The Court of Justice of the European Union was asked to answer the question of whether Facebook may, in the context of targeted advertising, analyze and process personal data of any kind at its disposal, without time limitation, and whether it is permissible to process sensitive personal data, such as the sexual life or sexual orientation of a user who has publicly disclosed it, for that purpose.

The case concerns a complaint by Austrian activist, Maximilian Schrems, against Meta Platforms Ireland for the unlawful processing of his personal data, including those relating to his sexual orientation, for the purpose of sending targeted advertising. In particular, Meta Platforms Ireland obtained information about M. Schrems through 'cookies', 'social plugins' and similar technologies embedded in third-party websites and used them in order to improve Facebook products and send personalized advertising to M. Schrems. Because of those 'plugins', Meta Platforms Ireland was able to monitor M. Schrems' online behavior, which led to the collection of certain sensitive personal data. Such 'plugins' were found on the websites of political parties and on pages targeted at homosexual audience, which Mr Schrems visited, whereas he had not uploaded any sensitive data on his Facebook profile.

It should be noted that, already from the 6th of November 2023, Facebook services continued to be provided free of charge only to users who had agreed to the collection and use of their personal data, in order to target them with personalized advertisements.

The function of Facebook is based on online advertising funding, which is specifically targeted at each individual user of the social networking site according to, among other factors, their consumption habits, interests and personal status. This specific type of advertisement is possible, from a technical viewpoint, due to the automated and detailed profiling of network users and the online services provided. More precisely, Meta Platforms Ireland collects the personal data of Facebook users related to their activities both inside and outside this social network, mostly including data related to the internet, visits to third party platforms, websites and applications, and follows the navigation patterns of users on these websites, through the use of social media and the "pixels" embedded in the relevant sites.

In the particular case in question, the user received an advertisement about an Austrian politician based on Meta Platforms Ireland's analysis that M. Schrems had common grounds with other users who had clicked "Like" on the politician in question. On the other hand, Mr Schrems also regularly received advertisements aimed at a homosexual audience and invitations to similar events, while he never mentioned his sexual orientation on his Facebook profile, although he had publicly disclosed the fact that he was homosexual.

The key-point in this case was the application of Article 9(1) of the GDPR which prohibits the processing of special categories of personal data, which include, inter alia, data revealing racial or ethnic origin, political opinions, religious beliefs and data concerning the health, sex life or sexual orientation of an individual. For the purposes of the application of Article 9(1) of the GDPR, the Court in its judgment in paragraph 72 stated that it is important to determine where personal data is processed by the operator of an online social network, whether such data contain information falling within one of the categories listed in the exceptions to the provision of Article 9 and are allowed to be disclosed, regardless of whether this information relates to a user of that network or to any other natural person. If so, then such processing of personal data is prohibited, with the exceptions listed under Article 9(2) of the GDPR.

Nonetheless, could a public disclosure by M. Schrems of his sexual orientation constitute an adequate basis for Article 9 para. 2(e), according to which the processing concerns personal data which have been manifestly made public by the data subject?

In his submissions, the Advocate General pointed out that the exception laid down under Article 9(2)(e) of the Regulation requires, in essence, two conditions to be met cumulatively, namely, first, an 'objective' condition that the personal data in question must be 'manifestly made public' and, second, a 'subjective' condition that it is the 'data subject' who must manifestly make those data public.

The Court ruled on the basis of the principle of minimization, that it is unlawful to aggregate, analyze and process all personal data acquired by Facebook, from the user himself or from third parties, collected both on and off the platform, for the purposes of targeted advertising, without time limitation and without distinguishing based on the nature of the data.

In conclusion, the fact that a person has expressed his or her sexual orientation in the context of a round table discussion open to the public, as in the case in question, does not allow Facebook to process other data relating to that person's sexual orientation, possibly obtained outside the platform through third-party applications and websites, in order to aggregate and analyze these data in order to propose personalized advertising to that person.