Meta apparently switches to consent for behavioral ads after five years of litigation
After more than five years of extensive litigation by noyb, the German Kartellamt and decisions by the EDPB and CJEU it seems that Meta finally complies with EU privacy laws. The company announced it will ask its users for consent before showing behavioral ads in the future. It is uncelar if Meta fully applies the consent requirement. noyb will follow up with litigation if the GDPR is not fully implemented by Meta.
- Facebook Update of August 1st
- CJEU declares Meta/Facebook’s GDPR approach largely illegal
- EDPB decision prohibiting Meta from using personal data for advertisement
- Report in the Wall Street Journal
Meta might finally buckle. On Tuesday, Meta announced its intention to change the legal basis used "to process certain data for behavioural advertising" for people living in the European Union and Switzerland from "legitimate interest" to "consent". Although we have to wait to see the details, we might finally see some progress in the protection of the user's data privacy. Depending on Meta's implementation of this change, people living in the EU could for the first time gain some control over their data.
No way out. While the social media corporations' PR department talks about a supposedly new GDPR interpretation by the Irish DPC that resulted in the upcoming adaptation, the reality is much more unpleasent for Meta. Following two noyb complaints from 2018, the EDPB decided earlier this year, that it is forbidden to Meta to use personal data for advertising. Furthermore, the CJEU decided in July, that company is not allowed to use personal data beyond what is strictly necessary to provide its core products. Although the Irish DPC hasn't yet enforced these decisions, there seems to be no way out anymore.
Scope of Consent is unclear. Meta has so far only announced that it would switch to consent for "certain data for behavioural advertising". The GDPR does however apply to any type of personal data for any type or processing. The word "behavioural advertisment" is not existent in law. If Meta for example uses the age or location of a person, it is unclear if this would constitue a "behaviour" in the view of Meta and if the consent requirement would be complied with.
Max Schrems: "We will see if Meta is actually applying the consent requirement to all use of personal data for ads. So far they talk about 'highly personalized' or "behavioural' ads and it's unclear what this means. The GDPR covered all types of personalization, also on things like your age, which is not a 'behaviour'. We will obviously continue litigation if Meta will not apply the law fully."
Background: Three legal basis in one year. Under Article 6(1)(a) to (f) of the GDPR, companies may not use personal data, unless they comply with one of six legal basis. After litigation by noyb filed in 2018, Facebook, Instagram and WhatsApp were barred from using Article 6(1)(b) when hiding terms in their contract that allegedly required data usage without consent. After an intervention by the EDPB, this litigation lead to a fine of € 390 million in January. Meta then moved to claim a "legitimate interest" under Article 6(1)(f) with an "opt-out" to justify the harvesting of user data. In litigation brought by the German Cartel Authority ("Bundeskartellamt"), supported by the German Consumer Rights Organization ("VZBV"), the Court of Justice decided that Article 6(1)(f) is also not available. Because the other three legal bases are not available to Meta, the only logical consequence is, that Meta now has to ask for yes/no consent when using personal data for advertisement.
Max Schrems: "After more than five years of litigation, Meta finally comes to the conclusion that it must ask people if its allowed to spy on them for ads. It took litigation by NGOs and a German Authority to get where we are now - while the Irish Regulator has consistently protected Meta."
