EU squeezes Meta on personal data use for targeting ads

The European Data Protection Board said Wednesday (1 November) it had adopted a binding decision that will ban Facebook and Instagram owner Meta from using the personal data of users for targeted ads without their explicit consent.

The order closes off the legal basis used by Meta to freely process the personal data of its users in Europe to target ads, a practice that has made the company founded by Mark Zuckerberg one of the world’s most profitable companies.

Instead, Meta will now need clear consent by its users to keep harvesting their data, a new protocol which will also face intense legal scrutiny among privacy activists and European regulators.

The latest order will “impose a ban on the processing of personal data for behavioural advertising on the legal bases of contract and legitimate interest across the entire European Economic Area,” stated the European Data Protection Board (EDPB), the umbrella organisation of national data protection authorities.

Firms like Meta use user data to serve highly targeted ads, and they have struggled to comply with the strict rules of the EU’s 2018 data privacy regulation (GDPR).

In anticipation of the order, Meta said on Monday (30 October) that Facebook and Instagram users in Europe will be able to pay for subscriptions to use the social networks without any advertising from this month.

Meta believes that taking this move to offer subscriptions will assuage EU regulators’ concerns over its data collection and how ads are targeted.

“Meta has already announced that we will give people in the EU and the European Economic Area (EEA) the opportunity to consent and, in November, will offer a subscriptions model to comply with regulatory requirements,” a Meta spokesperson said.

The company said the 30 EDPB members of the EEA (the 27 EU members plus Iceland, Norway and Lichtenstein) have been aware of its consent plan for weeks and that it had been fully engaged with them to arrive at a satisfactory outcome.

“This development unjustifiably ignores that careful and robust regulatory process,” Meta added.

Meta has said an EU court ruled a subscription model is “a valid form of consent for an ads funded service” but prominent online privacy activist Max Schrems slammed this approach of ending tracking only for paid users.

“We would fight this up and down the courts,” Schrems said earlier this month.

High time for compliance

The EDPB said it took the decision following a request from Norway’s data regulator, which earlier this year imposed a ban on sending Facebook and Instagram users targeted advertisements based on their personal data which the social media platform had collected without their explicit consent.

The EDPB decision forces Ireland’s data regulator, the Data Protection Commission, which has authority over Meta’s operations in Europe, to take final measures on the issue within two weeks, with a non-consent ban to enter into force a week later.

The EDPB said Meta was informed Tuesday (31 October) of the decision and that it had indicated it plans to ask for consent to use personal data to target ads that users see when they use the apps.

“The EDPB takes note of Meta’s proposal to rely on a consent-based approach as legal basis” and said this was being evaluated.

Facebook had some 300 million daily users in Europe at the end of 2022, out of about two billion users worldwide, with Europeans generating about a fifth of Meta’s advertising sales.

Losing the ability to target ads may deal a financial blow to Meta if advertisers reduce their spending more than Europeans shell out for an ad-free experience – 9.99 euros a month on the web, or 12.99 euros on mobile phones.

EDPB chairwoman Anu Talus said the decision to impose a ban was taken after Meta was found not to have complied with orders issued at the end of last year.

“It is high time for Meta to bring its processing into compliance and to stop unlawful processing,” she said.

Read more with EURACTIV