O’Carroll v Meta: an objection to ad profiling has to be honoured

UK GDPR gives people an absolute right to object to their data being used for direct marketing, including profiling for it. O’Carroll objected to Meta profiling her for targeted ads. Meta argued that its personalised ads are not direct marketing. The ICO, intervening, took O’Carroll’s side on that point. Meta settled days before the hearing.

These are claims and positions, not findings. The case settled before any court decided them.

• O’Carroll claimed that Meta’s tracking and profiling of her for targeted ads was direct marketing, so she had an unqualified right to make it stop. She brought the claim in 2022, according to TechCrunch.
• Meta denied that its personalised ads were direct marketing, according to the same report.
• The ICO’s summary of its position says UK GDPR applies to online targeted advertising, that advertising directed at particular individuals is direct marketing, and that on the evidence filed O’Carroll had the absolute right to object. The ICO adds that its submissions are not a formal finding that Meta broke the law.

Inth’s technical interpretation: an objection to direct marketing is separate from cookie consent. It can arrive by email, a support form or a settings page, and it has to reach every system that profiles or targets that person, including logged-in ad targeting on the server. A cookie banner choice does not cover it by itself.

1. 2022O’Carroll brings her claim, per TechCrunch
2. March 2025Meta settles shortly before the High Court hearing
3. 22 March 2025ICO statement on the settlement

Meta agreed not to use O’Carroll’s data for targeted advertising. This is an individual settlement: it sets no precedent and Meta did not accept liability. The ICO statement says "online targeted advertising should be considered as direct marketing" and that it will "continue to engage with Meta on this issue".

No sum has been reported. No fine.

The UK regulator’s stated view is that targeted advertising is direct marketing, so anyone who personalises ads needs a working way to object and must act on it. That route sits alongside cookie consent, not inside it.

• Consent banner: on withdrawal it sends the revocation to each integration and stops loading tags not yet loaded.
• Code audit can trace reviewed outbound data flows, which helps find where ad audiences leave your systems.

In-product settings and objections made by email or support are outside the banner. Inth does not process Article 21 objections for you; your own systems must carry them to every ad and profiling route.

In the repository

• Find every audience export and personalisation job, and check each reads a marketing objection flag.

In the browser and network

• Object on a test account, then check whether ad and audience requests still carry that account’s identifiers.

With the people responsible

• Ask how a written objection to marketing reaches the ad stack, and how long it takes.

• ICO statement, 22 March 2025
• Summary of the ICO’s position (PDF)
• TechCrunch, 21 March 2025 (press report; Inth has not seen the court filings)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Meta’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: Meta consent or pay in the UK, Bundeskartellamt v Meta, Meta (EU)