The European Union’s top court has ruled that social media platforms like Meta’s Facebook must limit the use of personal data, including information on sexual orientation, for targeted advertising. This landmark decision stems from a case brought by privacy activist Max Schrems, who contested the “unlawful” processing of personal data by Meta. The ruling highlights the importance of the EU’s General Data Protection Regulation (GDPR) in protecting user privacy and curtailing the unchecked collection and use of personal information by tech giants.
Target Ads — Limiting Data
The European Court of Justice (ECJ) has ruled that personal data such as information on sexual orientation could only be used for targeted advertising in cases where it is subject to strict limits. The move follows a case brought by privacy campaigner Max Schrems against Meta, the parent company of Facebook.
Schrems had challenged the “illegal” processing of his data on the grounds that he mentioned in public about his sexual orientation as not equal to consent for its purpose in personalized advertising. There, the ECJ concurred with the EDPB about the “principle of data minimization” underpinned by the EU’s GDPR. The rule “prohibits the combining, evaluation and processing for advertising with the help of a social network operator data from there,” the court said.
Restrictions on Data Usage
The ECJ ruling places restrictions on how personal data can be used by social media platforms to serve adverts. The court said the employment of such data should be “limited as to duration” and “distinguished as to category” of information. Which in turn basically means that platforms such as Meta cannot keep and use user data indefinitely to target ads, and need to distinguish between different types of personal information.
And the court noted too that simply because a user shares a certain information in public — such as their sexual orientation — doesn’t mean it entitles a platform to “process other personal data”, i. e. additional information useful for tracking that individual by linking IDFA data with sensitive profiling.) The judgment has been designed to safeguard the users’ fundamental right to privacy and freedom of speech by preventing their personal data from being used as a tool for commercial exploitation.
Implications for Big Tech
It represents a major threat to the data-fuelled business models of tech giants — such as Meta. The tech behemoth has for years been dependent on mining user data from its sprawling inventory of communication tools to maintain the vast ad platform which sustains nearly all of its revenue.
This has made it legal for the court to restrict Meta from using personal information, all the more so are intimate details such as sexual orientation for advertising purposes. The ruling could have wide-reaching consequences for the technology industry by marking a new standard for minimal data protection and challenging the unfettered ability of social-media platforms to make money off their subscribers’ information.
The ruling has been welcomed by privacy campaigners including Max Schrems and his group NOYB (None Of Your Business) who say Meta will be significantly restricted in how it collects data. Latest Naked Security podcastThe judgment stands as a warning not only to Google but every other tech giant, that even they must stick by the data minimisation and user consent tenets of the GDPR.
