"Personalised advertising and the use of personal data are prohibited without consent," the court said in a statement.

Meta, the parent company of Facebook and Instagram, must "provide information on all personal data processed" within one month, and may not omit the source, the recipients or the reasons for processing, it added.

Austrian activist and lawyer Max Schrems, a defender of online privacy rights, took Meta to court in 2014, three years after he began trying to obtain full access to his personal data.

Meta, however, only provided him with some of it.

"All of Meta's claims of trade secrets or other limitations were rejected, leading to unprecedented access to the inner workings of Meta," said noyb, a Vienna-based non-profit that seeks to enforce data protection laws.

The case has been brought three times before Austria's supreme court and twice at the European Court of Justice, it added.

"The final and directly enforceable ruling by the Austrian Supreme Court will therefore lead to unprecedented access by Mr Schrems to Meta's practice of processing his (and in reality anyone else's) user data," noyb said on its website.

Schrems was awarded 500 euros ($585) in damages. A final ruling on costs has been reserved but the overall litigation costs so far have exceeded 200,000 euros.

According to his lawyer, Katharina Raabe-Stuppnig, Austrian case law makes it "realistic" that any complainant could potentially obtain that amount in the future.

bg/oaa/phz/rlp

Meta