EU court decision orders Meta to change data practices

A Tuesday ruling from the European Union’s Court of Justice (CJEU) held up a German government antitrust authority’s 2019 order directing Facebook to change how it tracks customers’ web surfing and use of browser apps, a decision that is widely seen as a blow to parent company Meta’s business model in Europe.

The court decision has far reaching implications and will be an obstacle to Facebook’s ad targeting, European authorities said. It effectively blocks Meta from leveraging data from all of its services, including WhatsApp and Instagram, to more precisely profile users in order to improve its advertising model.

The CJEU’s judgment comes on the heels of an unprecedented German-led antitrust investigation of Facebook for allegedly breaking strict European Union data protection regulations to amass immense market power. The EU’s top court’s ruling Tuesday is widely seen as a benchmark that will determine European antitrust regulators’ power to go after Big Tech for how it uses its vast trove of user data to assert market dominance.

The original 2019 decision brought by German antitrust officials held that Facebook compels users to share data from WhatsApp and Instagram and even third-party websites which users often unknowingly submit data to when they like or share content on the social media platform.

The decision is just the latest bad news for Meta. In May, EU privacy authorities issued a record-setting $1.3 billion privacy fine, saying the social media giant could no longer send user data to the U.S. because it did not protect its contents from American authorities.

Meta did not immediately respond to a request for comment, but it has previously assailed the 2019 German decision for improperly mixing antitrust and privacy laws.

The head of the German antitrust authority which brought the case hailed the decision Tuesday, calling it a model for how antitrust law can be used to enforce European privacy regulations.

“When large internet companies use the very personal data of consumers, this usage can also be deemed abusive under competition law,” Andreas Mundt, head of the German Federal Cartel Office, said in an emailed statement. “The judgment will have far-reaching effects on the business models used in the data economy.”

The Luxembourg-based CJEU released a statement Tuesday calling Meta’s conduct a violation of Europe’s General Data Protection Regulation, which is widely seen as the world’s most important and sweeping privacy protection law.

The CJEU noted that Meta’s data processing operation “appears also to concern special categories of data that may reveal … racial or ethnic origin, political opinions, religious beliefs or sexual orientation, and the processing of which is in principle prohibited by the GDPR.”

The court said national antitrust officials across the continent, such as the German Federal Cartel Office, have the leeway to use the GDPR as a lever to order companies to change their practices. It also held that users do not automatically consent to having their data mined by Meta just because they visit Facebook and its sibling companies.

“The mere fact that a user visits websites or apps that may reveal such information does not in any way mean that the user manifestly makes public his or her data,” the EUJC said in a press release.