Meta may no longer collect data from users based on legitimate interest. The American technology company may only use personal data to the extent that the information is strictly necessary to provide services. For all other processing, the company must seek explicit consent from users.
This is what the European Court of Justice ruled in a judgment (pdf).
For the beginning of this case, we have to go back to January 2023. The Irish regulator, Data Protection Commission (DPC), then imposed a €390 million fine on Meta. The privacy watchdog ruled that the tech company had unlawfully collected data from Facebook and Instagram users for years in order to offer targeted ads. To do so, the company should have sought permission from its users.
Meta's lawyers argued that this was unnecessary because it had an executive agreement with its members. In a nutshell, it said that anyone with a Facebook or Instagram account, consented to the parent company collecting user data. This processing was necessary to provide the social networks.
As mentioned, the Irish regulator did not go along with this, concluding that Meta's "contractual necessity" violated the General Data Protection Regulation (AVG). In addition to the multi-million dollar fine, the parent company of Facebook and Instagram was ordered to adjust its basis for processing user data.
Thereupon, Meta decided to adopt "legitimate interest" as its new basis. Based on this basis, the tech company is allowed to collect data from users without explicit consent because the processing of this data is necessary for business operations. According to this reasoning, offering targeted ads is part of the service.
Critics vehemently opposed this, seeing it as an attempt to circumvent the AVG's consent requirement. The European Court of Justice agrees, according to the ruling made public today. In it, the Court writes that a party may only collect user data without consent if it is "necessary to give effect to the contract with the data subject." Targeting advertisements does not meet this condition.
Furthermore, the Court holds that personalization of advertising is not a legitimate interest to be allowed to process users' data without explicit consent. Finally, the Court states that Meta has such a strong dominant position as a data controller that it is questionable whether consent to the terms and conditions was given voluntarily.
The Austrian privacy foundation Noyb welcomes the European Court of Justice's ruling. "This is a huge blow for Meta, but also for other online advertising companies. It makes clear that various legal theories of the industry to circumvent the GDPR are null and void," said president Max Schrems in a reaction to the ruling.
According to Schrems, the court's ruling makes it clear that Meta cannot simply get around the AVG's consent requirement with "a few paragraphs in its legal documents. "This means that Meta must seek consent and cannot use its position of power to force people to agree to things they do not want. This will also have a positive impact on ongoing litigation," said the Noyb chairman.
