Court Rules Meta’s EU Ad Model Illegal * Science and Technology Times

Austria’s Supreme Court has ruled that Meta’s personalised advertising model violates EU data protection law.
The decision requires the company to overhaul its data practices and provide users with full access to their information.
The ruling sets a precedent across the EU and may influence future enforcement actions.

Court Finds GDPR Violations

Austria’s top court concluded that Meta’s personalised advertising system breaches the General Data Protection Regulation. The ruling states that Meta must give EU users complete access to their personal data within 14 days of a request, including details on sources, recipients and processing purposes. Judges found that Meta collected information from third‑party apps and websites without obtaining “specific, informed, unambiguous and freely given” consent. Sensitive data such as political views and health information was also processed without lawful justification.

The case originated in 2014 when privacy activist Max Schrems filed a complaint challenging Meta’s data practices. It has since involved multiple decisions from Austria’s Supreme Court and two rulings from the EU Court of Justice. Schrems’ organisation, noyb, said the judgment is enforceable across the EU and could lead to daily fines or even prison sentences for non‑compliance, depending on national enforcement rules. Meta acknowledged the decision and said it is reviewing the ruling.

Implications for Meta’s Data Use

The court ordered Meta to stop processing sensitive user data, rejecting the company’s argument that such changes were technically unfeasible. Previous rulings had already established that explicit consent is required for using personal data in targeted advertising. Schrems noted that platforms like Facebook and Instagram can influence users through personalised content, making strict consent requirements essential. The decision reinforces the principle that sensitive preferences cannot be used without clear approval from each individual.

Meta argued that the case concerns practices from more than a decade ago and highlighted its investments of over €8 billion in privacy improvements. The company said it no longer uses sensitive data for ad personalisation and disputes the court’s findings regarding third‑party data collection. Austria’s Supreme Court clarified that its assessment was based on the situation as it existed in 2020. The ruling nevertheless applies to Meta’s current operations and requires compliance across the EU.

New Options for EU Users

EU users now have several choices when using Facebook and Instagram. They may continue using the platforms for free with personalised or less personalised advertising, or they can subscribe to avoid data usage for ads entirely. EU antitrust regulators approved Meta’s pay‑or‑consent model in December, allowing the company to rely on less personal data for advertising purposes. The court awarded Schrems €500 in damages, a figure set in 2014 before the GDPR came into force.

Noyb noted that compensation amounts today could be significantly higher due to stronger legal protections under the GDPR. The organisation is urging regulators to ensure that Meta fully complies with the ruling and stops processing unlawfully obtained data. The case may influence future enforcement actions against other platforms using similar advertising models. It also highlights the growing scrutiny of data‑driven business practices across the EU.