According to reports, four political parties were reprimanded over targeted Facebook advertising. But microtargeting and the GDPR do not only concern parties; they affect every campaign that selects audiences by interests.
Targeted advertising and its limits
Targeted advertising (like that of the German federal government on Facebook !?) is part of everyday life on social networks. Anyone placing an ad selects age, region and interests. The platform then delivers the ad to matching users. This is convenient and effective. However, it raises questions as soon as interests allow conclusions about very private characteristics.
Microtargeting under the GDPR: the decision and its reasoning
According to reports, the Berlin Commissioner for Data Protection and Freedom of Information has held that four parties acted unlawfully by using political microtargeting in the 2021 German federal election campaign. The parties concerned are the CDU, SPD, Bündnis 90/Die Grünen and Die Linke. The authority issued reprimands and warnings. No fines were imposed, according to the report.
The reports name investigations by the TV show ZDF Magazin Royale from 2021 as the trigger. The editorial team had used a browser extension to collect data on election ads that were running. On this basis, the data protection organisation noyb filed complaints on behalf of affected individuals in March 2023. According to beck-aktuell, the decisions were issued on 24 September 2026. According to noyb, they were only served on the parties in mid-October. Media reported on 21 October 2026.
In substance, the authority is said to have found that the parties processed sensitive data about users' presumed political interests in order to deliver targeted election ads. There was no sufficient legal basis for this, such as explicit consent. That is how the reports describe it.
What is established and what is not
No press release from the authority could be found as of 23 October 2026. So far, the decision is documented through the media and noyb. According to the research, the full reasoning is not public. Several points therefore remain unclear:
- which legal bases the authority relies on in detail,
- what role Meta as a platform plays in the assessment,
- whether and how customer lists (Custom Audiences) or similar audiences (lookalikes) were assessed.
The proceedings against the AfD are still ongoing. Further details on this are not confirmed. In addition, the Berlin decision binds neither other supervisory authorities nor courts. It does, however, show how an authority reasons, and that is a warning sign for every company that advertises on social media.
Targeted advertising is not prohibited under the GDPR when it comes to microtargeting. The point of contention is the processing of political opinions and other specially protected information. That is exactly where the next question comes in.
Art. 9 GDPR: when interests become sensitive data
The General Data Protection Regulation gives special protection to certain information. The technical term is special categories of personal data. These include information on health, religious or philosophical beliefs, political opinions, sexual orientation, ethnic origin and trade union membership, as well as genetic and biometric data. Art. 9 GDPR prohibits their processing in principle and allows only narrow exceptions. For advertising, in practice usually only explicit consent comes into consideration.
A broad view is decisive here. It is not enough that someone explicitly states that they are ill or religious. The Court of Justice of the European Union interprets the term broadly. Its judgment of 1 August 2022 (C-184/20) concerned information from which a sensitive characteristic can only be inferred indirectly. Such inferences can also fall under the special protection.
The judgment of 4 July 2023 (C-252/21) concerned Meta and the German Federal Cartel Office. The Court held that merely visiting websites or apps with a sensitive connection, linked to the user account, can constitute processing of special categories. Moreover, such data is not "manifestly made public" simply because users visit a page. This exception must be interpreted narrowly.
The judgment of 4 October 2024 (C-446/21) concerned Schrems and Meta. A public statement about one's sexual orientation does not permit the use of further data on it for advertising. Data minimisation also applies to advertising.
A yardstick for practice
A rule of thumb can be derived from this line of case law. It is not the label of an audience attribute that decides, but purpose and inference. An interest such as "running" reveals hardly anything sensitive. An interest in an information page about a specific illness is closer to health. Interest in a party or a religious community is closer to political or religious views than interest in "news". The closer the connection, the more likely it is to be sensitive data.
Substitute attributes, known as proxy targeting, are also dangerous. Here, the sensitive category itself is not selected, but a substitute. noyb reports that parties used such proxy attributes in the campaign for the 2025 federal election, for example interest in bands that are popular within a particular political spectrum. Proceeding this way does not solve the problem. What matters is the inference that the selection is meant to enable.
Part of the legal situation has not been conclusively clarified. According to the available sources, it remains open whether interest attributes that Meta derives itself are to be treated as the advertiser's own processing of sensitive data. Whether the authority also assessed attributes derived by Meta in this way is not known. Only presumed political interests are reported.
The problem is not advertising, but the inference about health, beliefs or political views.
How such inferences arise is also shown in the article on personal data: information that can be linked with other information becomes personal data faster than many assume.
Advertising on Facebook: how responsibility is shared with Meta
Anyone advertising on Facebook or Instagram does not act alone. The platform analyses data, builds audiences and delivers the ad. Legally, the concept of joint controllership is central here. It is set out in Art. 26 GDPR. Under it, joint controllers are bodies that jointly determine the purposes and means of processing. They must set out their obligations in an arrangement.
