Max Schrems had lodged legal cases in an Austrian court on behalf of himself and seven other users in Austria, Germany and India against Facebook's Irish division for various alleged rights violations involving personal data.
Facebook had argued that people can only sue as individual consumers, not as groups.
"Mr Schrems may bring an individual action in Austria against Facebook Ireland," the Luxembourg-based European Court of Justice said in a statement.
"By contrast, as the assignee of other consumers' claims, he cannot benefit from the consumer forum for the purposes of a collective action."
Austria's Supreme Court had referred the matter to the ECJ after Schrems's lawsuit was first thrown out and then restored by the country's courts.
Schrems still hailed it as a victory.
"YAY: @EUCourtPress decides: I can finally sue Facebook in Vienna over Privacy violations!" Schrems said on Twitter.
"However, it limits consumer rights to 'contract partner' only, so no class action. Huge problem for Facebook anyways," he said, adding a winking-smiley-face emoji.
Schrems single-handedly brought down the EU's former "Safe Harbour" data sharing arrangement in 2015 after he sued Facebook in Ireland over the transfer of personal information by Facebook from Europe to the United States.