The European Union’s top court today ruled against Meta Platforms Inc. in a case that focused on the way the company processes user data.

The decision could also have implications for other players in the social media market.

The lawsuit in which the Court of Justice of the European Union, or CJEU, issued the ruling was launched by privacy activist Max Schrems a decade ago. He originally filed the complaint in Austria. Following several years of litigation, the case found its way to Austria’s top court, which in turn referred it to the CJEU.

The CJEU’s ruling revolves around a principle in the EU’s GDPR privacy regulation that is known as data minimization. The gist of the principle is that a company may collect only the minimal amount of personal information necessary for a data processing project. Furthermore, tech firms may not retain such information after it’s no longer needed.

The CJEU concluded that GDPR’s data minimization clauses prohibit the processing of personal information “without restriction as to time and without distinction as to type of data.” In practice, that means Meta may no longer indefinitely retain the personal information it collects about users. As a result, certain consumer data that the company could until now leverage to deliver personalized ads may not longer be used to that end.

The more data is available to an advertising algorithm about consumers’ buying preferences, the more closely it can tailor promotions to their interests. By restricting the amount of information available to such algorithms, today’s ruling could potentially decrease their effectiveness. The decision is significant for not only Meta but also other tech firms that leverage personal data to deliver targeted ads in the EU.

The CJEU’s ruling was not unexpected. In April, an adviser to the court published a non-binding legal opinion that argued companies shouldn’t indefinitely retain personal data they use for targeted advertising. The CJEU often accepts such opinions. 

Today’s ruling also addresses another aspect of Meta’s data processing practices. When a consumer publicly shares personal information, that information can theoretically find its way into targeted advertising systems. The CJEU found that such public information may be processed in accordance with GDPR rules, but there are situations where companies may not process other data related to this information.

“We await the publication of the Court’s judgment and will have more to share in due course,” Meta said in a statement. “Meta takes privacy very seriously and has invested over five billion Euros to embed privacy at the heart of all of our products. Everyone using Facebook has access to a wide range of settings and tools that allow people to manage how we use their information.”

The ruling is the second that the CJEU has issued in connection with Max Schrems’ privacy case against Meta. The previous decision, which dates back to July 2023, found that the Facebook parent must ask users’ permission to collect their data for targeted advertising purposes.

Photo: Wikimedia Commons