The case, explained

EU Court of Justice: Data Minimization Principles in Advertising Profiling

5 min read · Updated October 2026 · Editorial oversight: Avv. Federico Papa

The recent evolution of European data protection jurisprudence marks a turning point for the digital advertising market. According to news reports, the Court of Justice of the European Union has defined the boundaries for processing personal data intended for commercial profiling, clarifying the incompatibility of indiscriminate and indefinite collection. Other aspects of the case, concerning data usage for AI training, are covered in dedicated articles within this column. This contribution focuses on the platforms' duty to limit the retention of user information, especially regarding sensitive data disclosed in public contexts. Through the analysis of the Gaio Sventura case, we will explore how the minimization principle concretely affects corporate database management and data subject protection.

EU Court of Justice: Data Minimization Principles in Advertising Profiling

In brief

This article examines the EU Court of Justice ruling on the Meta-Schrems case, focusing on the data minimization principle. The Court ruled that platforms cannot indiscriminately use all collected personal data for advertising purposes, nor can they store it indefinitely. Even sensitive data made public by the user is protected, preventing a public statement from authorizing unlimited and invasive profiling.

  1. The facts

    According to sector press reports, the dispute arises from legal action brought by activist Maximilian Schrems against Meta Platforms Ireland Ltd. Schrems complained that Meta systematically used all collected personal data, both inside and outside the Facebook platform, for targeted advertising, including sensitive information regarding his sexual orientation. This information had been made public by Schrems during a panel discussion; however, he contested that this gave the platform the right to process it indefinitely for targeting purposes. The case reached the CJEU following a preliminary reference from the Austrian Supreme Court. The European judges were asked to clarify whether the GDPR allows a data controller to aggregate data without temporal or material limits for commercial purposes.

  2. The legal framework

    1. GDPR Article 5: establishes the data minimization principle, requiring controllers to process only adequate, relevant, and limited data to what is necessary for the stated purposes.
    2. GDPR Article 9: prohibits the processing of special categories of data except under specific exemptions, including manifest public disclosure by the data subject, which must nevertheless be interpreted restrictively.
    3. GDPR Article 83: provides that violations of these principles can lead to administrative fines up to 4% of the company's total annual worldwide turnover.

  3. What the case law says

    European case law has established a rigorous stance on digital privacy protection. The Court clarified that the minimization principle precludes a social platform from storing and using all personal data obtained for advertising purposes without distinction of nature or temporal limits. According to established orientation, the fact that a user makes sensitive data public does not authorize the controller to reuse it in different contexts or for a duration exceeding the original purpose. Case law has also highlighted that the burden of proof regarding the necessity of processing lies entirely with the controller, who must demonstrate that every data point processed is strictly indispensable for the service offered.

  5. Analysis drafted and verified with edit.legal

    To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

    Try edit.legal AI

  8. What it teaches professionals

    1. Implement data retention procedures providing for the automatic deletion of profiling data after a defined period.
    2. Technically segregate ordinary data flows from those capable of revealing personal orientations or health status, even if obtained from publicly accessible sources.
    3. Advise data controllers to document a specific data protection impact assessment (DPIA) for every advertising campaign utilizing data aggregated from third-party sources.

References: Regolamento UE 2016/679 (GDPR) Art. 5Regolamento UE 2016/679 (GDPR) Art. 9Regolamento UE 2016/679 (GDPR) Art. 82Regolamento UE 2016/679 (GDPR) Art. 83

Related cases

Same caseGDPR as a Tool for Unfair Competition: Professional Standing in Privacy LitigationSame caseLinkedIn Case: Data use for AI training paused following regulatory engagement21/10/2026Joint Sections of the Supreme Court: Credit Splitting and Abuse of Process
Avv. Federico Papa
Editorial oversight: Avv. Federico Papa·ICAMContent drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction

Frequently asked questions

Can a company keep my profiling data indefinitely?

No, the principles of data minimization and storage limitation require that data be deleted when it is no longer strictly necessary for the purposes for which it was collected.

If I declare my political orientation in public, can social media platforms use it for advertising?

Although the data is public, the CJEU clarified that reuse for advertising purposes must still respect the principles of necessity and minimization, preventing any indiscriminate use.

What remedies are available if I receive ads based on sensitive data?

The data subject can exercise the right to object and request the controller to limit processing or delete the data, as well as report the conduct to the Data Protection Authority.

Verified legal research and drafting with edit.legal

Legal research and drafting with citations checked against official databases. edit.legal is free to try, no credit card.

Try edit.legal for free