Austria's Supreme Court asks CJEU if Facebook “undermines” GDPR by treating a contract as consent to deliver targeted ads, following a request from Max Schrems
Max Schrems has spent a decade routing his fight with Facebook through the courts: after an Austrian court threw out his class action as inadmissible in 2015, he pivoted to individual complaints — and this referral shows the strategy working. Austria's Supreme Court won't decide itself; it asks the CJEU whether a platform can lawfully claim 'contract performance' as its basis for targeted advertising instead of obtaining genuine GDPR consent.
The stakes are familiar territory for Luxembourg: the CJEU has already constrained Facebook once on data-for-ads grounds, ruling that networks cannot keep using people's data for ad targeting indefinitely. A finding that 'contract' cannot substitute for 'consent' would close the most common workaround platforms use to avoid asking permission at all.
First-order effects
Facebook's default legal basis for behavioral advertising across the EU comes under direct review, with the Austrian proceedings frozen until the CJEU answers — meaning its current consent-free targeting model stays in place but without judicial cover.
Schrems' noyb complaint graduates from a national procedural fight to a bloc-wide question, converting one user's objection into a preliminary ruling every EU regulator will have to apply.
Second-order effects
Every social network relying on a 'contract' justification for personalized ads — not just Facebook — inherits the same exposure, since the CJEU answer would set one standard for all of them.
If the court sides with Schrems, platforms face rebuilding their EU consent flows toward explicit opt-in, pushing ad revenue toward users who agree and forcing pricing or service changes for those who refuse.
Third-order effects
The pattern points to GDPR interpretation consolidating at the CJEU through individual-complaint referrals rather than mass litigation — a structural shift away from the failed class-action route of 2015 toward test cases that bind the whole market.
Consent architecture becomes the compliance battleground: whoever defines what counts as valid consent effectively writes the operating manual for European digital advertising.
The trend: European privacy enforcement is shifting from national lawsuits to individual complaint-driven CJEU referrals that set single, binding standards for how big platforms may monetize personal data.
#PrivacyBREAKING: Austrian Supreme Court asks #CJEU if @Facebook illegally “undermined” the #GDPR by bypassing consent via an alleged “contract”!😍 If so, they would not only have to stop processing data, but also pay damages to millions!😉 ⏩More: https://noyb.eu/...
I'm also noting here how Facebook was fined for (unsurprisingly) not fulfilling a complete Subject Access Request which suggests you actually cannot download *all* of your personal data from Settings as the company insists. As I always suspected. #DataRights https://twitter.com/.…
📢 BREAKING: Austrian Supreme Court asks CJEU if Facebook “undermines” the GDPR by confusing ‘consent’ with an alleged ‘contract’. If so, they would not only have to stop processing data, but also pay damages to millions! More here: https://noyb.eu/... https://twitter.com/...
A major escalation in post-Privacy Shield US-EU data tensions: the GDPR legality of all Facebook data processing of EU citizens has been referred by the Austrian Supreme Court (and Max Schrems) to the European Court of Justice. https://noyb.eu/...
The relationship between Art. 6 I a (consent) and Art. 6 I b (contract) and especially their connections via Art. 7 IV (conditionality) is one of the most relevant questions of the #GDPR. This will be a key decision (and another one not brought before the #CJEU by the DPAs). http…
Can't wait to read the CJEU judgment. I argued in a paper that “in most circumstances, the only available legal basis for the processing of personal data for behavioural targeting is the data subject's unambiguous consent.” (2015. So long ago already!?) https://twitter.com/...
Interesting. Wow. And of course. Seems pretty obvious to me. We've been waiting for enforcement going on three years at least partially because Facebook just claimed overnight something was suddenly in its contract. https://twitter.com/...