By BrightNewsBeat 
Court Ruling Against Meta’s Data Retention Practices
The European Union’s highest court has supported a privacy challenge against Meta, ruling that platforms like Facebook cannot indefinitely use users’ personal information for targeted advertising. This decision has significant implications for how Meta and similar ad-supported networks operate within the EU.
Impact on Meta and Advertising Networks in the EU
The ruling emphasizes the need to adhere to the data minimization principles outlined in the General Data Protection Regulation (GDPR), which limits how long personal data can be retained. Violations of these regulations could lead to substantial fines for Meta, potentially amounting to billions, given its history of GDPR violations.
GDPR Compliance and Potential Penalties for Violations
The court’s decision underscores the consequences of failing to comply with GDPR, which can impose fines of up to 4% of a company’s global annual revenue. This represents a significant financial risk for Meta, already known for its numerous GDPR infringements.
Previous Advisory Opinion Supporting Data Retention Limits
This ruling follows an earlier advisory opinion from a court adviser that supported imposing limits on the retention of personal data used for advertising, indicating a trend towards stricter enforcement of privacy regulations.
Meta’s Commitment to Privacy Measures
In response to the ruling, Meta spokesperson Matt Pollard stated that the company is awaiting the full judgment. He emphasized Meta’s commitment to privacy, noting their investment of over five billion Euros in privacy measures and the tools available for users to manage their data.
Revenue Implications for Meta Due to Data Usage Restrictions
Meta generates revenue by tracking users across its platforms and the web. Any limitations on its ability to profile users could adversely affect its advertising revenue, which relies heavily on extensive data collection.
Max Schrems’ Advocacy and Reaction to the Ruling
The ruling is seen as a victory for privacy advocate Max Schrems, who has long challenged Meta’s data practices. His organization, noyb, celebrated the decision, emphasizing the importance of data minimization as required by EU law.
Background of the Legal Challenge Against Meta
The challenge to Meta’s advertising practices began in 2014, but it was not fully addressed in Austria until 2020. The Austrian Supreme Court referred legal questions to the CJEU in 2021, some of which were resolved in a separate case in July 2023, invalidating Meta’s claims of “legitimate interest” for data processing.
CJEU’s Clarification on Data Use for Targeted Advertising
The CJEU ruled that platforms like Facebook cannot use all personal data for targeted advertising indefinitely. The court emphasized the need for differentiation in data types and usage time limits to comply with GDPR.
Implications for Meta’s Advertising Business Model
The ruling is significant for advertising companies like Meta, where extensive data collection typically enhances business performance. The decision potentially limits the volume of data available for targeted advertising.
Meta’s Internal Data Collection Practices
An internal memo from Meta engineers likened the company’s data collection to tipping ink into a vast lake, highlighting the lack of controls over data management. Meta has asserted that this document does not accurately depict its privacy compliance efforts.
Future Adjustments to Data Retention Practices Post-Ruling
While how Meta will modify its data retention practices remains uncertain, it is clear that the company must implement limitations. Advertising companies will likely need to develop protocols to delete unnecessary data or cease using it altogether.
CJEU’s Ruling on Using Publicly Shared Sensitive Data
The CJEU also addressed whether sensitive data that individuals have “manifestly made public” can be used for ad targeting. The court ruled against this, reinforcing the GDPR’s principle of purpose limitation.
Meta’s Position on Handling Sensitive Personal Information
In response to concerns about handling sensitive data, Pollard claimed that Meta does not use such information for ad targeting and has measures in place to prevent advertisers from sharing sensitive information.
Broader Implications of the Ruling for Data Usage in AI Training
The CJEU’s ruling may have wider implications beyond social media, particularly as tech companies seek to repurpose personal data for AI training. Using personal data for purposes like AI training may also violate the GDPR’s principle of purpose limitation.Court Ruling Against Meta’s Data Retention Practices
The European Union’s highest court has supported a privacy challenge against Meta, ruling that platforms like Facebook cannot indefinitely use users’ personal information for targeted advertising. This decision has significant implications for how Meta and similar ad-supported networks operate within the EU.
Impact on Meta and Advertising Networks in the EU
The ruling emphasizes the need to adhere to the data minimization principles outlined in the General Data Protection Regulation (GDPR), which limits how long personal data can be retained. Violations of these regulations could lead to substantial fines for Meta, potentially amounting to billions, given its history of GDPR violations.
GDPR Compliance and Potential Penalties for Violations
The court’s decision underscores the consequences of failing to comply with GDPR, which can impose fines of up to 4% of a company’s global annual revenue. This represents a significant financial risk for Meta, already known for its numerous GDPR infringements.
Previous Advisory Opinion Supporting Data Retention Limits
This ruling follows an earlier advisory opinion from a court adviser that supported imposing limits on the retention of personal data used for advertising, indicating a trend towards stricter enforcement of privacy regulations.
Meta’s Commitment to Privacy Measures
In response to the ruling, Meta spokesperson Matt Pollard stated that the company is awaiting the full judgment. He emphasized Meta’s commitment to privacy, noting their investment of over five billion Euros in privacy measures and the tools available for users to manage their data.
Revenue Implications for Meta Due to Data Usage Restrictions
Meta generates revenue by tracking users across its platforms and the web. Any limitations on its ability to profile users could adversely affect its advertising revenue, which relies heavily on extensive data collection.
Max Schrems’ Advocacy and Reaction to the Ruling
The ruling is seen as a victory for privacy advocate Max Schrems, who has long challenged Meta’s data practices. His organization, noyb, celebrated the decision, emphasizing the importance of data minimization as required by EU law.
Background of the Legal Challenge Against Meta
The challenge to Meta’s advertising practices began in 2014, but it was not fully addressed in Austria until 2020. The Austrian Supreme Court referred legal questions to the CJEU in 2021, some of which were resolved in a separate case in July 2023, invalidating Meta’s claims of “legitimate interest” for data processing.
CJEU’s Clarification on Data Use for Targeted Advertising
The CJEU ruled that platforms like Facebook cannot use all personal data for targeted advertising indefinitely. The court emphasized the need for differentiation in data types and usage time limits to comply with GDPR.
Implications for Meta’s Advertising Business Model
The ruling is significant for advertising companies like Meta, where extensive data collection typically enhances business performance. The decision potentially limits the volume of data available for targeted advertising.
Meta’s Internal Data Collection Practices
An internal memo from Meta engineers likened the company’s data collection to tipping ink into a vast lake, highlighting the lack of controls over data management. Meta has asserted that this document does not accurately depict its privacy compliance efforts.
Future Adjustments to Data Retention Practices Post-Ruling
While how Meta will modify its data retention practices remains uncertain, it is clear that the company must implement limitations. Advertising companies will likely need to develop protocols to delete unnecessary data or cease using it altogether.
CJEU’s Ruling on Using Publicly Shared Sensitive Data
The CJEU also addressed whether sensitive data that individuals have “manifestly made public” can be used for ad targeting. The court ruled against this, reinforcing the GDPR’s principle of purpose limitation.
Meta’s Position on Handling Sensitive Personal Information
In response to concerns about handling sensitive data, Pollard claimed that Meta does not use such information for ad targeting and has measures in place to prevent advertisers from sharing sensitive information.
Broader Implications of the Ruling for Data Usage in AI Training
The CJEU’s ruling may have wider implications beyond social media, particularly as tech companies seek to repurpose personal data for AI training. Using personal data for purposes like AI training may also violate the GDPR’s principle of purpose limitation.
