Activist wins privacy case against Meta over personal data on sexual orientation

The European Union’s top court has said social media company Meta cannot use public information about a user’s sexual orientation obtained outside its platforms for personalised advertising under the bloc’s strict data privacy rules.

The decision from the Court of Justice of the European Union in Luxembourg is a victory for Austrian privacy activist Max Schrems, who has been a thorn in the side of Big Tech companies over their compliance with the 27-nation bloc’s data privacy rules.

The EU court issued its ruling after Austria’s supreme court asked for guidance in Mr Schrems’ case on how to apply the privacy rules, known as the General Data Protection Regulation (GDPR).

Mr Schrems had complained that Facebook had processed personal data including information about his sexual orientation to target him with online advertising, even though he had never disclosed on his account that he was gay.

The only time he had publicly revealed this fact was during a panel discussion.

“An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data,” the court said in a press release summarising its decision.

Even though Mr Schrems revealed he was gay in the panel discussion, that “does not authorise the operator of an online social network platform to process other data relating to his sexual orientation, obtained, as the case may be, outside that platform, with a view to aggregating and analysing those data, in order to offer him personalised advertising”.

Meta said it was awaiting publication of the court’s full judgment and that it “takes privacy very seriously”.

“Everyone using Facebook has access to a wide range of settings and tools that allow people to manage how we use their information,” the company said in a statement.

Mr Schrems’ lawyer Katharina Raabe-Stuppnig welcomed the court’s decision.

“Meta has basically been building a huge data pool on users for 20 years now, and it is growing every day. However, EU law requires ‘data minimisation’,” she said in a statement.

“Following this ruling only a small part of Meta’s data pool will be allowed to be used for advertising – even when users consent to ads.”