May Meta collect and pass on data about my sexual orientation to advertisers?

On Oct. 4, 2024, the European Court of Justice issued an important ruling in the case Schrems (C-446/21), with far-reaching implications for the processing of sensitive personal data (such as sexual orientation) by tech giants such as Meta (Facebook). The Court clarified that even if a Facebook user self-discloses sensitive data (such as his/her sexual orientation) outside the Facebook platform, it does not mean that Meta may therefore collect such data to provide the Facebook user with targeted ads related to his/her sexual orientation without his/her explicit consent.

Case Background

Maximilian Schrems, an Austrian privacy activist, argued that Meta had unlawfully processed his personal data in the context of the social networking platform Facebook. This data included information about his sexual orientation (homosexual), collected through tracking tools such as cookies, pixels and social plug-ins. While Schrems had spoken about his sexual orientation during a public panel discussion, Meta additionally collected data about his online activities outside the Facebook platform for targeted advertisements.

The case revolved around whether disclosing sensitive information in a particular context gives Meta the freedom to process that data without question. Indeed, Meta was using the data collected to offer Schrems personalized ads based on his interests, including his sexual orientation.

Judgment of the Court

The Court of Justice points out that the General Data Protection Regulation (GDPR) explicitly protects sensitive data, such as sexual orientation. Even if an individual discloses this data in another context, this does not give platforms such as Meta the freedom to process this data for marketing purposes in the context of the platform without further consent.

The Court emphasized two crucial principles:

1. Data minimization (Article 5 AVG): Platforms may only process personal data for specific and necessary purposes. This means that Meta may not collect, store and use unlimited data for personalized advertisements.
2. Consent for sensitive data (Article 9 AVG): The AVG requires the explicit consent for the processing of sensitive personal data. The fact that someone discloses their sexual orientation in a particular context (such as a panel discussion) does not justify the processing of data by Meta about this sexual orientation.

Impact on businesses

This ruling primarily affects Meta (Facebook) itself, but also has important implications for companies engaged in personalized advertising. Companies must review their data collection and advertising practices to meet the strict requirements of the AVG, especially with respect to sensitive data such as sexual orientation, political views or religious beliefs.

The emphasis is on transparency and obtaining explicit consent. Companies that collect personal data through external tracking mechanisms, such as cookies and pixels, must clearly inform users and obtain their consent before processing sensitive data for commercial purposes.

Conclusion

The ruling in the case Schrems strengthens the protection of sensitive personal data and places further restrictions on how tech companies like Meta may collect and use data for personalized ads. This ruling highlights the importance of compliance with the AVG, especially when it comes to processing sensitive data without explicit user consent. Assistance from a lawyer specializing in data protection law is therefore appropriate.