EU’s top court sinks basis for targeted ads on Facebook

The direct result of the ruling will likely be a German ban on Meta’s customary combination of user data from its WhatsApp and Instagram platform—and data derived from tracking people as they visit third-party websites—with users’ Facebook data, to provide personalized advertising on the company’s longest-running social network.

But the ruling from the Court of Justice of the EU (CJEU) could fatally undermine Meta’s last remaining legal justification for providing targeted advertising anywhere in the EU. With Meta also facing a ban on exporting Europeans’ personal data to the U.S., its future in the region is seriously in doubt. And as much of Big Tech was relying on the same justification, there could be massive repercussions across the sector.

Antitrust + privacy

The case the CJEU just ruled on dates back several years. In early 2019, the German antitrust authority—the Bundeskartellamt or Federal Cartel Office—decided that Facebook was abusing its dominant position in the social-networking market, by combining data from different platforms to provide more targeted advertising.

The regulator said Facebook wasn’t really getting users’ voluntary consent for this extensive profiling, even though it was in the terms of use that they agreed to, because they had no choice but to agree, if they wanted to use the leading social network. Therefore, it argued, Facebook was both breaking the terms of the EU’s General Data Protection Regulation (GDPR) and illegally using its power as market leader to do so.

This was an unprecedented decision because it partially involved a competition authority wielding the power of the EU’s tough privacy law, which is usually enforced by data protection authorities. Facebook naturally appealed, which ultimately led to the CJEU ruling handed down Tuesday morning.

In its ruling, the CJEU confirmed that competition authorities such as the Bundeskartellamt can indeed look at a company’s compliance with other laws, such as the GDPR, when deciding if the company is breaking antitrust laws—although the competition regulator has to defer to whichever privacy regulator has jurisdiction over the company, if that watchdog has already ruled on the same issue.

That in…