Meta pledges to ask EU users for consent before showing behavioural ads

When scrolling through Facebook or Instagram, users are automatically shown ads that the platforms’ algorithms think they’ll be interested in. This system only works thanks to the processing of huge amounts of personal data, which is supposed to increase the number of clicks on an ad. The problem is that, until now, users haven’t been asked for their consent. That could change. In a surprise announcement last Tuesday, Meta made the long overdue promise to finally ask its users for their consent before showing them behavioral ads – at least if they live in the European Union, EEA or Switzerland.

According to Meta, the change is due to a new interpretation of the GDPR by the Irish Data Protection Commission (DPC). Not only does this statement leave open what this supposed new interpretation is all about. It also fails to mention that Meta has been involved in a number of legal disputes over its advertising business in the past five years – resulting in multiple changes to the legal basis for its use of personal in the space of a year.

Open questions about the real impact

The specific impact of this alleged switch to consent remain unclear. Meta has only stated that “the legal basis that we use to process certain data for behavioural advertising” will change from “Legitimate Interests” to “Consent”.

This is the crux of the mater, as the limitation to “certain data for behavioural advertising” and the overall vague wording potentially leaves room for Meta to continue using some personal data without the user’s consent. To be specific: The term “behavioural advertising” is not defined in EU law, so it’s unclear whether the company will interpret a person’s age or location as behavior. Since the GDPR applies to any type of personal data for any type of processing, liming the change only to a subset of processing (“behavioral advertisement”) could possibly spark new litigation from data protection NGOs like noyb.

Two rulings against Meta’s advertising business

Under the GDPR, any company can rely on one of six legal bases to process personal data. For advertising this usually is consent, but Meta has tried to rely on any other option to avoid a yes/no choice for users. Just this year, Meta was hit with a decision from the European Data Protection Board (EDPB), which decided that Meta couldn’t use personal data for advertising based solely on its terms of service. The case was based on complaints filed by EDRi member noyb.

Then, in July, the European Court of Justice agreed with the EDPB’s finding on terms and conditions as a legal basis, but also declared Meta’s approach to rely on so-called “legitimate interests” illegal – clarifying once more that it can’t use personal data beyond what is strictly necessary to provide its core product. All other data processing, including advertising and the sharing of personal data, requires freely given and fair opt-in consent from users. The company still fails to meet theser equirements.

A temporary ban of behavioral advertising

While the Irish DPC has yet to enforce these decisions, the Norwegian data protection authority (DPA) has taken matters in its own hands and temporarily banned behavioral advertising on Facebook and Instagram in Norway. The ban will be in place for at least three months or until the social mediac orporation can prove its compliance with Norwegian law.

Contribution by: Mickey Manakas, PR Manager, EDRi member, noyb