CJEU, Judgment of 4 July 2023, C-252/21, Meta Platforms/Bundeskartellamt
Landmark decision on Article 6(1)(b) and (f) GDPR in the online context: "objectively indispensable" rather than merely "useful"; interaction with Article 9 GDPR.
1 Overview
The decision is to date the most important concretization of the statutory grounds for lawful processing in Article 6 GDPR in the online context. It arose out of a prohibition decision under competition law issued by the German Federal Cartel Office (Bundeskartellamt) against Meta concerning the combination of user data from Facebook and other sources. The CJEU clarified the interaction between data protection and competition law and at the same time set out the requirements of Article 6 GDPR in greater detail.
Reference: CJEU, judgment of 4 July 2023, C-252/21, Meta Platforms and Others/Bundeskartellamt
2 Necessity under Article 6(1)(b) GDPR
The Court markedly tightens the necessity criterion. Processing is necessary "for the performance of a contract" only where it is "objectively indispensable" in order to achieve a purpose that forms an integral part of the contractual service. It is not sufficient that the processing is "of use" to the controller or that it improves the service.
Specifically, the Court holds that the personalization of content and the consistent, seamless use of the various services within the group are precisely not objectively indispensable.
3 Necessity under Article 6(1)(f) GDPR
In the context of the balancing of interests, too, necessity is to be interpreted narrowly. The processing must remain within the limits of what is "strictly necessary". The Court emphasizes that, although advertising and other economic interests may constitute legitimate interests, the balancing exercise frequently comes out against the controller in view of the intensity of the interference involved in combining data across services.
4 Interaction with Article 9 GDPR
The Court makes clear that the grounds for lawful processing in Article 6(1) GDPR do not suffice for special categories under Article 9(1) GDPR. In addition, an exception under Article 9(2) GDPR is required. The two provisions must be examined cumulatively.
5 Significance
The Meta decision has far-reaching consequences for the online economy. Advertising-based business models that have hitherto been based on Article 6(1)(b) GDPR are, on this case law, as a rule no longer tenable. The decision calls either for consent or for a careful assessment under point (f).
About the author
About the author
This article was written by Dr. Thomas Helbing, specialist lawyer for IT law in Munich.
Since 2020 and continuously through today (2026), Handelsblatt has recognized Dr. Helbing as one of "Germany's Best Lawyers" in IT law and data protection law.
According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the leading lawyers for data protection and IT law and is listed among the top 100 lawyers in Germany (2024/25). Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has many years of advisory experience in data protection and IT law and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.
His professional background covers the full spectrum of IT and technology law practice. He began his career at a major international law firm, then gained in-house experience at a DAX-listed company, and is himself an entrepreneur and founder of several digital ventures. He also has hands-on programming experience, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.
For many years, his clients have included technology companies and SaaS providers, leading German research institutions and a systemically important German bank. His advisory focus lies in particular on GDPR compliance, the data economy, SaaS, AI regulation and IT contract law.
CJEU, Judgment of 1 August 2022, C-184/20, Vyriausioji tarnybinės etikos komisija
Exhaustive character of Article 6(1) GDPR; publication of declarations of interests on the internet; scope of the special categories under Article 9 GDPR.
CJEU, Judgment of 30 March 2023, C-34/21, Hauptpersonalrat der Lehrerinnen und Lehrer
Limits of specific national rules on employee data protection: requirements for § 23 of the Hesse Data Protection and Freedom of Information Act (HDSIG) and § 26 of the German Federal Data Protection Act (BDSG) measured against Article 88 GDPR.