E.U. Court Limits Meta's Use of Personal Facebook Data for Targeted Ads

Europe's top court has ruled that Meta Platforms must restrict the use of personal data harvested from Facebook for serving targeted ads even when users consent to their information being used for advertising purposes, a move that could have serious consequences for ad-driven companies operating in the region. In other words, social networks, such as Facebook, cannot keep using users' personal data for ad targeting indefinitely, the court said, adding limits must be set in place in order to comply with the bloc's General Data Protection Regulation (GDPR) data minimization requirements.

The EU Court emphasized that Meta must obtain explicit, informed consent from users before collecting personal data for targeted ads. The court found that Meta’s current consent process does not fully comply with GDPR’s stringent requirements for obtaining user consent. This means that merely accepting the terms of service isn’t sufficient for Meta to collect personal data for behavioral advertising.

"An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data," the Court of Justice of the European Union (CJEU) said in a recent ruling.

"The fact that a person has made a statement about his or her sexual orientation on the occasion of a public panel discussion does not authorize the operator of an online social network platform to process other data relating to that person's sexual orientation, obtained, as the case may be, outside that platform using partner third-party websites and apps, with a view to aggregating and analyzing those data, in order to offer that person personalized advertising," the CJEU said.

Speaking with media, Meta said that it has made monetary efforts to "embed privacy" in its products, noting it "does not use special categories of data that users provide to personalize ads while advertisers are not allowed to share sensitive data."

The development comes as Texas Attorney General Ken Paxton has filed a lawsuit against ByteDance-owned TikTok for alleged violations of child privacy laws in the U.S. state, otherwise called the Securing Children Online Through Parental Empowerment (SCOPE) Act. The lawsuit accused TikTok of failing to provide adequate tools that allow parents and guardians to control the privacy and account settings of children aged between 13 and 17.