Austrian court forces Meta to hand over data and stop EU ad tracking

The Austrian Supreme Court has ordered Meta to provide a full, 1:1 copy of all personal data it holds on privacy activist Max Schrems and to stop showing him personalised advertising, the court ruled on 18 February 2026. The decision demands disclosure of purposes, sources and recipients under Article 15 GDPR, treats sensitive categories under Article 9, and declared the judgment directly enforceable across the EU. The court set a 14 day disclosure window that had a deadline ending 31.12.2025, and awarded Schrems €500 in damages plus litigation costs exceeding €200,000 after 11 years of proceedings.

Before this ruling, platforms such as Meta operated under contested practices for profiling and ad targeting of EU users, often defending internal processing logic as trade secrets. Regulators and courts across Europe issued mixed signals about the scope of access rights and the balance between transparency and commercial confidentiality. Two references to the Court of Justice of the European Union featured in the case history, and the Austrian court explicitly rejected Meta's trade secret defense in favour of full disclosure obligations under GDPR.

A directly enforceable EU precedent

This is not a local victory confined to Austria. The court stated the judgment is directly enforceable throughout the EU, which makes it a practical precedent for national data protection authorities and future litigants. For teams operating advertising platforms or running targeted campaigns on Facebook or Instagram, the ruling changes the enforcement landscape. Regulators can now point to a final national judgment that insists on granular Article 15 disclosure, including sources and recipients, and that treats sensitive data differently under Article 9.

The rejection of Meta's trade secret argument is the critical legal pivot. Companies that relied on opacity to protect profiling algorithms will now face stronger demands for transparency when individuals exercise access rights. This creates a cascade risk: more access requests will reveal how profiling works and could increase regulatory scrutiny of consent and lawful basis for processing.

Operational impact for platforms and compliance teams

Practically, the ruling forces product and legal teams to reassess data export and logging practices. A full 1:1 copy requirement means systems must be able to map identifiers, processing purposes, sources and recipients in a human readable form. That is an engineering and data governance effort. Teams that use targeting features such as custom audiences, behavioural segments, or inferred attributes need an immediate inventory of what they store and why.

The court also ordered Meta to stop personalised ads for Schrems and, by implication, reinforced that profiling-based advertising lacks a lawful basis without appropriate consent. The ruling includes a clear statement that Meta needs opt-in consent to track people in the relevant way. Advertising products built on implicit or contractual lawful bases should be reviewed, and consent flows should be hardened where EU users are involved. The practical deadline pressure is real, given the short statutory timelines in access requests and the fact litigation here spanned 11 years but culminated in a fast enforcement order.

WHY THIS MATTERS

For any EU-facing marketing team using Meta advertising, this is a legal red line. Facebook and Instagram audiences that rely on implicit profiling now carry measurable legal risk. Legal and product teams should prioritise two actions: pause non-consensual EU targeting and instrument exports that satisfy Article 15 requirements. Failure to do so invites both regulatory action and litigation that is now demonstrably enforceable across EU countries.

SOURCES

https://noyb.eu/en/austrian-supreme-court-meta-must-give-users-full-access-their-data