Austria's Supreme Court has ruled that Meta's personalized advertising practices are illegal under European Union data protection law, setting a binding legal precedent across the bloc, reports The Record, a news site by cybersecurity firm Recorded Future.
The court determined that Meta violated the General Data Protection Regulation (GDPR) by processing user data, including sensitive information obtained from third parties, without obtaining "specific, informed, unambiguous and freely given" consent for targeted advertising.
The ruling, stemming from an 11-year legal battle initiated by privacy advocate Max Schrems and his organization noyb, mandates that Meta must provide users with detailed access to their personal data within two weeks of a request, including specifics on data sources, recipients, and purposes. Schrems stated that the decision clarifies that platforms like Facebook and Instagram "must not use such user preferences without explicit consent by each user."
While Meta argued it was entitled to use data for ad personalization as "necessary for providing its services," the court rejected this claim.
The court determined that Meta violated the General Data Protection Regulation (GDPR) by processing user data, including sensitive information obtained from third parties, without obtaining "specific, informed, unambiguous and freely given" consent for targeted advertising.
The ruling, stemming from an 11-year legal battle initiated by privacy advocate Max Schrems and his organization noyb, mandates that Meta must provide users with detailed access to their personal data within two weeks of a request, including specifics on data sources, recipients, and purposes. Schrems stated that the decision clarifies that platforms like Facebook and Instagram "must not use such user preferences without explicit consent by each user."
While Meta argued it was entitled to use data for ad personalization as "necessary for providing its services," the court rejected this claim.
