Facebook Faces Fresh Threat to Sending Personalized Ads in EU

Meta Platforms’ Facebook must get user consent before sending some personalized ads, the European Union’s top court ruled, a surprise element in a broader court decision in which it sided with German competition regulators in limiting how the company can use data.

The personalized-ad element of the decision issued Tuesday by the EU’s Court of Justice throws a potential wrench in Meta’s longstanding legal battle to protect its core business model, which is based on its ability to send users targeted adverts. The ruling was read out in Luxembourg, but hasn’t been published yet. 

Depending on that ruling’s wording and implementation, Facebook could be compelled to ask its users to opt in to ads that are based on how they interact with it and other Meta apps. Such interactions could include a user’s comment on an Instagram post, or their views of a particular Instagram video.

That would cut into Meta’s core business model, which revolves around selling targeted ads to its users. Meta brought in $28 billion in advertising revenue for the three months ended March 31, about 22% of which came from Europe.

Tuesday’s ruling would only apply in the EU.

Meta is currently appealing a January privacy decision in Ireland that fined the company roughly $425 million and ruled that the company couldn’t use its contracts to justify personalizing its ads based on users’ activity on Meta’s platforms. Tuesday’s Court of Justice decision isn’t appealable, and it could influence the Irish court’s handling of Meta’s appeal. 

Following January’s Irish privacy decision, Meta switched its legal justification for such ads under the EU’s privacy law to a provision that cites the “legitimate interest” of its business, and created an online form that EU-based users could fill out to request an opt-out from personalized ads. That move riled privacy activists, who had campaigned for the company to prompt all of its European users proactively to decide whether they agree to the use of their activity data for ads. 

A press release sent by the court on Tuesday, however, says the Luxembourg court decided Meta can’t use the “legitimate interest” argument for its ads business to justify using data, unless it has user consent. Under EU law, consent must be freely given, which means access to a service can’t be conditional on clicking “yes.”

A spokesperson said Meta was “evaluating the court’s decision and will have more to say in due course.”

The ruling on advertising consent came as part of a wide-ranging decision from the EU court, which said that competition regulators such as Germany’s Federal Cartel Office can consider whether companies comply with rules other than competition laws—such as the bloc’s data-protection laws—as part of investigations into questions of competition violations.

That is something that could open the door to new types of antitrust investigations against big tech companies, which are already facing a big expansion of tech regulations related to competition, content moderation and—soon—artificial intelligence.

The broader decision Tuesday means Meta will have to comply with a 2019 order from the German cartel office and stop combining user data from various platforms unless users gave their consent. That included Facebook and Meta-owned products WhatsApp and Instagram.

The original German privacy case was seen as a novel combination of privacy rules into a competition case—something that Meta had argued went too far. The German regulator said Facebook had abused its dominance as a social network by requiring users to agree to terms of service that included combining data between its services.

But the concrete impact of that part of the decision may be limited, in part, because a new EU digital competition law is likely to impose similar rules on Meta beginning next year. The EU’s Digital Markets Act requires explicit user consent for providers of digital core platforms to process personal user data, combine it with data from other platforms and cross-use data from one service to another. If a user doesn’t provide consent, the DMA states they must still be able to use the service.

While its appeal has continued, Meta has been working with the German competition authority and taken steps to comply. The authority announced in June that Meta planned to update its user accounts center to better allow users to decide whether to combine their Meta accounts across platforms—after the regulator deemed a previous version “seriously deficient.”

Separately on Tuesday, the EU announced that several companies including Meta, Google owner Alphabet, Apple and

Write to Sam Schechner at [email protected] and Nuha Dolby at [email protected]