Austria's highest court prohibits Meta Platforms' business model

Contents

Meta Platforms has been operating its business model illegally in the European Economic Area: it collected too much data, personalized advertising impermissibly, and provided insufficient information. This was decided by the Supreme Court of Austria (OGH) after an eleven-year legal process (Ref. 6 Ob 189/24y). Facebook was not allowed to tailor advertising to the plaintiff and is not allowed to harvest data about him on third-party sites. And contrary to Meta's previous practice, its claim for information is not limited to a copy of all personal data, but also includes the disclosure of the purposes of processing, as well as the sources and recipients of the data.

In principle, Meta has one month to respond to information requests. In this specific case, this deadline expired years ago, so the OGH only grants time until the end of the year. The proceedings were initiated by Austrian lawyer and data protection activist Max Schrems in 2014. Since then, the case has been before the European Court of Justice (ECJ) twice and now for the third time before the OGH.

Now it's over – but only with this process. Numerous lawsuits are likely to follow, and the German Federal Court of Justice (BGH) may also orient itself towards interpretations of the OGH.

"Meta (must) grant Mr. Schrems unprecedented access to the data collected about him," says the plaintiff's lawyer, Katharina Raabe-Stuppnig. "This goes far beyond the download tool or the information on the website. For more than a decade, Meta has refused to provide complete transparency regarding the processing of European data. The ruling is directly enforceable throughout the EU."

Personalized advertising not a service to the user

"For the provision of the services of the social online network... the personalization of advertising using the user's personal data... is not necessary," states the OGH. "Furthermore, the aggregation and analysis of personal data for advertising purposes is not part of the contractual performance intended for the plaintiff." Rather, this is a service for advertising customers, not for users. This eliminates the legal basis claimed by Meta for the personal tailoring of advertisements.

However, since 2023, Meta has offered users the option to refuse ad tailoring by paying a fee. The OGH expressly leaves open what this constellation means legally. Its ruling relates exclusively to the situation in 2020.

Meanwhile, the situation has become even more complex. The EU Commission has recently concluded an agreement with Meta, according to which Meta will soon evaluate less data for personalized advertising on Facebook and Instagram, but may charge fees for comprehensive injunctions. However, as far as can be seen, this only helps against ad tailoring, not against the collection of personal data itself. As soon as the user leaves the EEA, or the legal situation changes, Meta could fully re-evaluate the data already collected.

Data harvesting on third-party sites impermissible

Meta collects data about its users not only through its own services but also on countless third-party websites and apps, through cookies and the notorious "Meta Business Tools." In this regard, the OGH states that Meta is the "controller" within the meaning of the General Data Protection Regulation (GDPR) "with regard to the collection, transmission and further processing of the plaintiff's personal data obtained through their social plugins and similar technologies during the plaintiff's visits or activities on third-party websites." Meta's argument that the operators of the respective apps and websites are solely responsible for this is not valid.

Meta's plugins are, for example, also integrated into the websites of political parties, medical sites, or sites for homosexuals. They thus collect sensitive data that is specially protected by the GDPR. According to the OGH, it does not matter whether Meta collects such data intentionally or unintentionally. Meta must cease this data collection via third-party websites and apps. It also does not matter whether the data is used for advertising or other purposes.

The OGH also bases its decision on the ECJ. In the proceedings with the German Federal Cartel Office (Ref. C-252/21), it expressly rejected a division of the overall process into individual processing operations and different data categories.

"The OGH confirms that the Meta Business Tools are generally unlawful," clarifies German lawyer Max Baumeister. "They are espionage tools that spy on all of our private lives." Independently of Schrems' eleven-year-old lawsuit, Baumeister is pursuing a legal major offensive against Meta's business model in Germany and Austria. The lawyer "assumes that the BGH will confirm this at the end of 2026 or the beginning of 2027," he told heise online on Thursday evening.

Only 500 Euros for Max Schrems

At an earlier stage of the proceedings, the OGH had already awarded Max Schrems 500 Euros in damages for Meta's violation of its duty to provide information. For the illegal data collection and the impermissible data evaluation for personalized advertising, there is no further compensation for damages for the sole reason that Schrems did not request more than 500 Euros in total -- likely to avoid escalating the dispute value and thus legal costs.

"We assume that there is significantly more to it," says Baumeister, "This applies to Austria; for Germany, it applies even more so due to stricter laws for serious infringements of personality rights." German regional courts are divided on Meta's data practices.

The long road to the BGH

Because private individuals in Germany cannot file enforceable class actions, Baumeister has filed around 8,000 lawsuits in the last two years for data harvesting using Meta Business Tools. More than 2,000 proceedings have been decided in the first instance so far, none of them legally binding.

A ruling by the Leipzig Regional Court in the middle of the year, which awarded a Meta affected person 5,000 Euros (Ref. 05 O 2351/23, not legally binding), caused a stir. Initially, German courts ruled predominantly in favor of Meta, but data protection arguments are gradually gaining ground with German judges. The legal reasoning is not always the same, and the awarded damages vary by a factor of 100: the range extends from 100 Euros to 10,000 Euros.

The BGH will have to decide. In cooperation with the Austrian Consumer Protection Association (VSV), Baumeister is now gathering participants from both countries who wish to participate in a collective action free of charge.

(ds)