CJEU Meta Ruling: Why Consent Fails for Bundled Services
Core Ruling of CJEU Case C-252/21
The Court of Justice of the European Union ruled on July 4, 2023, in case C-252/21 (Meta Platforms Ireland Limited) that linking Facebook usage to consent for data processing for personalized advertising violates Art. 7(4) GDPR. The judgment establishes: consent is not freely given when made conditional for service access, while data processing is not necessary for service provision.
Specifically, the case addressed Meta's practice of combining user data from various sources (Facebook, Instagram, WhatsApp, external websites via pixels and plugins) for personalized advertising. Meta made this data processing a prerequisite for Facebook usage – without offering alternatives.
Legal Assessment under Art. 7(4) GDPR
The CJEU found Meta violated the bundling prohibition in Art. 7(4) GDPR. This provision prohibits making contract performance conditional on consent when such consent is not necessary for contract fulfillment. The Court emphasized three crucial aspects:
- Providing a social network does not inherently require personalized advertising
- Market dominance exacerbates the lack of genuine choice
- Alternative revenue models (contextual advertising, subscriptions) are technically feasible
Particularly relevant is the finding that merely having the option not to use a service does not constitute genuine choice when no comparable market alternatives exist.
Impact on Legal Bases under Art. 6 GDPR
The ruling has significant consequences for legal basis selection. Meta can no longer rely on Art. 6(1)(a) GDPR (consent) when it's coerced. Remaining options are problematic:
Art. 6(1)(b) GDPR (contract performance): Personalized advertising is not necessary for social network provision. The CJEU followed the EDPB's restrictive interpretation in Guidelines 2/2019 on processing personal data under Art. 6(1)(b).
Art. 6(1)(f) GDPR (legitimate interests): Following CJEU decision C-311/18 (Schrems II) and subsequent supervisory authority guidance, balancing tests for extensive profiling for advertising typically fail.
Technical Implementation Requirements
The ruling forces platforms toward fundamental technical changes. Key requirements include:
Granular Consent Options: Separate consent management for different data processing purposes. Technical implementation must ensure users can specifically decide on advertising personalization, cross-service data linking, and external tracking pixels.
Alternative Service Variants: Providing services without personalized advertising, through contextual advertising or freemium models. This requires separate cookie policies, adapted JavaScript APIs, and segregated databases for different user groups.
Data Minimization: Implementing privacy-by-design principles per Art. 25 GDPR. Technically: separate data streams, local processing where possible, and strict purpose limitation in data processing protocols.
Compliance Requirements for Organizations
Data Protection Officers and compliance professionals must review their consent management systems. The Irish DPC has indicated in recent enforcement actions increased scrutiny of bundling practices.
Immediate Actions: Review all services where consent becomes contractual prerequisite. Particularly critical are CRM systems, newsletter registrations, and app downloads requiring tracking consent.
Long-term Adaptations: Develop alternative business models and technical architectures. This includes implementing differential privacy, on-device processing, and federated learning systems for ad relevance without central data collection.
Practical Implementation for DPOs
Concrete compliance steps:
- Audit all consent forms for bundling scenarios
- Document necessity of each data processing for respective contractual purposes
- Implement granular consent options in existing cookie banners
- Legal assessment of alternative legal bases considering CJEU jurisprudence
- Technical preparation for separated service variants
The Meta ruling marks a turning point in data protection law. Organizations must fundamentally rethink their data processing strategies and create genuine user choice – both legally and technically.