European Court of Justice Rules Meta Must Limit User Data for Targeted Advertising

The Court of Justice of the European Union (CJEU) delivered a landmark judgment on Thursday, ruling that social media giant Meta cannot indefinitely aggregate and utilize personal data collected from external third-party websites and apps for targeted advertising. The ruling reinforces the core principle of data minimization under the General Data Protection Regulation (GDPR).

The Luxembourg-based court found that an online social network operator cannot hoard all personal data obtained through off-platform tracking technologies without imposing clear time limits and strict category boundaries. The judgment represents a severe blow to the surveillance-based business model that underpins digital advertising monopolies.

Data Minimization Principle Curbs Indefinite Behavioral Profiling

The legal challenge was originally brought in Austrian courts by prominent privacy activist Max Schrems. Schrems contested Meta's extensive profiling practices, demonstrating how the tech giant continuously harvested browsing history, app usage, and sensitive behavioral cues to serve personalized marketing without meaningful consent.

In its binding ruling, the CJEU held that even when a user makes certain personal details public, it does not grant platforms carte blanche to combine those insights with extensive off-platform tracking records. Data controllers must systematically delete or anonymize tracking data once the immediate processing objective is met.

“Under the GDPR, an online social network operator such as Meta cannot use all personal data obtained indefinitely for the purpose of targeted advertising without regard to data minimization.” — Court of Justice of the European Union Judgment

Implications for Big Tech and the Future of Digital Advertising

Privacy advocacy groups across Europe celebrated the ruling as a definitive affirmation of consumer rights. Legal experts noted that European data protection authorities, including the Irish Data Protection Commission, will now be compelled to enforce strict retention schedules on Meta's algorithmic advertising apparatus.

Meta stated that it is reviewing the full judicial text, maintaining that it has heavily invested in privacy-enhancing technologies and consent mechanisms. However, the ruling creates a binding precedent that will restrict ad targeting practices across the entire European tech sector.

Sources

• Court of Justice of the European Union
• European Data Protection Board