Meta Ordered to Provide User’s Complete Personal Data in Austrian Supreme Court Ruling

The company must provide full access to personal data collected on any user in the European Union who requests it.

A pedestrian walks in front of the Meta logo at the Facebook headquarters in Menlo Park, Calif., on Oct. 28, 2021. Justin Sullivan/Getty Images

Austria’s highest court has ordered Meta to give an online privacy activist full access to his personal data, establishing what could be a landmark legal precedent across the European Union.

In a decision handed down on Dec. 18, Austria’s Supreme Court of Justice sided with Austrian lawyer and activist Max Schrems, who first sued Facebook in 2014, seeking complete access to the personal data the social media company had collected about him.

In a statement, the court said it found Meta in violation of EU data protection law—among the strictest in the world—by using users’ personal data to personalize advertising and by aggregating and analyzing that data for advertising purposes without valid consent.

The court also found Meta unlawfully collected personal data through cookies, social plugins, and third-party integrations without proper user consent.

Under the ruling, Meta must provide Schrems with a full copy of all personal data it holds about him, along with detailed information about how each piece of data was processed, including its source, purpose, and recipients. The obligation applies not only to Schrems but also to any user within the EU who requests such access.

Since 2011, Schrems has sought full access to his personal data, but Facebook provided only partial disclosures, according to the Vienna-based nonprofit the European Center for Digital Rights (NOYB), which Schrems founded. For most users, the platform directed requests to a data “download tool” containing what it described as “relevant” information according to its general privacy policy.

Now, the Austrian Supreme Court said Meta must disclose Schrems’ personal data in its entirety within 14 days, with a deadline of Dec. 31. It also held that Meta must stop serving personalized advertisements to Schrems, finding that the company never had a lawful basis to process his personal data for that purpose.

“Platforms like Facebook or Instagram have huge influence, for example via pushing political views on users,” Schrems said in a statement via NOYB. “It was always absurd for Meta to claim that it does not process such data and must not comply with the law. The decision makes clear that Meta must not use such user preferences without explicit consent by each user.”

In addition, the court awarded Schrems 500 euros (about $587) in non-material damages. According to NOYB, the total costs to fight this 11-year legal battle have exceeded 200,000 euros (about $234,000).

“We acknowledge the Court’s decision on this long-running matter and are reviewing the ruling,” a spokesperson for Meta said in an emailed statement to The Epoch Times.

The spokesperson emphasized that the latest ruling refers to the situation as it existed at the time the lawsuit was filed, adding that Meta no longer uses sensitive data for personalized advertising.

“Since the case was first filed in 2014, we have made numerous updates and improvements to these tools, which allow users to access, download, or delete their data,” the spokesperson said.

Earlier in December, Meta announced plans to give Facebook and Instagram users in the EU additional options to limit personalized advertising, an effort to comply with the bloc’s regulations. For now, EU users can access these platforms for free with personalized or less personalized ads, or pay a subscription fee to avoid ads altogether.

The European Commission said the new advertising options will roll out in January 2026, calling it “the first time that such a choice is offered on Meta’s social networks.”

The changes follow a 200 million euro (about $266 million) fine imposed on Meta in April for breaching the EU’s Digital Markets Act, which requires companies to give users meaningful choices over how their data is used for advertising. Regulators concluded that Meta violated the law by forcing users to either pay a subscription fee to avoid ads or consent to use of their personal data for ad-supported versions of Facebook and Instagram.