Meta's Targeted Advertising Found Non-Compliant with GDPR
Meta's Targeted Advertising Found Non-Compliant with GDPR
TL;DR — Quick Answer
1 min readEU regulators fined Meta EUR 390 million for targeted advertising without valid consent, clarifying that social media platforms cannot claim ad tracking is contractually necessary.
Meta's Targeted Advertising Found Non-Compliant with GDPR
European regulators ruled that Meta cannot deliver targeted advertising without obtaining valid user consent, striking down the company's claim that advertising is necessary for performing its contract with users.
The Legal Basis Problem
Meta had relied on "contractual necessity" as its legal basis for processing personal data for targeted advertising, arguing that personalized ads were an essential part of the social media service. The Irish DPC, guided by the European Data Protection Board, rejected this argument. Targeted advertising is not necessary for providing a social media service, and therefore requires a different legal basis -- in practice, consent.
The Impact
This ruling forced Meta to fundamentally reconsider how it operates in Europe. The company must either obtain valid consent for targeted advertising (which many users would refuse) or find alternative revenue models. The total fines for these violations reached EUR 390 million.
Industry-Wide Implications
The ruling clarifies that social media platforms and other free services cannot claim that surveillance-based advertising is a necessary part of their service contract. Any platform relying on similar legal reasoning should reassess its position.
Was this article helpful?
Let us know what you think!
Before you go...
Related Articles
Meta's Pay-or-Consent Model Under Regulatory Scrutiny in Europe
Meta's paid subscription as an alternative to ad tracking faces regulatory challenges. Learn why 'pay or be tracked' models may violate GDPR consent requirements.
Why Meta Faces Existential Regulatory Challenges in Europe
The CJEU Bundeskartellamt ruling combined with accumulated GDPR enforcement creates unprecedented threats to Meta's European operations, connecting competition law with data protection.
Meta Receives $102 Million Fine for Storing Passwords in Plain Text
The Irish DPC fined Meta $102 million after discovering up to 600 million user passwords were stored unencrypted since 2012. Learn about the GDPR violations and lessons for all organizations.