Meta cannot treat every piece of personal data it has collected as permanently available for targeted advertising in the European Union. In a judgment issued on October 4, 2024, the Court of Justice of the European Union (CJEU) said GDPR data-minimisation rules prevent an online network from aggregating, analysing and using personal data for advertising without limits on time or data type.
The ruling does not set a universal 30-day, one-year or other deletion deadline. It also does not ban personalised advertising or order Meta to delete every user record. Instead, it requires advertising-related data processing to have meaningful, justified limits—and separately restricts the use of sensitive data, including information relating to sexual orientation.
As an Amazon Associate I earn from qualifying purchases.
What the CJEU decided
The case is C-446/21, Maximilian Schrems v Meta Platforms Ireland. The Austrian Supreme Court referred questions to the CJEU about Meta’s processing of Facebook users’ data for personalised advertising.
Free tools Windows power users keep installed
One-click scans. No signup required.
The CJEU’s central finding was based on Article 5(1)(c) of the GDPR, the data-minimisation principle. A social network cannot collect or retain all personal data available to it and then use that entire pool for advertising without distinguishing between:
#1 Best Overall
- different categories of data;
- different advertising purposes; and
- the length of time the data remains necessary.
The relevant data can include information collected directly from a user, information obtained from third parties, and data gathered on websites or apps outside Facebook. The judgment therefore reaches beyond posts, clicks and activity inside the social network.
The Court described processing for targeted advertising that occurs “without restriction as to time and without distinction as to type of data” as incompatible with the GDPR’s data-minimisation requirement. Read the CJEU’s official press release or the full judgment on EUR-Lex.
There is no fixed deletion deadline
The most important clarification is what the judgment does not say. It does not require Meta to delete advertising data after a specific number of days or months.
Instead, the ruling requires the duration and scope of processing to be justified. The appropriate retention period may depend on the type of data, the stated advertising purpose, and whether continued use remains necessary and proportionate. The Austrian court must apply the CJEU’s interpretation to the underlying dispute, while data-protection authorities may address compliance separately.
That means headlines about “data-retention limits” should not be read as announcing a single EU-wide timetable for deleting users’ information. The practical legal question is whether Meta’s advertising systems place defensible limits on the data they retain, combine and use.
Rank #2
Why this matters to Meta’s advertising model
Meta’s advertising business relies on signals that can help build audiences, personalise ad delivery, measure campaigns and reconnect advertisers with people who have interacted with a business. Those signals may come from Facebook or Instagram activity, partner websites, apps, cookies, pixels and other third-party sources.
A requirement to limit advertising-related aggregation could affect:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- long-term behavioural profiles;
- audiences built from historical activity;
- retargeting and lookalike modelling;
- data imported from partner websites and apps;
- the reuse of old information for a new advertising purpose; and
- derived audience segments that remain usable after the underlying data is no longer needed.
In practical terms, Meta would likely need to demonstrate why particular data categories remain necessary, how long they are retained, when they stop being used for targeting, and how deletion, suppression or objection requests move through its advertising systems. Those are compliance implications of the judgment, not a checklist ordered expressly by the Court.
The ruling does not quantify any effect on Meta’s revenue, require the company to abandon targeted advertising, or establish that its EU advertising business will lose a particular amount of money.
The separate ruling on sensitive data
The CJEU also addressed special-category data under GDPR Article 9, including information relating to sexual orientation.
A person’s public statement about their sexual orientation does not, by itself, give Meta unlimited permission to process other information about that characteristic obtained elsewhere. The Court specifically rejected the idea that publicly mentioning a sensitive trait automatically authorises the platform to collect, combine or use related data from partner websites or apps for personalised advertising.
This distinction matters because sensitive information can be:
- expressly provided by a user;
- made public by the person;
- obtained from another source;
- inferred from behaviour or interests; or
- represented as a probability rather than a confirmed fact.
