Meta’s advertising empire faces growing hurdles in Europe

BRUSSELS — Instagram, Facebook and other Meta services are running out of options to keep their advertising beast fed with Europeans’ data — at least legally.

The Court of Justice of the European Union on Tuesday ruled that Meta was wrong to gather troves of data about people’s online activity to target them with personalized ads based on the firm’s "legitimate interest" and without their explicit consent.

The EU’s top court also backed Germany’s competition authority in weighing potential privacy breaches under the General Data Protection Regulation (GDPR) by Facebook owner Meta Platforms in its antitrust case.

The ruling’s two main conclusions are a major blow to the parent company of Facebook and Instagram, Meta, which is increasingly seeing Europe’s privacy noose tighten around its lucrative business model. The Silicon Valley company in 2022 made over $133 billion (€121.9 billion) in advertising revenue — tracking millions of people on its social media platforms, and more broadly online, to show them ads.

Meta was fined in January — totaling €390 million — by its lead privacy regulator in Ireland for unlawfully gathering swaths of Facebook and Instagram users’ data to target them with ads based on their terms of service.

The tech giant was also ordered to find a new legal basis to serve personalized ads. The company appealed the decision and stressed at the time that it did not anticipate having to rely on user consent. Facebook and Instagram in April started using the legitimate interest basis for some data gathering on their platforms, meaning European users’ data will be used for targeted ads unless they refuse through an online form.

But Meta’s appeal and new legal route for its targeting plans are now looking at best tenuous and at worst doomed to fail, according to some lawyers.

“It’s going be the role of the Irish [Data Protection Commission] to enforce the decision that was issued by the Court of Justice of the EU,” said Olivier Proust, a partner in the technology and data team in Fieldfisher’s Brussels office. “Meta is going to have to either stop doing targeted advertising for its European users or if it continues to do so, it is going to have to obtain their prior consent.”

The Irish privacy watchdog — which oversees Meta because its EU headquarters is in the country — said it was "currently assessing" Meta’s legal basis for targeted ads alongside other EU privacy agencies and will take into account the EU’s top court decision, said Graham Doyle, a spokesperson for the watchdog.

Beyond Meta, the ruling is set to have a much broader effect on other major online platforms’ advertising operations.

“All big players that do have targeted advertising activities based on collecting massive volume of personal data from their users — Google or Tiktok and the likes — are likely to have to go for consent,” said Dessislava Savova, a partner focusing on tech at law firm Clifford Chance.

Several new European tech laws will also set new restrictions as soon as next month on how large tech companies track people online to serve them personalized ads. Under the Digital Services Act, 19 large online platforms and search engines — ranging from Instagram and Facebook to Google — will be banned from using people’s sensitive information, like health data and sexual orientation, to target them starting at the end of August. Targeting teenagers and children will also be off-limits.

Big Tech companies designated as gatekeepers under the Digital Markets Act will also be prohibited from tracking users outside of their services for targeted ads without their consent as soon as February 2024.

Meta declined to comment about the impact of the CJEU decision on its legal basis for targeted advertising.