Meta Settles UK Lawsuit Over Use of Data for Targeted Advertising

Want to receive these privacy recaps in your inbox each week? Subscribe here.

Europe

Meta Settles UK Lawsuit Over Use of Data for Targeted Advertising

The Claimant in a three-year-old lawsuit against Meta announced that the case has settled and that Meta has agreed to stop processing her personal data for direct marketing purposes.

The lawsuit, filed in the High Court of England and Wales, alleged that Meta continued to process known or inferred characteristics about the Claimant for direct marketing purposes after the Claimant exercised her right to object under the UK GDPR. She sought relief in the form of a declaration that Meta breaches the UK GDPR and an order for Meta to cease processing O’Carroll’s personal data for direct marketing purposes. She did not seek monetary damages.

The settlement followed submissions from the ICO to assist the Court, stating the following positions relevant to the case: (1) the processing of personal data for the purposes of online targeted advertising and profiling for such purposes falls within the scope of the UK GDPR; (2) the fact that PECR could have been amended to address online advertising (outside of the cookie context) does not prevent the UK GDPR from applying to online targeted advertising; and (3) the plaintiff in this case has “an absolute right to object to the processing of her personal data and related profiling for the purposes of online targeted advertising where that processing and profiling are for direct marketing purposes.”

TAKEAWAY

Although the settlement only applies to the individual Claimant in this case, and a settlement means that no legal precedent has been established by the Court, the Claimant is reportedly hopeful that the settlement and the ICO’s backing will serve as support for others who object to Meta’s processing of their data.  

Luxembourg Court Upholds €746M Daily Fine Against Amazon Europe

The administrative court of Luxembourg dismissed an appeal brought by Amazon Europe of a 2021 decision issued by the National Data Protection Commission against Amazon Europe imposing a penalty of 746 million euros per day that Amazon Europe failed to establish a proper legal basis for its ad targeting practices. Amazon had previously relied on its contract terms of service as a means of obtaining consent to ad targeting, which the Luxembourg DPA held, and the Court confirmed, to be insufficient.

The Court also found that Amazon Europe failed to adopt the corrective measures necessary to avoid the penalty. Amazon has the right to further appeal the ruling, and the Court ruled that the decision would remain suspended during the appeal period.

TAKEAWAY

In the years since the original decision, legal precedent in Europe regarding the reliance on contractual necessity as a legal basis under GDPR has been further developed. For example, the Irish Data Protection Commission fined Meta Ireland €390M in January 2023 for GDPR violations based on reliance by Facebook and Instagram on the “contract” legal basis for data processing operations, including for behavioral advertising.

The European Data Protection Board had issued determinations in that case, finding that Meta Ireland was not entitled to rely on the “contract” legal basis for its processing of personal data for behavioral advertising. The European Data Protection Board then issued a binding decision in October 2023 banning Meta’s targeted advertising practices following Meta’s alleged failure to demonstrate compliance with previous orders holding that contract was not a suitable legal basis for Meta’s processing of personal data for behavioral advertising.

The Irish Data Protection Commission went on to fine LinkedIn IE €310M in October 2024 based, in part, on a determination that LinkedIn IE did not validly rely on contractual necessity to process first party data for behavioral analysis and targeted advertising. 

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.