Austria's Supreme Court ruled Thursday that Meta’s personalized advertising model is illegal.

The ruling will set legal precedent across the European Union and mandates that the social media giant provide users in the bloc access to their personal data within two weeks of requesting it.

The court ruled Meta must share a detailed account of the data it collects, the court said, including information about sources, recipients and purposes for which it was used. The ruling follows an 11-year legal battle between Meta and Austrian privacy advocate Max Schrems, who leads the data rights nonprofit None of Your Business (noyb).

By gathering user data from third parties and processing sensitive information without "specific, informed, unambiguous and freely given" consent for personalized advertising, Meta flouted the bloc’s General Data Protection Regulation (GDPR), the court said.

 “Platforms like Facebook or Instagram have huge influence, for example via pushing political views on users,” Schrems said in a statement. “It was always absurd for Meta to claim that it does not process such data and must not comply with the law.” 

“The decision makes clear that Meta must not use such user preferences without explicit consent by each user.”

Meta had argued that it was “entitled” to use individuals’ personal data for ad personalization, aggregation and analysis without user consent because such processing was “necessary for providing its services,” the court said in a press release.

A Meta spokesperson said the company is reviewing the ruling.

The Austrian Supreme Court said its ruling was based on Meta’s practices in 2020.

The company has introduced new tools since the case originated in 2014, and at this point everyone in the EU can choose to opt out of seeing personalized ads, a spokesperson said. Users can also choose to not have their data used for advertising by paying a subscription fee, the spokesperson said.

The company has also made several improvements to its data access tools since 2014, the spokesperson said, and users can now access, download or delete their data.

Schrems was awarded €500 ($587) in damages for Meta’s delay in providing him access to his data and how it was processed. Users today could likely be paid more, noyb said in a press release, because the amount Schrems was awarded was based on a standard set before the GDPR took effect.