The European Union’s top court has issued a ruling that could lead to major changes in the way Meta Platforms Inc. operates its ad business.

The Luxembourg-based Court of Justice of the European Union, or CJEU, released a summary of the ruling today. The decision is the culmination of a long-running legal battle focused on Meta’s data collection practices. 

The saga began in 2016 when Germany’s competition regulator, the Federal Cartel Office, started investigating the way Meta collects users’ personal information. The focus of the probe was the manner in which Meta, then Facebook Inc., made use of so-called off-Facebook data. That’s user information the company collects from WhatsApp and Instagram, plus third-party websites and apps.

Users agree to Meta’s data collection practices when they sign up for Facebook. However, the Federal Cartel Office determined that an “obligatory tick on the box” was an insufficient basis for Meta’s aggregation of off-Facebook data. The General Data Protection Regulation, the EU’s privacy regulation, requires companies to receive permission from users before processing their information.

In 2019, three years after opening its investigation, the Federal Cartel Office ordered Meta to change its data collection practices. Meta appealed the decision at the Higher Regional Court of Düsseldorf shortly thereafter. The court then referred the case to the CJEU, which is what led to today’s ruling against the social networking giant.

Meta argued in its appeal that the Federal Cartel Office, a competition regulator, overstepped its authority when it sought to address a data privacy matter. Violations of the EU’s GDPR privacy law are often referred to a different regulator. In its ruling today, the CJEU dismissed Meta’s argument.

“In the context of the examination of an abuse of a dominant position by an undertaking, it may be necessary for the competition authority of the Member State concerned also to examine whether that undertaking’s conduct complies with rules other than those relating to competition law, such as the rules laid down by the GDPR,” the court stated.

In its 2019 decision on Meta’s collection of off-Facebook data, the Federal Cartel Office ordered the company to change the relevant business practices. The regulator stated that Meta must receive users’ permission before aggregating their data from third-party apps and websites. 

In the same decision, the Federal Cartel Office ruled that Meta may continue collecting data from WhatsApp and Instagram as before. However, officials ordered the company to ask for users’ permission before linking that data with personal information collected via Facebook. Linking user data from multiple sources is a common practice in the digital ad industry. 

At the time of the regulator’s 2019 decision, it was reported that Meta could face fines equal to up to 10% of its annual revenues if it fails to comply with the order.

The Federal Cartel Office welcomed today’s CJEU ruling. “Data is a decisive factor in establishing market power,” Federal Cartel Office president Andreas Mundt said in a statement to Reuters. “The use of the very personal data of consumers by the large internet companies can also be abusive under antitrust law.”

Meta stated in response to the ruling that “we are evaluating the Court’s decision and will have more to say in due course.”

Image: Unsplash