The Court of Justice applied this to social networks early on. In the fan page case (C-210/16, judgment of 5 June 2018), it considered the operator of a fan page to be jointly responsible, because by selecting the audience and configuring the page the operator takes part in determining purpose and means. In the Like button case (C-40/17, judgment of 29 July 2019), it limited responsibility to the phases that the operator actually co-determines.
Guidelines 8/2020 of the European Data Protection Board apply this to the targeting of social media users. According to them, the platform and the advertiser (the "targeter") can be jointly responsible insofar as delivery to an audience is concerned. This does not automatically apply to steps before or after.
What remains with the advertiser
Joint responsibility has two consequences. Meta is not the sole controller to whom every question can be handed off. And the platform's arrangement does not replace your own assessment. The following remain with the advertiser in particular:
- choosing a sound legal basis for your own targeting,
- informing data subjects, for example in the privacy policy,
- documenting decisions,
- in the case of extensive profiling or sensitive connections, considering a data protection impact assessment.
Whether the Berlin authority examined Meta's role, on the other hand, is not known. The complaints were directed against the parties, not against Meta.
For background on data flows to Meta, the blog offers articles on Meta and on tracking.
Which audiences are risky and which remain unproblematic
From a practical point of view, a simple ranking by inference potential is worthwhile. It is a guide, not a legal opinion. Individual cases may differ.
Age, region and language, as well as product-related interests without a connection to sensitive categories, are usually unproblematic. Placement in a matching context, for example next to an article on the topic, also requires no profiling.
Interests with a possible inference need to be checked carefully, for example health topics, beliefs, organisations or media with a clear leaning. This also includes customer lists and similar audiences. For Custom Audiences, two things need to be clarified: whether valid consent exists for uploading the list, and whether membership of the list already reveals something sensitive, for example in the case of patients or members. Remarketing after visits to sensitive subpages also belongs in this group.
Targeting based on presumed health, religion, political opinion, sexual orientation or origin is risky. Lists from sensitive contexts without explicit consent are equally risky.
According to its own announcement, Meta removed detailed targeting options relating to health, ethnicity, political affiliation, religion and sexual orientation from January 2022. This lowers the risk but does not eliminate it. The platform continues to build audiences from behaviour and signals, and automated audiences can contain inferences. The current range of functions of the advertising tools must be checked in the interface itself before every campaign launch.
May companies select Facebook audiences by interests that allow conclusions about health, religion or political views?
Checklist for compliant audiences in advertising campaigns
Marketing, management and data protection can work through the following list together.
- Record the purpose of the campaign and the audience criteria in writing. Only then can it be traced later what was intended.
- Check every criterion for inferences. Would membership reveal something about health, beliefs, political views, sex life, origin or trade union membership?
- Prefer broad, non-sensitive criteria. Proxy attributes are not a workaround.
- Assess the offering itself. If it relates to health, religion or politics, the risk is higher; in that case, consider consent or contextual advertising instead of profiles.
- Only upload your own customer lists with documented, informed consent. Hashing does not replace it.
- Review the joint controllership arrangement with Meta and assign your own obligations, such as information and requests from data subjects.
- For lookalike audiences, check the seed list and do not use lists from sensitive areas.
- Do not send pixel events relating to sensitive subpages such as counselling, diagnosis or religious community to the platform.
- Consider a data protection impact assessment if extensive profiles are built or sensitive connections exist, and document the decision.
- Bind agencies and service providers by contract, introduce an approval process before launch and regularly spot-check audience options.
On the pixel point, a look at your own website helps. The GDPR website check shows which services are loaded when a page is called up and whether the privacy policy reflects this. On the question of when tools require consent, there is also a checklist for website tools. The requirements for valid consent are also described in Recital 32.
Which services does your website load?
Meta Pixel, conversion APIs and other trackers create data flows that must appear in the privacy policy. The website check shows what is actually loaded when the page is called up.
Political advertising: special rules and what follows for others
Additional rules have applied to political online advertising since 10 October 2025. Regulation (EU) 2024/900 governs the transparency and targeting of political advertising. According to guidance from the Berlin authority, targeted political online advertising using personal data is only permitted under strict conditions: the data must be collected directly from the data subjects, explicit consent is required, and profiling using sensitive data is excluded.
According to press reports, Meta has stopped political and social issue advertising in the EU. No primary source for this was found, so the information is given with reservations. This may be relevant for companies and associations with political messages, for example in lobbying or campaigns on social issues. Parties and companies are not the same, but the legal questions on Art. 9, legal basis and responsibility are identical. The consequences in individual cases may differ.
Conclusion and next steps
A sensible first step is an inventory: which campaigns are running, which audience lists have been uploaded, and who approved them? Responsibilities should then be defined, including towards agencies. Where audiences allow sensitive inferences, the selection should be changed or consent documented.
It remains worth watching whether the Berlin authority publishes its reasoning or a press release and how the proceedings against the AfD end. Both have consequences and may sharpen the picture.
For your own website, it is also worth looking at the security of the embedded scripts. The automated web security checks offer a way to make an initial assessment. Anyone selecting interests should always ask what the selection reveals about the people being targeted.
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
