What does the Court of Justice of the European Union (CJEU) Advocate General’s opinion in the case of Meta vs. the German Bundeskartellamt tell us regarding the scope of what constitutes “sensitive information,” “contractual necessity” and “consent?” A lot.

“I doubt whether it is relevant (or always possible) to distinguish between the data subject merely being interested in certain information and the data subject belonging to one of the categories covered by the provision in question,” CJEU AG Athanasios Rantos said in the opinion.

Additional interesting points:

• A user does not manifestly make public data revealed by visiting websites and apps or entered into those websites or apps or resulting from clicking on buttons integrated into those websites or apps.
• Processing of personal data from other group services (including Instagram) may be useful or even preferable on occasion to the user, but it is not necessary to provide Facebook service
• The consent for the placement of cookies is not in view of its specific purpose, to be sufficient to justify the processing of sensitive personal data collected by such methods.
• Any dominant position on the market held by a personal data controller operating a social network is a factor when assessing whether users of that network have given their consent freely. The market power of the controller could lead to a clear imbalance.