What Does the CJEU Decision Mean for Personalised Advertising?

In a landmark decision, the Court of Justice of the European Union (CJEU) has reshaped the landscape for online platforms using personal data for targeted, personalised advertising. The case, Meta vs Bundeskartellamt, has important ramifications for how the AdTech industry navigates GDPR and Competition law. But what does this mean for personalised advertising now?

How Did We Get Here?

The case follows a series of fines imposed on major platforms like Meta and WhatsApp, highlighting their struggle to identify appropriate legal bases for data processing under GDPR. Platforms often relied on "contractual necessity" or "legitimate interest," both of which have been deemed insufficient for processing personal data related to behavioural advertising.

What Were the CJEU's Key Findings in Relation to Personalised Advertising?

The CJEU clarified that data processing for personalised advertising cannot merely be tagged onto a contract unless it is essential to the contract's core function. It also stressed that a service does not automatically require personal data processing beyond what is necessary to fulfil its primary purpose.

Understanding "Legitimate Interest": To claim "legitimate interest," businesses must consider whether users expect their data to be used in a particular way and must ensure that their processing does not trump users' rights. This decision indicates the diminishing viability of "legitimate interest" as a catch-all legal basis for targeted advertising.

To rely on "legitimate interest" as a legal basis, the CJEU clarified that, when performing a balancing test to determine whether the data subject's interests outweigh the legitimate interest, the controller must consider the data subject's reasonable expectations, the scale of the processing involved, and its impact on the data subjects.

Can Consent Be Freely Given?

Consent, according to the GDPR, should be freely provided. The CJEU ruled that users must have genuine choice in data processing decisions and should not be unduly penalised for declining to share personal data. Charging a fee for non-consented services is permissible, highlighting the need for transparency and choice in user agreements.

What Does This Mean for Online Platforms?

With this decision, platforms must reassess their data practices:

• Review and Adapt: It is crucial for online platforms to review their contractual and operational elements if they hinge on personalised content.

• Focus on Consent: Securing informed and genuine user consent is paramount. Using consent as the legal basis avoids the complexity associated with other bases like "legitimate interest."

• Competition Compliance: Platforms must also consider how GDPR violations could intersect with competition law violations, emphasising the need for compliance across regulatory spectrums.

  
  

How Can Businesses Protect Themselves?

At I.K.Kouppas & Co LLC, we understand the intricacies of EU regulations and offer expert guidance to help your business navigate these legal complexities efficiently. Our bespoke legal solutions are designed to ensure compliance and aid businesses in achieving their goals.

If you would like to discuss this pivotal decision further, we invite you to contact us via email at info@ikklaw.com.cy. To stay updated on these vital industry updates, subscribe to our newsletter at ikklaw.com.cy.

Navigate these evolving regulations with confidence; protect and leverage your data assets to their fullest potential while maintaining compliance and operational efficiency.