General Data Protection Regulation

O’Carroll specifically argued that Meta breached Article 21 of the UK General Data Protection Regulation (GDPR), which gives individuals an unqualified right to object to the processing of their data for direct marketing.

While Meta denied that its personalised advertising constituted direct advertising, the Information Commissioner’s Office (ICO) intervened in the litigation in support of O’Carroll’s case, stating that online targeted advertising should be considered direct marketing.

In a statement on the case, an ICO spokesperson said: “Organisations must respect people’s choices about how their data is used. This means giving users a clear way to opt out of their data being used in this way. If people believe that an organisation is not complying with their request to stop processing their data, they can file a complaint to us. We will continue to engage with Meta on this issue.”

Alexander Lawrence-Archer – one of the solicitors in the legal team at AWO who represented O’Carroll – said: “Whilst the legal issues in the case were not adjudicated by the court due to the last-minute settlement, the ICO made a rare intervention. The ICO has publicised the thrust of that intervention, which is consistent with what Tanya argued in the case: that the GDPR right to object applies to Meta’s processing for targeting advertisements to its users.”

While the settlement means the court has not made a formal decision on the matter, O’Carroll and AWO believe the situation could set a precedent for future legal cases against surveillance advertising online, and push a potential change in company policy in the UK.

Speaking with Computer Weekly, AWO added: “The ICO even went further, indicating that if other people were to use the right, the regulator would back them up. So, whilst the case didn’t go to court, the regulator’s intervention met Tanya’s second objective: people should now feel confident that they too can use the right to object in the GDPR to get more control over their data.”

Human rights and privacy online linked

The case also demonstrates that human rights and privacy online are fundamentally linked.

“We should not have to trade away our privacy to access essential online services,” said Jim Killock, executive director of Open Rights Group. “The real solution is to break down the monopoly of walled gardens.”

In partnership with legal experts at AWO, the Good Law Project has created a tool to send automated requests to Meta’s data protection officer, which people can use to demand it stops using their personal data for targeted advertising.

O’Carroll believes her victory could lead to greater accountability from Big Tech and help win back our right to digital privacy: “When one company controls how we connect, communicate and get our news, we’re left with no real choice. Meta acts like a public square but manages to dodge public accountability. It’s time for a fairer internet – where privacy is a right, not a price we’re forced to pay.”

Meta said that despite the settlement, it still “fundamentally” disagreed with O’Carroll’s claims, arguing that “no business can be mandated to give away its services for free”.

A spokesperson added: “Facebook and Instagram cost a significant amount of money to build and maintain, and these services are free for British consumers because of personalised advertising.

“Our services support British jobs and economic growth by connecting businesses with the people most likely to buy their products, while enabling universal access to online services regardless of income,” they said. “We will continue to defend its value while upholding user choice and privacy.”

Following a similar 2023 ruling in the European Court of Justice, Meta began offering a “pay or consent” subscription service model in the European Union, where users can pay monthly so they do not receive ads on the platform.

The Meta spokesperson said the company was “exploring the option” of offering a similar service to UK users and would “share further information in due course”.

The settlement also comes amid increased scrutiny of Meta’s surveillance-based business model.

In March 2025, a memoir published by former Facebook executive Sarah Wynn-Williams – titled Carless people – alleged that Meta allowed advertisers to target vulnerable people based on them feeling “worthless”, “anxious” or “insecure”.

However, the company has denied the claim, saying it has never offered tools to target people based on their emotional state.