The CJEU rules that social networks, such as Facebook, cannot keep using people's data for ad targeting indefinitely, siding with privacy campaigner Max Schrems
The European Union's top court has sided with a privacy challenge to Meta's data retention policies.
Context & Ripple Effects
This decision extends a run of EU legal pressure on Meta's data-driven advertising model. The CJEU had already upheld Germany's competition authority in its order requiring changes to Meta's ad business, while Ireland's regulator had imposed a €390M GDPR penalty over ad and data practices.
It also builds on prior CJEU backing for consumer-protection agencies bringing GDPR cases, widening the routes through which data-use practices can be challenged.
First-order effects
- Social networks, including Meta's Facebook, cannot treat advertising data as usable without end; retention and targeting practices must account for a time limit.
- Privacy campaigners and enforcement bodies gain a stronger court-backed basis to contest prolonged use of personal data for advertising.
Second-order effects
- Meta and other ad-supported platforms face added pressure to redesign data governance and targeting workflows, rather than relying on accumulated user histories.
- The ruling strengthens the leverage of regulators and consumer-protection groups in disputes over ad-data handling, compounding existing GDPR enforcement risk.
Third-order effects
- If applied consistently, the decision pushes European digital advertising toward time-bounded data use, making durable access to personal data a less reliable competitive advantage.
- It reinforces a regulatory model in which privacy, consumer protection, and competition authorities can each constrain the same platform data practices.
The trend: European courts and regulators are steadily narrowing the scope and duration of personal-data use that can underpin platform advertising.