Austria's Supreme Court Rules Meta's Ad Model Illegal
Austria's Supreme Court ruled that Meta's personalized advertising model violates GDPR by processing sensitive user data without explicit consent. The court ordered Meta to cease processing data on political views and health status, and to disclose data sources and recipients to users within 14 days of request.
What happened
Austria's Supreme Court ruled that Meta's personalized advertising model is unlawful. The court found Meta violated the EU's General Data Protection Regulation (GDPR) by collecting user data from third-party apps and websites and processing sensitive information without 'specific, informed, unambiguous and freely given' consent for personalized advertising.
The ruling orders Meta to cease processing sensitive user data such as political views or health status, and to disclose not only raw data but also detailed information on its sources, recipients and purposes. The court dismissed Meta's claims that ceasing such processing was not technically feasible.
Reported impact
The court ordered Meta to provide EU users full access to their personal data within 14 days of a request. The ruling sets a legal precedent across the EU and is enforceable throughout the bloc by the plaintiff.
Index analysis
The case was brought by Austrian privacy activist Max Schrems in 2014 and took 11 years to resolve, involving three Austrian Supreme Court decisions and two EU Court of Justice rulings.
Governance controls
Non-compliance with the ruling could result in daily fines or even a prison sentence for relevant decision-makers at Meta, depending on the country of enforcement.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.