On July 09, 2025, the Central District Court in Lod certified a class action against Meta Platforms, Inc. (formerly Facebook). The case centers on Meta’s practice of using users’ personal data, including names and profile photos, in advertisements – specifically, in promotional posts shown to users’ friends. Two primary privacy claims underlie the action: first, that valid informed consent was not obtained for such use, constituting a violation of privacy under Israel’s Protection of Privacy Law, 1981 (the “PPL”), particularly Section 2(6), which prohibits the use of a person’s name, image, or likeness for profit without informed consent. Second, the plaintiffs allege that the provision of Meta’s online terms of service which permits the use of a person’s name, image, or likeness for profit is an ‘oppressive provision’ under the Israeli Uniform Contracts Law (“UCL”), and should therefore be voided.
Consent Under the PPL: The court clarified that while the PPL allows for implied consent and does not always require an explicit “opt-in” in all cases, it does require consent to be “informed,” meaning users must be clearly and transparently notified about how their data will be used, in a manner sufficient to allow them to make an informed decision. The court noted that while Meta’s online terms included relevant information about data use, the mechanism by which users consented to those online terms did not adequately reflect the privacy implications of the consent; users were presented with a general statement linking to the online terms, which they were asked to approve without any indication that such online terms affect a user’s privacy rights.
Oppressive Provision under the UCL: Under the Israeli Uniform Contracts Law (UCL), courts may deem a provision that unfairly disadvantages one party in a uniform contract, such as online terms, an “oppressive provision,” and may subsequently void it. This framework is intended to protect individuals from being bound by provisions they had no real opportunity to negotiate or fully understand. Plaintiffs argued that certain terms in Meta’s online terms should be deemed unenforceable under the UCL. Meta argued that the relevant provisions are not oppressive or unconscionable (and should not be voided) since users had the ability to opt-out of such arrangement. However, plaintiffs argued that the online terms did not clearly disclose that users have an option to manually opt-out of such use through user settings. The court noted that the opt-out option may be relevant in determining whether such provision is oppressive or not. However, for the opt-out option to be effective, users must be clearly informed of their ability to exercise it by modifying their preferences. Therefore, a technical opt-out option alone is unlikely to suffice in curing the oppressive nature of the arrangement in this case.
Implications for Companies Processing Personal Data
This decision is an example of judicial attention to privacy rights where users of online platforms grant consent to the use of their data by means of accepting terms of use and privacy policies, and represents a proactive judicial approach to evaluating consent mechanisms. Key takeaways include:
- Transparency: Privacy notices should clearly disclose all intended uses of personal data, and particularly any ad-related, commercial, or for-profit use, and consent and opt-out mechanisms, including the language used to solicit consent, should be designed to enable users to clearly understand the privacy implications of their choices in a simple and clear manner. Depending on the nature of the data and use, companies should consider adopting a separate notice and/or opt-in consent, which may be required in certain cases, particularly where the processing is excessive or involves sensitive information.
- Uniform Contracts: Clauses in uniform contracts that broadly revoke or limit rights granted by law, including dispositive rights, may give rise to a presumption of unfairness under Israeli law, and may therefore be unenforceable. This has implications for companies relying on contracts of adhesion, such as click-through terms: representations or waivers embedded in lengthy legal texts may be insufficient where users’ interests are materially affected; notification and opt-out mechanisms should be tailored to the specific context, and provided in a clear and accessible manner.
- Ongoing Compliance: Companies should regularly review and update their privacy notices, consent flows, and user interfaces to remain aligned with evolving privacy standards. Global organizations should also ensure their legal documents – especially user-facing materials – are adapted to local laws and reflect legislative and case law developments. Ongoing review is key to closing compliance gaps and reducing enforcement risks.
This publication is provided as a service to our clients and colleagues, with explicit clarification that each specific case requires individual examination and discussion in writing.
The information presented here is of a general nature and is not intended to answer the unique circumstances of any individual or entity. Although we strive to provide accurate and available information, we cannot guarantee the accuracy of the information on the day it is received, nor that the information will continue to be accurate in the future. Do not act on the information presented without appropriate professional advice after a comprehensive and thorough examination of the specific situation
