Data Protection And Targeted Online Advertising

On 4 October 2024, the Court of Justice of the European Union ("CJEU"), in delivering a preliminary ruling in the name of Maximilian Schrems v. Meta Platforms Ireland Ltd (C-446/21), provided critical guidance on the application of the General Data Protection Regulation (the "GDPR") to personalised advertising practices on online platforms like Meta Platforms Ireland (formerly Facebook Ireland). The case was referred by the Austrian Supreme Court and it centered on the lawful limits of data processing, particularly regarding data minimisation, purpose limitation and the handling of sensitive personal data. This judgement is a significant development in balancing data protection rights against the business models of social media companies.