Meta is no longer allowed to collect data from users based on legitimate interests. The American technology company may only use personal data to the extent that this information is strictly necessary to provide services. For all other processing, the company must explicitly ask for permission from users.The European Court of Justice has ruled this in a judgment (pdf).
Meta is fined 390 million euros
For the start of this case, we have to go back to January 2023. The Irish regulator, Data Protection Commission (DPC), then imposed a fine of 390 million euros on Meta. The privacy watchdog ruled that the tech company had unlawfully collected data from Facebook and Instagram users for years to offer targeted advertisements. To be allowed to do this, the company should have asked permission from its users.Meta’s lawyers argued this was unnecessary because it had an implementation agreement with its members. In a nutshell, anyone with a Facebook or Instagram account consented to the parent company collecting user data. This processing was necessary to be able to offer the social networks.As mentioned, the Irish regulator did not agree with this and concluded that Meta’s ‘contractual necessity’ was in conflict with the General Data Protection Regulation (GDPR). In addition to the million-dollar fine, the parent company of Facebook and Instagram was instructed to adjust the basis for processing user data.
Court: offering targeted advertisements is not a legitimate interest
Meta then decided to take ‘legitimate interest’ as a new basis. Based on this basis, the tech company may collect data from users without explicit permission because processing this data is necessary for business operations. According to this reasoning, offering targeted advertisements is part of the service.Critics strongly opposed this, seeing it as an attempt to circumvent the GDPR’s consent requirement. The European Court of Justice agrees, according to the judgment that was made public today. In it, the Court writes that a party may only collect user data without consent if this is “necessary to implement the agreement with the data subject”. The targeted provision of advertisements does not meet this condition.The Court also ruled that personalization of advertising is not a legitimate interest in being allowed to process user data without explicit consent. Finally, the Court states that Meta has such a strong position of power as controller that it is questionable whether consent to the general terms and conditions was given voluntarily.
Noyb: ‘A huge blow to Meta.’
The Austrian privacy foundation Noyb is pleased with the European Court of Justice ruling. “This is a huge blow to Meta and other online advertising companies. It makes it clear that several of the industry’s legal theories to circumvent the GDPR are null and void,” said chairman Max Schrems in response to the ruling.According to Schrems, the judgment of the Court makes it clear that Meta cannot simply circumvent the consent requirement of the GDPR with a few paragraphs in its legal documents. “This means Meta has to ask permission and can’t use its position of power to force people to agree to things they don’t want. This will also positively impact pending lawsuits,” said the Noyb chairman.