CJEU’s landmark decision in Meta vs Bundeskartellamt allows GDPR scrutiny through antitrust regulators and imposes strict limitations on the personalised use of consumers’ personal data by social media platforms

By Verena Grentzenberg, Philipp Schmechel, Dr. Jonas Kranz

On 4 July 2023, the European Court of Justice (“CJEU”) delivered its judgment in Meta vs Bundeskartellamt Case C-252/21. The decision imposes important requirements in relation to the interpretation of the GDPR and the interplay between competition authorities and data protection supervisory authorities, in particular, with regards to the personalised use of consumers’ personal data for targeted advertising by social media platforms.

In particular, the CJEU ruled that competition authorities of a Member State have the authority to investigate and sanction an infringement of the GDPR, if companies exploit their dominant market position. In case of data protection violations, the competition authorities must consult with the competent data protection supervisory authority.

In addition, the case deals, in particular, with requirements for the combined personalised processing of Facebook users’ personal data collected by Meta within Facebook, and of so-called off-Facebook data, collected by websites and applications outside of the social media platform. In this regard, the CJEU imposes strict limitations on the interpretation of the ‘necessity for the performance of a contract’ legal basis and also significantly limits Facebook’s legitimate interests to process the users’ personalised social network data and imposes limitations and strict requirements for obtaining lawful consent for a company dominant on the market. The CJEU clarifies that it cannot be inferred from the mere visit to websites or apps by a user that sensitive personal data generated in this process were manifestly made public by that user within the meaning of Article 9(1)(e) GDPR.

For further information on the decision, please see our article available here