Recent Judgement of the Court of Justice of the European Union: Social Media Platforms Cannot Use All Collected Data for Targeted Advertising Purposes

Some recent decisions of the Court of Justice of the European Union (CJEU) were published in a press release on 4 October 2024. The judgements are again significant in terms of personal data. Among the published judgements, the most striking one is C-446/21, which determines the CJEU's stance against the violating actions of Meta platforms regarding personal data.

The judgment emphasizes that a social media network like Facebook cannot use all the personal data it collects for targeted advertising purposes without time restrictions or distinctions based on data type. To summarize the case, it all started when Maximilian Schrems, an activist, made a statement about his sexual orientation on a public panel. Schrems did not share this data on Facebook; rather, he disclosed it verbally during a panel where he participated as a speaker. Subsequently, he began regularly receiving targeted advertisements for homosexuals and invitations to related events on Facebook, via one of Meta's platforms. This indicates that Facebook, as part of Meta, also collects and processes non-Facebook data about its users.

The central argument in this case is whether Schrems has consented to the processing of this data under the GDPR, given that he explicitly disclosed sensitive personal information by publicly revealing his sexual orientation during a panel discussion. Although he verbally shared this information in a public setting, it was not posted on any social media platform, and no consent was provided for the processing of such data by any social media network.

In its decision, the CJEU examines the relevant GDPR provisions by addressing two key questions: the processing of publicly disclosed personal data without consent, and its use for targeted advertising purposes:

▪️ Should Article 5(1)(c) GDPR be interpreted as meaning that all personal data held by a platform can be used for targeted advertising without time or data type restrictions, as in the main proceedings? 

GDPR art. 5/1-c regulates the data minimization principle. As per the relevant article of GDPR, personal data should be limited to sufficient, relevant and necessary for the processing reasons. The CJEU stated that the principle of data minimization excludes all personal data obtained from the data subject or third parties, whether collected on or off the social media platform, for targeted advertising purposes. It also clarified that this restriction is not subject to time limitations or differentiation by data type regarding the collection, analysis, and processing of the data.

▪️ Should Article 5(1)(b) of the GDPR, taken in conjunction with Article 9(2)(e), be interpreted as meaning that a statement made by an individual about their sexual orientation during a panel discussion is consent to the processing of other data relating to sexual orientation for the purpose of collecting/analyzing data for personalized advertising purposes?

Art. 9 GDPR regulates the processing of special categories of personal data. Article 9(2) (e) of the GDPR, which is the provision that was referred to by the Court, sets forth that the data processed must relate to matters that the data subject has expressly made public. Ultimately, the CJEU answered this question by stating that “...a statement made by the data subject about his or her sexual orientation during a public panel discussion may constitute an act by which the data subject has expressly made such data public within the meaning of Article 9(2)(e) GDPR. However, this alone does not authorize the processing of this data for the purpose of aggregating and analyzing the data for the purpose of personalized advertising.’” Accordingly, it was concluded that public disclosures do not grant the social media platform the right to engage in targeted advertising based on the content of the disclosure. 

Additionally, according to the decision, Meta can only utilize a portion of its data pool, even if users consent to targeted advertising.

This decision is significant as it prohibits the social media platform from spontaneously processing personal data that the data subject has publicly disclosed, as well as any other data that may be linked to this information.

You can reach the relevant press release from here (available in EU languages) and the mentioned CJEU decision from here (available in EU languages).