The Supreme Court of Austria ruled on Thursday that Meta’s personalized advertising practices are unlawful under the European Union’s General Data Protection Regulation (GDPR). The court found that Meta failed to obtain explicit consent from users regarding the use of their personal information, violating the GDPR’s requirement for “clear and plain language.” The court emphasized that the company cannot utilize the “legitimate interests” clause to process user data for targeted advertising without prior consent.
In its decision, the court ordered Meta to provide plaintiff Max Schrems with a complete copy of all personal data it processes about him. This includes detailed information on the sources of the data, purposes for which it is used, and specific recipients to whom it has been disclosed. Meta must fulfill this request within 14 days of the ruling.
The court rejected Meta’s argument that its existing “Download Your Information” tools satisfied the GDPR’s right of access. It determined that summaries or filtered disclosures do not meet the regulation’s requirements, thereby reinforcing the necessity for full transparency. Additionally, the court dismissed Meta’s claims of trade secrets, noting that the company failed to provide adequate evidence to support such assertions during the proceedings.
This ruling also addressed Meta’s handling of sensitive personal data, which includes information related to political opinions, health, and sexual orientation. The court ruled that Meta is prohibited from processing this type of data, including that collected through third-party social plugins, without the user’s explicit, informed, and freely given consent. The court further dismissed Meta’s defense that it does not intentionally collect sensitive data, clarifying that the company must separate such data from other categories.
Reacting to the decision, privacy activist Max Schrems, who initiated the case, stated that the ruling underscores Meta’s obligation to adhere to EU law regarding user preferences. He criticized the company’s long-standing claims that it did not process sensitive data, asserting that the ruling clarifies the necessity of obtaining explicit user consent for such practices.
Monika Raabe-Stuppnig, the Austrian lawyer representing Schrems, described the judgment as unprecedented in scope. She remarked, “It took eleven years, but now there is a final ruling that Meta must provide unprecedented access to all data it has ever collected about Mr. Schrems,” adding that “the ruling is directly enforceable throughout the EU.”
In addition to mandating compliance with data access obligations, the Supreme Court awarded €500 in non-material damages to Schrems for Meta’s failure to provide timely and lawful access to his data. Raabe-Stuppnig noted that this amount establishes a realistic benchmark for many other pending cases in Europe.
This decision concludes an 11-year legal battle that began in 2014. The case faced numerous procedural challenges, including early refusals by Austrian regional courts to hear it and disputes over Schrems’ status as a consumer. It reached the Supreme Court of Austria three times and prompted preliminary rulings from the Court of Justice of the European Union before a final resolution was achieved, with litigation costs exceeding €200,000.
Meta is now obligated to comply with the court’s order by December 31, 2025, providing Schrems with full access to his personal data. The ramifications of this ruling are likely to be significant for Meta and its advertising practices across Europe, as it sets a precedent for how user data must be managed under EU law.
