings, leading to three Austrian Supreme Court decisions and two referrals to the CJEU. Litigation costs exceeded €200,000 despite the relatively small financial claim.

Schrems described the experience as representative of the challenges ordinary users face when enforcing GDPR rights. He argued that large technology companies often rely on procedural obstacles and jurisdictional complexity to delay cases. The ruling highlights the need for more practical enforcement mechanisms to ensure that individuals can exercise their rights effectively. Schrems emphasized that GDPR litigation remains prohibitively difficult for most people.

Some claims in the case were dropped due to procedural constraints. Austrian law makes it difficult to overturn factual findings from lower courts, which prolonged the process. Several alternative claims were also withdrawn because only one could succeed under the structure of the case. These factors contributed to the unusually long duration of the proceedings.

The final ruling provides a clear precedent for future GDPR enforcement. It establishes that companies cannot rely on trade secrets, technical limitations or organizational complexity to restrict user access rights. The decision also reinforces strict consent requirements for advertising and sensitive data processing. Legal experts expect the ruling to influence similar cases across Europe.