Since the beginning of November, Instagram and Facebook users who don’t want to be tracked have to pay a “privacy fee” of up to € 251.88 per year. While one (free) click is enough to consent to being tracked, users can only withdraw their consent by going through the complicated process of switching to a paid subscription. This is illegal, as the GDPR clearly states that withdrawing your consent must be “as easy as” giving it. In addition to a previous noyb complaint relating to the consent phase of the “pay or okay” system, noyb has filed an additional complaint with the Austrian data protection authority today to take into account the withdrawal situation.
- Complaint against Meta on the withdrawal issue (EN)
- Previous complaint relating to the consent phase (EN – Machine translation)
Meta’s latest attempt to circumvent EU privacy laws. It has merely been six months since the European Court of Justice (CJEU) ruled that Meta’s handling of user data was illegal. Yet the social media giant has launched its third attempt to circumvent European privacy laws. Instead of asking users for their consent, Meta is now charging people for choosing a privacy-friendly setting. As of the beginning of November 2023, it costs up to €251.88 a year to maintain your fundamental right to data protection on Facebook and Instagram. Users who don’t want to pay will have to accept being tracked for targeted advertising. noyb has already filed a complaint against this approach in November 2023.
Expensive withdrawal of consent. But Meta’s seriously flawed approach to free consent isn’t the only issue at hand. Once users have consented to being tracked, there’s no easy way to withdraw it at a later date. This is illegal. Despite Article 7 of the GDPR clearly stating that “it shall be as easy to withdraw as to give consent”, the only option to “withdraw” the (one-click) consent, is to buy a € 251.88 subscription. In addition, the complainant had to navigate through several windows and banners to find the page where he could actually revoke consent.
Massimiliano Gelmi, data protection lawyer at noyb: “The law is clear, withdrawing consent must be as easy as giving it in the first place. It is painfully obvious that paying € 251,88 per year to withdraw consent is not as easy as clicking an “Okay” button to accept the tracking.”
Clear violation. The European Data Protection Board (EDPB) even mention monetary costs as an example of a burden that is incompatible with the principle of Article 7 GDPR in its guidelines, making it clear that Meta is making the withdrawal of consent not nearly as easy as to give consent.
Complaint filed in Austria. noyb has now filed a complaint with the Austrian data protection authority (DSB) on behalf of one complainant. The authority should order Meta to bring its processing operations in compliance with European data protection law and to provide users with an easy way to withdraw their consent – without having to pay a fee. In addition, noyb suggests that the authorities should impose a fine to prevent further violations of the GDPR. The case will likely be forwarded by the Austrian DSB to the Irish DPC, who is the “lead authority” for Meta in the EU.
