Meta will only be able to serve ads based on personally identifiable information with users’ consent, according to a confidential decision by the EU data protection regulator, a person familiar with the matter told the US social network on Tuesday.
The Irish Data Protection Authority, which oversees Meta because its European headquarters are in Dublin, has been given one month to make a decision based on the European Data Protection Board’s (EDPB) binding decision.
The EDPB is likely to ask the Irish authority to impose fines, the person said, asking not to be named due to the sensitivity of the issue.
Big Tech’s targeted ad model and how data is collected and used has led to regulatory investigations around the world.
The company’s shares fell 6.2 percent during trading during the session. Google, snap and Pinterest that rely on digital advertising fell 2.2 percent, 8 percent, and 4 percent, respectively.
The Irish case on the other hand Meta was triggered in 2018 by a complaint by Austrian data protection activist Max Schrems.
“Instead of having a yes/no option for personalized ads, they just moved the opt-in clause to the terms and conditions. This is not only unfair, but clearly illegal. We are not aware of any other company that has tried to ignore the GDPR so arrogantly,” Schrems said in a statement.
He said the EDPB’s decision meant that Meta would have to allow users to have a version of all apps that doesn’t use personal data for ads, while the company would still be allowed to use non-personal data to personalize ads or simply turn users around to ask for consent.
The 27-country bloc’s landmark data protection regulations known as the General Data Protection Regulation came into effect in 2018.
Meta is working with the Irish body, said a Meta spokesman.
“The GDPR allows for a number of legal bases on which data can be processed that go beyond consent or the performance of a contract. Under the GDPR there is no hierarchy between these legal bases and neither should be considered better than the other,” the spokesperson said.
apples new privacy rules preventing digital advertisers from tracking iPhone Users, too, were a hit for that Facebook Parent.
An EDPB spokeswoman declined to give details of the decisions taken. The agency said it stepped in after other national watchdogs disagreed with the Irish agency’s draft decision.
His draft decisions on Meta’s parents Facebook and Instagram focus on the lawfulness and transparency of processing for behavioral advertising while making their decision on Whatsapp concerns the lawfulness of processing for the purpose of improving services.
“The DPC cannot comment on the content of the decisions at this time. We have one month to adopt the EDPB’s binding decisions and will then publish details,” said the Data Protection Commission of Ireland.
Meta may need to change its business model, said Helena Brown, head of data & privacy at London law firm Addleshaw Goddard.
“The direction seems to be that European regulators will not allow Meta to hide behind the ‘provision of services’ as a basis for using personal data for behavioral advertising,” she said.
“Instead, Meta may need to change its approach to seek clear, explicit consent instead. It will be a challenge for Meta to be able to explain its practices in a way that such consent is lawful and well-informed,” Brown said.
First the Wall Street Journal reported on the EDPB judgment.
© Thomson Reuters 2022