The judgment concerns data “relating to” a sensitive characteristic, not only a database field literally labelled “sexual orientation.” But it does not mean that every advertisement connected with a sensitive topic is automatically unlawful, nor does it establish that every example discussed in the litigation proves a user’s actual sexual orientation was known or used.
Does consent solve the problem?
No—not automatically. Consent may be relevant to one part of GDPR lawfulness, but it does not erase separate obligations concerning purpose limitation, data minimisation, transparency, special-category data, necessity, proportionality and retention.
In other words, “the user consented” is not the same as “all available data may be retained and used indefinitely for advertising.” At the same time, the judgment does not prohibit every consent-based personalised advertising model. The legality of a particular system depends on how its purposes, data categories, legal bases and retention practices fit together.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What the decision does—and does not—change
| What the ruling does | What it does not do |
|---|---|
| Requires meaningful limits on advertising-related aggregation, analysis and use. | Set one universal retention period. |
| Requires distinctions between data types and advertising purposes. | Ban all personalised advertising. |
| Restricts reliance on a public statement to justify processing related sensitive data obtained elsewhere. | Order deletion of every Meta record. |
| Applies GDPR interpretation relevant to online advertising businesses. | Automatically change Meta’s practices worldwide. |
| Creates a legal standard that may affect other ad-tech companies. | Quantify lost revenue or impose a specific financial penalty. |
Where the case fits in the Schrems litigation
The dispute originated with privacy activist Maximilian Schrems and was referred to the CJEU by Austria’s Oberster Gerichtshof, or Supreme Court. The CJEU interpreted EU law; the Austrian court remains responsible for applying that interpretation to the original proceedings.
The October 2024 judgment should also be distinguished from a separate CJEU ruling in July 2023 concerning Meta’s reliance on “legitimate interest” for advertising-related processing. The earlier decision concerned a legal basis for processing. The October ruling focused on the scope, duration and categories of data used for targeted advertising, as well as sensitive data made public by the subject.
Reporting from TechCrunch provides additional chronology and business context, but the CJEU’s judgment remains the primary authority for the legal holding.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why other ad-tech companies should pay attention
The reasoning is not limited to Meta’s corporate structure. Other GDPR-covered businesses could face similar questions if they:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- retain advertising profiles indefinitely;
- combine data from multiple contexts without meaningful limits;
- treat every available data category as interchangeable;
- reuse information for advertising after its original need has passed; or
- retain sensitive inferences or derived audience segments for targeting.
This could be relevant to social networks, publishers, data brokers, ad exchanges, measurement companies and platforms using partner-site data. It is a legal implication of the Court’s reasoning—not a finding that every company in these categories currently violates the GDPR.
Important limits and edge cases
The judgment concerns processing for targeted advertising. It should not be interpreted as requiring immediate deletion of every record held by Meta or any other platform.
Different questions may apply to data retained for account operation, security, fraud prevention, legal claims, regulatory duties or other separately justified purposes. Storage is also not identical to advertising use: a company may face different legal questions when it stores information, builds an advertising profile, selects an ad using an old profile, or retains a derived segment after deleting source data.
Similarly, public availability is not the same as permission for unlimited secondary processing. A public post, interview or speech may be visible to others without authorising a platform to combine related sensitive information from unrelated sources for advertising.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What happens next
The next steps depend on how the Austrian proceedings and relevant enforcement processes apply the CJEU’s interpretation. Possible areas of dispute include the retention periods that are proportionate for particular data categories, whether old profiles must be deleted or merely suppressed, and how off-platform data is separated from other advertising systems.
For users in the EU, the decision is best understood as a limit on the idea that a platform may permanently keep and reuse every available signal for advertising. For advertisers and publishers, it signals that durable audience targeting and cross-context data use may require more specific controls and stronger explanations. For investors, it creates a potential compliance issue for Meta’s advertising model, but the judgment alone does not support a precise forecast of revenue impact.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
