Austria's Supreme Court has ruled that Meta's personalised advertising model is unlawful, the court said on Thursday, requiring the company to provide EU users full access to their personal data within 14 days of a request, in a decision that sets a legal precedent across the bloc.

The ruling orders Meta to disclose not only raw data but also detailed information on its sources, recipients and purposes.

The court found Meta violated the EU's General Data Protection Regulation (GDPR) by collecting user data from third-party apps and websites and processing sensitive information without "specific, informed, unambiguous and freely given" consent for personalised advertising.

"We acknowledge the Court's decision on this long-running matter and are reviewing the ruling," a Meta spokesperson said.

The case was brought by Austrian privacy activist Max Schrems in 2014 and has taken 11 years to resolve, involving three Austrian Supreme Court decisions and two EU Court of Justice rulings.

"It is enforceable throughout the EU by the plaintiff, meaning that, depending on the country of enforcement, non-compliance could result in daily fines or even a prison sentence for the relevant decision-makers at Meta," privacy advocacy group noyb, founded by Schrems, told Reuters.

The court ordered Meta to cease processing sensitive user data, such as political views or health status, dismissing the company's claims that this was not technically feasible. The ruling reinforced previous ones on the use of personal data without explicit consent.

"Platforms like Facebook or Instagram have huge influence, for example via pushing political views on users," Schrems said. "The decision makes clear that Meta must not use such user preferences without explicit consent by each user."

The Meta spokesperson said that the case pertains to practices from over a decade ago, noting improvements to the company's privacy measures, including investments exceeding 8 billion euros.

The Austrian Supreme Court said in its statement that its assessment was based on the situation as it stood in 2020.

The spokesperson said Meta no longer uses sensitive data for ad personalisation and disputes the Court's findings on third-party data.

EU users can now use Facebook and Instagram for free with personalised or less personalised advertising, or subscribe to avoid data usage for ads.

In December, EU antitrust regulators approved Meta's proposal to use less personal data in this pay-or-consent model.

The court awarded Schrems 500 euros ($587) in damages. Noyb stated this figure, set in 2014, predates GDPR enforcement and suggested users today might receive higher compensation.