Today, noyb filed a complaint against the social media platform Pinterest. Most users probably know it as a visual mood board and use it to find ideas and inspiration. Advertisers, on the other hand, use the platform to push their products on consumers. Unsurprisingly, Pinterest’s business model is also based on personalised advertising and the associated user tracking. The problem: Despite a CJEU ruling prohibiting this practice, the platform uses people’s personal data without asking for their consent. Pinterest falsely claims to have a “legitimate interest” and enables tracking by default. Most other websites have abandoned this legally flawed argument years ago.
Want to use Pinterest? Get ready to be tracked! More than 130 million people in the European Union currently use Pinterest. The image and video-based social media platform allows you to search for all sorts of different topics, be it home decor, food recipes, fashion or travel tips. As with most social media platforms, Pinterest is partly funded by personalised advertising. To do this, the company tracks users - without ever asking for their consent, as required by law. Instead of seeking opt-in consent under Article 6(1)(a) GDPR, it falsely claims to have a “legitimate interest” in processing people’s personal data under Article 6(1)(f) GDPR. Tracking is turned on by default and would require an objection (opt-out) by each user to stop.
Kleanthi Sardeli, data protection lawyer at noyb: “Pinterest is secretly tracking European users without asking for their consent. This allows the social media platform to unlawfully profit from people’s personal data without them ever finding out.”
No information on personalised ads. The complainant only found out about Pinterest’s ad tracking by chance. After using the platform for some time, she checked the “privacy and data” settings and found out that the “ads personalisation” was turned on by default. According to these settings, Pinterest uses information from visited websites and from other third parties to show users personalised ads. In addition, Pinterest tracks on-site activity “to improve the ads about Pinterest you’re shown on other sites or apps.” This practice is clearly unlawful since the introduction of the GDPR in 2018. In its ruling in case C252/21 Bundeskartellamt in 2023, the Court of Justice of the European Union (CJEU) found again that personalised advertising cannot be based on legitimate interest under Article 6(1)(f) GDPR.
Kleanthi Sardeli, data protection lawyer at noyb: “It appears that Pinterest is actively ignoring a European Court of Justice (CJEU) ruling in order to maximise its profits. The CJEU made it clear that personalised advertising cannot be based on legitimate interest.”
Keeping users in the dark. To find out more about the personal data processed by Pinterest, the complainant filed an access request. She received a copy of her data on the same day, but quickly realised that it didn’t include any information about the recipients of her data. Even after two additional requests, Pinterest failed to provide details about the categories of data that were shared with third parties. In other words: Pinterest failed to adequately respond to the access request under Article 15(1)(c) GDPR.
Complaint filed in France. noyb has now filed a complaint with the French data protection authority (CNIL). Pinterest violated Article 6(1) GDPR by processing the complainant’s personal data for personalised advertising on the basis of legitimate interest. Pinterest also violated Article 15(1)(c) GDPR by failing to provide access to the categories of data that were shared with third parties. noyb requests that Pinterest erase the data processed for personalised ads and that the recipients be informed of the erasure. In addition, noyb requests that Pinterest comply with the complainant’s access request. Finally, noyb suggests the CNIL to impose an administrative fine to prevent similar violations in the future.
