In a landmark ruling, the European Court of Justice (ECJ) has sided with Germany's competition regulator, the Bundeskartellamt, against Meta Platforms, the parent company of Facebook, Instagram, and WhatsApp. The court ruled that Meta's practice of merging user data from its various services without explicit user consent is illegal. This decision upholds the 2019 finding of the Bundeskartellamt that Meta was abusing its dominant market position by collecting and processing user data without their explicit consent.
The Bundeskartellamt had argued that Meta's business model, which relies heavily on detailed user data analysis to deliver personalized advertising, was exploiting its market dominance. Meta had countered this decision, taking the case to the Higher Regional Court in Düsseldorf, which then referred some of the open questions to the ECJ.
No More GDPR Evasion
For years, Meta has avoided asking its users for explicit permission to process their data. After the General Data Protection Regulation (GDPR) came into effect, Meta argued that personalized advertising was a “contractual necessity” for its services. This interpretation was rejected by the European Data Protection Board following a lawsuit by the privacy organization NOYB (None Of Your Business). Subsequently, Meta changed its terms of service and began justifying the processing of sensitive data with a “legitimate interest,” a move that has been legally questionable.
In its ruling, the ECJ clarified that competition authorities may investigate and prohibit potentially unlawful data protection practices if they identify market abusive behavior. The court also pointed out that Meta violates the GDPR by processing sensitive data without asking, which could reveal information such as religious beliefs or sexual orientation.
Doubts Over Data Processing Justifications
The ECJ expressed doubts about the legality of a blanket permission for data processing secretly obtained and necessary for contract fulfillment. The court stated that the need to fulfill a contract with a person would only justify the disputed practice if the data processing was “objectively indispensable” and the main subject of the contract could not be fulfilled without it. The court also did not recognize a “legitimate interest” for Meta's data processing in the absence of the affected person's consent, even if the company finances itself through personalized advertising.
Impact on Tech Giants
This ruling could have significant implications for other tech giants like Google, which use similar data collection mechanisms. Andreas Mundt, head of Germany's antitrust agency, tweeted that the judgment would have far-reaching effects on the business models used in the data economy. “When large internet companies use the very personal data of consumers, this usage can also be deemed abusive under competition law,” Mundt stated.
The judgment sends a strong signal for competition law enforcement in the digital economy, a field where data are decisive for market power. When large internet companies use the very personal data of consumers, this usage can also be deemed abusive under competition law. In… https://t.co/IqJx3hfhwl
— Andreas Mundt (@AMundt_BKartA) July 4, 2023
Max Schrems, Chairman of of None of Your Business (NOYB), a European non-profit organization that focuses on privacy issue and privacy violations in the private sector, saw the ruling as a “heavy blow for Meta, but also for other online advertising companies. It makes clear that various legal approaches of the industry to circumvent the GDPR are null and void.”
The ruling means that Meta will have to seek proper consent and cannot use its dominant position to force people to agree to things they don't want. This decision could significantly impact Meta's business model and potentially reshape the landscape of the internet, giving a boost to non-commercial, decentralized, and free services.
