Meta must grant EU users full access to their data
Austria’s Der Standard reports that Meta, the parent company of both Facebook and Instagram, must grant European Union users full access to all their personal data within 14 days. The Austrian Supreme Court (OGH) ruled so on Thursday 19th December, according to the Vienna-Based data protection organisation noyb. The lawsuit was filed in 2014 by noyb founder Max Schrems.
Schrems, an Austrian lawyer and data protection activist, started attempting to gain full access to his personal data stored by Meta in 2011. According to a press release from noyb, the company merely referred those affected to a “download tool” and its general privacy policy.
14 days term
According to a press release from the data protection authorities, the OGH has now ruled that Meta must disclose all personal data and provide information about this data, such as the source, recipients and purpose of the processing, within 14 days – i.e. by 31st December 2025.
The court also found that Meta had unlawfully collected data from third-party apps and websites, according to a press release. Personalised advertising may only be shown with the explicit consent of the individuals concerned. Meta must also ensure that sensitive data is not processed together with other data.
The case was heard three times before the OGH and twice before the European Court of Justice over the past eleven years. Schrems has been awarded €500 in compensation.
Situation has changed
Meta has told Reuters that it had taken note of the ruling. However, it referred to the situation as it existed at the time the lawsuit was filed. Meta stated that it no longer uses sensitive data for personalised advertising. EU users can now also use Facebook and Instagram for free with personalised or less personalised advertising or pay a subscription to prevent their data from being used for advertising purposes.
In December 2025 the EU competition authorities approved Meta’s proposal to use less personal data under this pay-or-consent model.