Meta faces mega fine as ad policy is declared illegal

facebookMeta is facing a major threat to its advertising model – as well as a mega fine – after European Union privacy regulators have ruled that its current practice of using terms and conditions to bypass opt-outs of targeted ads, is in breach of GDPR.

The issue was first raised by privacy organisation NYOB – set up by Austrian lawyer and long-term Facebook nemesis Max Schrems – back in 2018, just days after GDPR came into force.

The complaints claimed that all Meta’s platforms – Facebook, Instagram and WhatsApp – use a strategy of “forced consent” to process users’ personal data — when in fact the law requires that users be given a free choice unless a consent is strictly necessary for provision of the service.

At the time Schrems said: “Facebook has even blocked accounts of users who have not given consent. In the end users only had the choice to delete the account or hit the agree button – that’s not a free choice, it more reminds of a North Korean election process.”

The Irish Data Protection Commission – which governs Meta in Europe – initially ruled that the practice did not breach GDPR, but, now, according to the Wall Street Journal, the European Data Protection Board has over-ruled this decision.

The board has not ordered Meta to change its practices, however, but has demanded that the Irish DPC issues public orders that reflect the EDPB’s decisions, along with “significant fines”.

The regulator has been given 30 days to act. At the end of November, the Irish DPC issued a fourth fine – of €265m (£210m) – against Meta, bringing the regulator’s total penalties against the social media giant to €912m (£786m) in just over 12 months.

In response to the EDPB move, Max Schrems said: “Instead of having a yes/no option for personalised ads, [Meta] just moved the consent clause in the terms and conditions. This is not just unfair but clearly illegal. We are not aware of any other company that has tried to ignore the GDPR in such an arrogant way.

“This case is about a simple legal question. Despite the slow procedure, we are happy about the EDPB decision after all.”

According to NOYB, the decision means that Meta must allow users to have a version of all the apps that does not use personal data for ads. The decision would still allow Meta to use non-personal data (such as the content of a story) to personalise ads or to ask users for consent to ads via a yes/no option.

Even so, users must be able to withdraw consent at any time and Meta may not limit the service. While this will limit Meta’s profits dramatically in the EU, it would not fully prohibit ads. Instead the decision will put Meta on the same level as other websites or apps, that need to provide a yes/no option to users.

Schrems added: “This is a huge blow to Meta’s profits in the EU. People now need to be asked if they want their data to be used for ads or not. They must have a ‘yes or no’ answer and can change their mind at any time. The decision also ensures a level playing field with other advertisers that also need to get opt-in consent.”

A Meta spokesman said: “This is not the final decision and it is too early to speculate. We’ve engaged fully with the DPC on their inquiries and will continue to engage with them as they finalise their decision.”

Meta is also being challenged in the High Court in London over how it collects users’ personal profiling data to target ads without offering an opt-out.

Technology and human rights campaigner Tanya O’Carroll insists the company is breaching data protection law – currently the UK GDPR – because it will not let her stop the user profiling it uses to sell ads.

O’Carroll said she did not object to being advertised to and is not seeking damages, but wants the chance to opt out. She added: “What I really want in this case with the right to object is just choice.”

Related stories
Meta faces High Court action to block data profiling
Privacy group vows to ensure that WhatsApp coughs up
Irish up WhatsApp fine 350% to €225m after EDPB call
Irish GDPR investigations ‘hampered by ancient tech’
Decision Marketing at 10: How GDPR changed the world
GDPR three years on: ‘The aperitif to a cookieless world’
GDPR zero hour: Now the hard work begins say experts
Let battle commence: first GDPR complaints are filed