Supreme Court permits Ireland's inaugural collective lawsuit
Microsoft Faces Legal Scrutiny Over Online Ad Practices in EU First
Published on 27th May 2025
The US technology giant Microsoft is facing potential legal consequences due to its online advertising practices in Europe following the approval of a class action lawsuit by the Irish Council for Civil Liberties (ICCL). This lawsuit, the first of its kind under the EU Collective Redress Directive, was announced on Monday, 26th May, by the ICCL.
The landmark legal action targets Microsoft's online advertising methods, notably its real-time bidding (RTB) system, which is accused of being a significant data breach in violation of the EU General Data Protection Regulation (GDPR). The complaint alleges that Microsoft's RTB system jeopardizes European security, and, in doing so, potentially leaves users vulnerable to harmful discrimination and profiling.
The ICCL, recognizing that the unauthorized dissemination of sensitive data poses a considerable risk to privacy and security, has taken the initiative to act on behalf of affected Irish consumers. The lawsuit will encompass users of Microsoft products such as Windows, Xbox, various web-based Office products, the pre-installed Windows web browser Edge, as well as websites and apps utilizing Microsoft's Xandr advertising technology.
Investigations led by the ICCL's Enforce unit revealed that the RTB system broadcasts extraordinarily sensitive data, including personal financial information, gambling habits, and, in some cases, whether a person works in a sensitive national security role. The data, in turn, is described as a "black hole of data" accessible to any malicious actor, thereby representing a massive data breach involving millions of people's information.
Microsoft has thus far been notified of the lawsuit but has not yet publicly commented on the matter. This legal action comes at a critical juncture as Ireland houses Microsoft's European headquarters, which could potentially impact the company's operations across the European Economic Area (EEA).
The Irish Council for Civil Liberties aims to set a precedent for stricter enforcement of data protection laws in Europe, and this lawsuit represents a significant step forward in their pursuit. If successful, it could pave the way for further legal actions against tech giants operating in the EU.
Microsoft's online advertising methods, particularly its real-time bidding (RTB) system, are at the center of a legal action by the Irish Council for Civil Liberties (ICCL), due to allegations of violating the EU General Data Protection Regulation (GDPR) and posing a risk to European security and user privacy. This lawsuit could set a precedent for stricter enforcement of data protection laws in Europe, potentially impacting technology giants operating within the EU.
