Austria’s high court orders Meta to change its personalised ad practices
Summary
The Austrian Supreme Court has ruled that Meta’s personalised advertising model was illegal, finding that the company processed user and third‑party data for ad targeting without the “specific, informed, unambiguous and freely given” consent required under the GDPR. The decision requires Meta to give EU users a detailed account of the data it collects and how it is used, including sources, recipients and purposes, within two weeks of a request. The judgment stems from an 11‑year legal fight led by privacy advocate Max Schrems and sets a binding precedent across the European Union.
The court based its ruling on Meta’s practices as of 2020. Meta says it has since added opt‑outs, subscription options and improved data access tools, and is reviewing the ruling. Schrems was awarded €500 for delays in access — an amount noyb notes would likely be higher under current GDPR standards.
Key Points
- The Austrian Supreme Court found Meta’s personalised ad processing violated the GDPR because it lacked explicit, informed consent.
- Meta must provide users in the EU a full, detailed account of their personal data (sources, recipients, purposes) within two weeks of request.
- The ruling resolves an 11‑year legal battle brought by Max Schrems and the NGO noyb and creates EU‑wide precedent.
- Meta argued such processing was “necessary for providing its services,” but the court rejected that defence for the 2020 practices under review.
- Meta says it has introduced opt‑outs, subscription alternatives and better data access tools since the case began, and is assessing the decision.
- Schrems received €500 for delayed access; noyb suggests current claims would likely secure larger damages under GDPR.
Context and relevance
This ruling matters because it clarifies how GDPR consent standards apply to large platforms’ ad‑tech: gathering data from third parties and inferring sensitive preferences cannot be treated as necessary service processing without explicit consent. Regulators, privacy advocates and other tech firms will watch closely — the decision strengthens individual data rights and could force changes to ad targeting models across the EU.
Why should I read this?
Short version: this is a big deal for anyone who uses Facebook or Instagram in the EU (so, most people) and for businesses that rely on targeted ads. The court just tightened the rules on what companies can do with your data — and made it easier for you to see exactly what they hold. Read it if you care about privacy, digital advertising or how GDPR actually gets enforced.