The Court of Justice of the European Union (CJEU) delivered a significant judgment in Case C-252/21 concerning Meta Platforms Ireland, the operator of Facebook, and its data processing practices. The ruling clarifies the interplay between competition law and data protection regulations, specifically the General Data Protection Regulation (GDPR).

In this case, the German Federal Cartel Office had prohibited Meta from processing off-Facebook data of users without their consent, arguing that such practices constituted an abuse of Meta's dominant position in the online social network market. The Higher Regional Court in Düsseldorf sought guidance from the CJEU on whether national competition authorities could evaluate compliance with GDPR during their investigations.

The CJEU ruled that while national competition authorities can consider GDPR compliance when assessing abuse of dominance, they do not replace the supervisory authorities responsible for enforcing GDPR. Their role is to determine if the conduct constitutes an abuse under competition law, which may involve examining GDPR compliance.

The Court emphasized the need for cooperation between competition authorities and GDPR supervisory bodies to ensure consistent application of data protection laws. It also noted that the processing of sensitive data, which could reveal personal characteristics, must be carefully scrutinized to ensure compliance with GDPR.

Furthermore, the Court expressed doubts about whether Meta's data processing practices could be justified under GDPR provisions that allow data processing without consent, particularly in relation to personalized advertising. The ruling highlights the importance of user consent and the potential imbalance of power between users and dominant platforms like Meta.