Tech companies must curb targeted advertising

Global tech companies have been told they cannot use all user data they gather free from deadlines and restrictions, following a ruling by the European Union Court of Justice.

It came at the conclusion of a challenge to Facebook's parent company Meta, the latest of several cases brought by Austrian privacy activist Max Schrems.

Until now, Meta has been collecting data on Facebook users when they visit other sites or use third-party apps, allowing the company to deploy targeted personalized advertising.

But according to the EU's General Data Protection Regulation, or GDPR, tech companies must stick to a policy of data minimization, which means limits on how much data can be used, and for how long.

"An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data," said a statement from the court.

Schrems brought about the case after being the subject of targeted advertising by Meta relating to his sexual orientation, which was not something he had made public on his account, but had mentioned at a public event.

The court ruled that such a statement made in the public arena "does not authorize the operator of an online social network platform to process other data relating to his sexual orientation."

This backed up a non-binding opinion published in April by the court's Advocate General Athanasios Rantos, siding with Schrems.

"The Court should rule that the GDPR precludes the processing of personal data for the purposes of targeted advertising without restriction as to time," Rantos said.

Katharina Raabe-Stuppnig, a lawyer representing Schrems, said the win had been expected.

"Meta has basically been building a huge data pool on users for 20 years now, and it is growing every day," she said. "Following this ruling only a small part of Meta's data pool will be allowed to be used for advertising, even when users consent to ads."

Schrems, who has brought action against Meta several times before, and is reportedly involved in other ongoing cases including one relating to the user data being used to train artificial intelligence technology, said he was pleased with the outcome.

"Now we know that if you're on a public stage, that doesn't necessarily mean that you agree to this personal data being processed," he said.

Meta representative Matt Pollard told the Wired website that the company had spent more than 5 billion euros ($5.49 billion) to embed privacy in its products, and "everyone using Facebook has access to a wide range of settings and tools that allow people to manage how we use their information".