The Court of Justice of the European Union in Case C-252/21 (Meta Platforms v Bundeskartellamt) held that combining personal data across services for advertising requires a valid GDPR legal basis and must satisfy necessity and proportionality standards. The court confirmed competition authorities may consider GDPR compliance in dominance assessments. Scaling SaaS and adtech businesses should reassess data aggregation models, consent architecture, and processor arrangements to reduce regulatory exposure.