Microsoft Faces High Court Action Over Alleged Data Misuse for Advertising

In a landmark case, Microsoft Ireland Operations is currently facing a representative action in the High Court of Ireland, stemming from allegations of unlawful personal data processing for advertising purposes. The Irish Council for Civil Liberties (ICCL) initiated the action, claiming that Microsoft's advertising operations, particularly through its Xandr platform, generated approximately $10.2 billion (€8.7 billion) within the nine months ending March 2025.

The ICCL, which advocates for civil liberties and consumer rights, argues that Microsoft’s data handling practices violate the General Data Protection Regulation (GDPR) and Irish law. The organization seeks declarations and orders to compel Microsoft to cease its current data processing methods or to modify them to comply with legal standards.

This case marks a significant development under the newly enacted Protection of the Collective Interests of Consumers Act, which was approved in May 2023. The High Court deemed the ICCL's action admissible as a representative case, setting a precedent for future collective actions concerning consumer rights and data protection.

James Doherty SC, representing the ICCL, successfully applied for the case to be fast-tracked through the Commercial Court, underscoring its importance not only for the parties involved but also for broader consumer rights in the digital age.

Declan McGrath SC, representing Microsoft, did not oppose the admission of the case to the Commercial Court but indicated the need for further clarification regarding the appropriate defendant. McGrath suggested that Xandr, rather than Microsoft itself, should be the defendant in this matter, prompting ongoing discussions about corporate responsibility in data privacy issues.

Johnny Ryan, a senior fellow at the ICCL and director of its privacy and data protection program, emphasized the importance of transparency in Microsoft's operations. He stated that the $10.2 billion revenue figure was disclosed in Microsoft’s 10-Q report to the U.S. Securities and Exchange Commission, which he argues highlights the scale of potential data misuse. Ryan contended that Microsoft’s claims regarding the legality of its data processing practices have not adequately addressed the ICCL's concerns.

The implications of this case extend beyond Microsoft; it raises critical questions about data privacy, corporate accountability, and the enforcement of consumer rights in the digital marketplace. As technological advancements continue to reshape advertising methodologies, the outcome of this case could set significant legal precedents regarding data protection practices in Ireland and potentially influence similar cases globally.

As the case progresses, it remains to be seen how the courts will balance the interests of consumers against the operational needs of large digital corporations like Microsoft. The next court session is scheduled for three weeks from now, allowing time for both parties to prepare their arguments and address the complexities of the case.