Is the world’s toughest privacy law tough enough to truly tackle Facebook?

That question may get an answer soon-ish, after Europe’s top court was asked to weigh in on Facebook’s tactics in handling the notorious General Data Protection Regulation, or GDPR.

As is usually true in Facebook’s European travails, its nemesis here is the Austrian lawyer-activist Max Schrems. This case is separate from the long-running one in which Schrems is trying to stop Facebook sending Europeans’ data to the U.S. (that’s the case that sunk the U.S.-EU Safe Harbor and Privacy Shield data-sharing deals, which are yet to be replaced with something legally waterproof.) This time round, it’s all about the legal basis Facebook has chosen to process people’s personal data in the EU.

Before the GDPR was introduced in 2018, Facebook said its users were “consenting” to having their data used for personalized ad-targeting. But the new law introduced stricter standards for what “consent” means and implies—people can withdraw their consent at any time—so Facebook switched to saying the consent clauses in its user agreements are instead contracts in which its users order personalized advertising.

Under the GDPR, personal data can be processed if doing so is necessary for fulfilling a contract. However, the conditions for using this reason are pretty narrow. The EU’s privacy regulators have advised that the “contractual” basis for processing is fair enough if, for example, an online retailer needs to process billing addresses for payment purposes—but not if they want to profile their users’ tastes, because that isn’t strictly necessary for executing the sale.

Schrems has been fighting against Facebook’s switch for years in Austria, and now the Austrian Supreme Court has asked the Court of Justice of the EU (CJEU, the court that killed Safe Harbor and Privacy Shield) to say whether Facebook’s switch is kosher or an illegal attempt to undermine the GDPR’s protections.

“The CJEU has two options,” Schrems tells me, “To say that an obvious trick to bypass the law is cool or to say that’s BS.”

If the court rules in his favor, he says, “Facebook would have to allow users to choose if they can use data for advertisements, and what data.” But if the court rules that Facebook is in the right, the GDPR’s privacy protections would effectively be weakened.

“We are committed to the principles of GDPR and have made major changes to our business as part of our ongoing efforts to give users meaningful transparency and control over their data,” says a Facebook spokesperson.

Expect a ruling in the next 18 months or so. The implications for the GDPR and the online economy are pretty serious.

More news below—and do lend your ears to the latest episode of Leadership Next (Apple/Spotify), in which Alan and Ellen McGirt chat with Engine No. 1’s Chris James about the board shakeup at Exxon, with Katherine Dunn giving some valuable insight into the proxy battle. Also, good luck to Jeff Bezos as he blasts off to the edge of space this morning.

David Meyer
@superglaze
david.meyer@fortune.com

TOP NEWS

Delta havoc

The spread of the coronavirus's Delta variant hit markets yesterday, as Wall Street responded to fears of a "pandemic of the unvaccinated" (the phrasing of CDC Director Rochelle Walensky.) The Dow dropped 2.1%, making for its worst day this year. However, while Asian markets are also in the red today, European markets have rebounded somewhat. Fortune

China blame

The U.S., the EU and other allies have blamed the Chinese government for a series of cyberattacks against public and private entities, notably Microsoft Exchange. So, more tensions between China and the West. China is claiming this is all a "malicious smear." Fortune

Opioid settlement

A long-awaited $26 billion settlement between states and drug distributors (AmerisourceBergen, Cardinal Health and McKesson) and manufacturer J&J, regarding the U.S.'s opioid epidemic, may be outlined this week. Meanwhile, the distributors have reportedly reached a separate $1 billion settlement with New York. Wall Street Journal

Ben & Jerry's

Ben & Jerry's has become one of the highest-profile brands to shun the Israeli-occupied West Bank and contested east Jerusalem. The move by the Vermont company, owned these days by Unilever, is a rebuke to Israeli settlements on occupied territory; it said selling its ice cream there would be "inconsistent with our values." Fortune

AROUND THE WATER COOLER

Emissions prediction

The International Energy Agency reckons carbon dioxide emissions will hit record levels a couple years from now, then keep growing. IEA: "The sums of money, both public and private, being mobilized worldwide by recovery plans fall well short of what is needed to reach international climate goals." Fortune

Gender split

In the U.K., the Delta variant is hitting young people and men particularly hard. Deutsche Bank analysts say this "strongly hints at the impact of millions of football fans watching the Euro football final." Fortune

Olympic jitters

An increasing number of Japanese companies are declining to send their executives to Friday's opening ceremony for the Tokyo Games, which will be held sans spectators. Meanwhile, one of the composers for the opening ceremony, Keigo Oyamada (better known as Cornelius), has quit because he bullied classmates with disabilities when in school, then boasted about it in interviews in the 1990s. Bloomberg

Dogecoin spray

If the phrase "48-hour crypto scent with a dank musk" sounds appealing, you must be a Dogecoin fan, in which case congratulations, Axe has the fragrance for you. It's free, understandably. Fortune

This edition of CEO Daily was edited by David Meyer.