X (Twitter) violates GDPR and Digital Services Act: Illegal micro-targeting for political advertising

In September, data protection organization noyb filed a data protection complaint against the EU Commission about an advertising campaign on X, formerly Twitter, that aimed to promote a controversial chat control measure, i.e. a proposal to monitor all chats and messenger services in the name of the supposed welfare of children.  

However, the EU Commission made the mistake of showing the advertising to certain users only.  The users in question were selected using so-called micro-targeting, which involves targeting people based on specific user data such as religious or political beliefs. However, the use of personal data for micro-targeting is prohibited under the GDPR, which is why noyb filed a complaint against the EU Commission.

Now, the data protection organization is going one step further and filing another complaint against the social media platform. The argument: The EU Commission's illegal actions were made possible by the online platform because X collects and stores user data such as political views and religious beliefs, which are then available for evaluation by third parties. In its guidelines, X prohibits the use of user data for micro-targeting, but does not appear to be enforcing this ban and obviously does not monitor advertising campaigns placed on its platform. In view of the seriousness of the infringement, noyb is proposing that the data protection authorities impose a fine.