New victory for Max Schrems against Facebook. And there are three of them. The Austrian lawyer succeeded in having the Court of Justice of the European Union (CJEU) condemn one of the characteristic practices of massive data extraction that characterizes Meta’s social networks: tracking on the Internet to obtain even more information on users in order to feed segmented segmentations. advertisement. The magistrates ruled that the fact that certain personal data is published on the Internet does not authorize Meta to include them in its databases and use them to produce highly targeted advertisements.
Schrems called out Facebook for including information about his sexual orientation in its files, based on comments made during a panel discussion. The fact that these were subsequently published on the Internet “does not authorize the operator of an online social media platform to process further data relating to your sexual orientation obtained, where applicable, outside of said platform, with the aim of aggregating and analyzing this data to offer personalized advertising,” rules the CJEU.
Meta, which also owns Instagram, collects user data not only within its social networks, but also when they browse other websites or use third-party applications. This tracking is carried out via the famous cookies or the “Like” and “Share” buttons integrated into the pages, but also via the famous “Facebook pixel”, or “Meta pixel” after the page name change.
The “Meta pixel” is a key tool for collecting data outside of enterprise platforms. This is a small snippet of code that website owners can insert into their pages so that Facebook tracks visitors’ actions, even if they aren’t using Facebook at the time. For example, when visiting an online store integrating the pixel, Meta can know which products the user was interested in, which ones he added to the cart or whether he actually paid for them. This information is then sold to advertisers. In addition, they are never deleted, unless requested by the user themselves.
In its judgment, the CJEU criticizes the “potentially unlimited scope” of these practices and considers that they violate privacy laws. The magistrates judge that this collection and indiscriminate processing of all of a user’s data violates the principle of minimization which should govern the processing of personal information. Therefore, they require Meta to obtain “explicit consent” to use this data for advertising purposes. Especially when it comes to sensitive data such as sexual orientation, which is the basis of Schrems’ complaint.
This new setback for Meta’s practices comes on top of the historic fine that the social media company received in 2023, of 1.2 billion euros, for not having respected one of the sentences that Schrems obtained against him and which prevented him from sending personal data of Europeans to the social network. WE. Furthermore, in recent months, another of its disputes with data protection authorities resulted in the company’s refusal to implement one of its new artificial intelligences, called Llama 3.2, in Europe.
It is a multimodal AI, which means it can process and generate information from text, images, documents and graphics. Meta trained it with user data from its networks and tried to make it difficult for Europeans to opt out of having their photos and comments used for this purpose. After being reprimanded by data protection authorities, Meta decided not to use this information to train its AI, but Llama would be banned in the EU.
