Meta Platforms must restrict the use of personal data harvested from Facebook for targeted advertising, Europe's top court ruled on Friday, backing privacy activist Max Schrems.
Schrems took his grievance to an Austrian court, saying he had been targeted by advertisements as a result of Meta's personalised advertising based on processing personal data.
The Austrian tribunal then sought guidance from the Luxembourg-based Court of Justice of the European Union (CJEU), which on Friday backed Schrems.
"An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data," the CJEU said.
The judges said the principle of data minimisation under EU privacy rules known as the General Data Protection Regulation (GDPR) sets this out.
Meta responded by saying it has invested more than 5 billion euros to embed privacy in its products and that it does not use special categories of data that users provide to personalise ads while advertisers are not allowed to share sensitive data.
"Everyone using Facebook has access to a wide range of settings and tools that allow people to manage how we use their information," a Meta spokesperson said.
Schrems' lawyer Katharina Raabe-Stuppnig welcomed the ruling.
"Following this ruling only a small part of Meta's data pool will be allowed to be used for advertising - even when users consent to ads. This ruling also applies to any other online advertisement company, that does not have stringent data deletion practices," she said.
Schrems has taken Meta to court a number of times for alleged GDPR breaches.
The case is C-446/21 Schrems (Communication of data to the general public).
