Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 11 SEPTEMBER 2023

AdTech Update: CJEU Landmark Data Protection Ruling For Online And Behavioural Advertising

William Fry LLP
William Fry LLP
Contributor
William Fry LLP

William Fry LLP

William Fry advises leading Irish and international companies, covering both the public and private...

View firm profile
Explore more from William Fry LLP

Following many fines and decisions from data protection supervisory authorities relating to the issue, the CJEU has issued a landmark decision in Meta vs Bundeskartellamt Case C-252/21 (Decision).

IrelandMedia, Telecoms, IT, Entertainment
Leo Moore
Leo Moore
Roisin Culligan
Roisin Culligan
Author LinkedIn connections

What legal basis can online platforms use for processing personal data for targeted advertising? We now have an answer.

Following many fines and decisions from data protection supervisory authorities relating to the issue, the CJEU has issued a landmark decision in Meta vs Bundeskartellamt Case C-252/21 (Decision). The Decision significantly impacts the AdTech industry, especially the personalised use of consumers' personal data for targeted advertising by social media platforms, but also generally regarding the interplay of GDPR and Competition law.

This note explores the history leading to this decision and what this means for the future of personalised advertising by online platforms.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

NCSC Guidance On Cyber Governance: What Management Boards Of NIS2 Entities Need To Know

Ireland's National Cyber Security Centre has issued comprehensive guidance on NIS2 compliance, placing cybersecurity firmly in the boardroom. With potential fines reaching €10 million or 2% of global turnover for essential entities, management boards must now actively oversee cyber risk strategies, incident response capabilities, and supply chain vulnerabilities. The guidance provides a structured framework for organisations to assess their readiness before the National Cyber Security Bill takes effec
IrelandMedia, Telecoms, IT, Entertainment
Arthur Cox
Arthur Cox
Article

The EU Cyber Resilience Act: Reporting Obligations Take Effect

The EU Cyber Resilience Act introduces mandatory vulnerability and incident reporting obligations for products with digital elements starting September 2026. Economic operators developing, importing, or distributing such products in the EU face strict compliance deadlines, substantial penalties for non-compliance, and must implement security-by-design principles throughout product lifecycles.
European UnionMedia, Telecoms, IT, Entertainment
Matheson
Matheson
Article

Irish Gambling Regulatory Regime – Implementation Update

Ireland's Gambling Regulatory Authority is now actively licensing operators and enforcing the comprehensive regulatory framework established by the Gambling Regulation Act 2024. With remote operators already transitioned and in-person operators facing a December 2026 deadline, the GRAI has implemented wide-ranging enforcement powers including administrative sanctions up to €20 million and criminal provisions for unlicensed activities. Recent CJEU case law highlights critical compliance considerations
GlobalMedia, Telecoms, IT, Entertainment
Matheson
Matheson
Article

EU KIDS Act: Grown-Up Rules For Online Providers

The European Commission has proposed the EU KIDS Act, establishing one of the most prescriptive child-safety frameworks yet at EU level. This comprehensive regulation would introduce graduated age-based access controls for social media, mandate safety-by-design requirements, and create a harmonized age-verification system across Member States. The proposal carries far-reaching implications for digital services accessible to minors, requiring providers to fundamentally redesign products, implement strict def
European UnionMedia, Telecoms, IT, Entertainment
William Fry LLP
William Fry LLP
Article

EU AI Act: Commission Draft Guidelines On Classification Of High-risk AI Systems

The European Commission has released draft guidelines clarifying how AI systems should be classified as high-risk under the EU AI Act, while simultaneously extending key compliance deadlines by up to two years. These guidelines provide detailed interpretative guidance on classification thresholds, the role of human oversight, and how complex or interconnected AI systems should be assessed for regulatory purposes.
IrelandMedia, Telecoms, IT, Entertainment
Arthur Cox
Arthur Cox
Article

Countdown To Compliance: The Cyber Resilience Act Reporting Deadline Has Arrived

The EU's Cyber Resilience Act establishes comprehensive cybersecurity obligations for manufacturers, importers, and distributors of products with digital elements. With reporting requirements now in effect and full compliance required by December 2027, economic operators must navigate conformity assessments, incident reporting protocols, and enforcement mechanisms that include substantial penalties for non-compliance.
IrelandMedia, Telecoms, IT, Entertainment
Arthur Cox
Arthur Cox
Article

Government Legislative Priorities For Autumn 2026

The Government has published its Autumn 2026 Legislation Programme, identifying 32 bills for priority publication and 32 bills for priority drafting. This article explores a selection of measures likely to be of interest to businesses, spanning digital economy, strategic infrastructure, litigation reform, financial regulation, competition law, corporate structures, employment, pensions, and healthcare sectors.
IrelandGovernment, Public Sector
William Fry LLP
William Fry LLP
Article

Ireland’s Data Centre Connections: Back Online

Ireland has lifted its data centre connection moratorium and introduced a demanding new framework requiring developers to provide their own generation capacity, source 80% of electricity from new Irish renewables within six years, and meet strict grid stability requirements. The policy creates significant opportunities for developers who can navigate the complex intersection of grid connection, planning permission, and renewable energy procurement, though a pending legal challenge adds uncertainty to the la
IrelandEnergy and Natural Resources
William Fry LLP
William Fry LLP
Article

Time Running Out As AI Transparency Guidelines Published

The European Commission has published comprehensive guidelines on AI transparency obligations under Article 50 of the EU AI Act, with enforcement beginning August 2, 2026. These guidelines establish how organizations must disclose AI systems, mark synthetic content, label deepfakes, and demonstrate compliance, with significant penalties for non-compliance reaching up to €15 million or 3% of global turnover.
IrelandTechnology
William Fry LLP
William Fry LLP
Article

Data For Sale: Can Insolvent Companies Realise The Value Of Corporate Data?

Spirit Airlines' proposed $10 million sale of a massive de-identified corporate dataset to Google in its Chapter 11 bankruptcy proceedings raises fundamental questions about whether operational business data can be treated as a realisable asset in insolvency. The transaction highlights the legal tension between preserving a dataset's commercial utility and ensuring individuals cannot be identified, particularly when the data maintains referential integrity across multiple systems.
IrelandInsolvency/Bankruptcy/Re-Structuring
William Fry LLP
William Fry LLP