Court decision · 4 July 2023
Meta Platforms Inc. and Others v Bundeskartellamt
Case C-252/21, ECLI:EU:C:2023:537 · Court of Justice of the European Union (Grand Chamber)
What it means for your code
Do not rely on 'contract necessity' in your terms to justify ad personalisation or cross-service tracking; get consent.
What happened
Germany's competition authority challenged Meta's combination of user data collected on and off Facebook for personalised advertising.
What was decided
Competition authorities may take GDPR compliance into account. Personalised advertising based on off-platform tracking cannot generally be justified as necessary for performing the contract, and legitimate interest is subject to strict limits; a dominant position is a factor in whether consent is freely given.
The legal test applied
- Contract necessity (Art. 6(1)(b)) covers only processing objectively indispensable to the service
- Legitimate interests for personalised advertising must survive a balancing test that users' reasonable expectations often defeat
- Consent must be freely given; a dominant position is relevant but does not by itself invalidate consent
- A competition authority may examine GDPR compliance when assessing abuse of dominance
What would have changed the outcome
- Contextual, non-profiled advertising avoids the need for these legal bases
- Offering an equivalent alternative without tracking supports freely given consent
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.