The encyclopedia · Legal & Compliance · Legal decision · 2018–2024
LinkedIn ran targeted ads on members' data without a valid legal basis — €310M
Consent, contract, legitimate interest — the DPC said none of LinkedIn's three bases held for the behavioural analysis behind its targeted ads.
LinkedIn · 2024-10-24
What happened
On 24 October 2024 Ireland's Data Protection Commission fined LinkedIn €310 million for processing members' personal data for behavioural analysis and targeted advertising without a valid legal basis. The inquiry began in August 2018 from a complaint by the French digital-rights group La Quadrature du Net, filed with France's regulator and routed to the DPC because LinkedIn's EU home is Dublin.
LinkedIn had leaned on three grounds, and the DPC rejected all three: member consent was not freely given, informed, specific or unambiguous; behavioural advertising was not necessary to perform the contract; and LinkedIn's own interests were overridden by members' fundamental rights. The regulator also found transparency failures and processing that violated the fairness principle.
LinkedIn was reprimanded and ordered to bring its processing into compliance, saying it had believed it was compliant but would meet the decision's requirements. Microsoft, which owns LinkedIn, had set aside $425 million in 2023 for potential penalties and indemnifies LinkedIn's Irish entity against the fine. It was the DPC's fifth-largest GDPR fine.
Why it happened
- Stacking three legal bases under one processing activity is not insurance — the regulator tests each one, and losing all three turns a defence into an admission.
- Consent gathered inside a product users do not realistically walk away from is not 'freely given'; the standard is the user's genuine choice, not the presence of a checkbox.
- A complaint filed in any EU country lands with the lead regulator of the company's establishment — LinkedIn's Dublin headquarters moved a French complaint to Irish jurisdiction.
The lesson
A legal basis for data processing is a claim to be demonstrated, not a clause to be drafted — if consent, contract and legitimate interest all fail, the whole ad pipeline is illegal.
Sources
- Irish Data Protection Commission fines LinkedIn Ireland €310 million — DPC
- Microsoft-owned LinkedIn fined €310m by Irish Data Protection Commission — The Irish Times
spotted an error? The club wants to know.
More like this
Amazon's €746M GDPR record fine was scrapped on a technicality
AliExpress got a €550M EU fine — the DSA's first big test landed on Alibaba
Italy fines Replika's maker €5 million over GDPR and children's data
Somewhere, someone solved the problem this company failed at. 2nd Opinion →
Comments · 0
Sign in to join the comments.