The ruling is one of the most consequential judgments since the 27-nation bloc, home to roughly 450 million people, enacted a landmark data-privacy law aimed at restricting the ability of Facebook and other companies from collecting information about users without their prior consent. The law took effect in 2018.
The case hinges on how Meta receives legal permission from users to collect their data for personalized advertising. The company includes language in its terms of service agreement, the very lengthy statement that users must accept before accessing services like Facebook, Instagram and WhatsApp, that effectively means users must allow their data to be used for personalized ads or stop using Meta’s social media services altogether.
Ireland’s data privacy board, which serves as Meta’s main regulator in the E.U. because the company’s European headquarters are in Dublin, said E.U. authorities determined that placing the legal consent within the terms of service essentially forced users to accept personalized ads, violating the European law known as the General Data Protection Regulation, or G.D.P.R.
The decision does not specify how the company must comply with the ruling, but it could result in Meta allowing users to choose whether they want their data used for such targeted promotions.
If a large number of users choose not to share their data, it would cut off one of the most valuable parts of Meta’s business. Information about a user’s digital history — such as what videos on Instagram prompt a person to stop scrolling, or what types of links a person clicks when browsing their Facebook feeds — is used by marketers to get ads in front of people who are the most likely to buy.
Meta, of course, will appeal this decision. But note how significant the final ruling will be.
Based on recent history, I would anticipate this to flow down to California next.