In a process that has taken more than four years, the EU has announced that it has finally made a decision on the legality of Meta’s core advertising business in Europe.
But the body won’t tell us what that decision is until next month.
In May 2018, complaints around Meta’s “forced consent” to process users’ personal data appeared, despite GDPR maintaining that users be given a free choice over data processing unless it is strictly necessary for the provision of the service. Meta had been using the personal data to build user profiles for its behavioural advertising model.
The decision could have significant ramifications for Meta’s business model and its bottom line — GDPR breaches can result in fines of up to four per cent of global turnover.
The European Data Protection Board (EDPB), a steering body for GDPR, confirmed it had stepped in with three binding decisions in the three complaints against Meta platforms Facebook, Instagram, and WhatsApp that had been filed by European privacy campaign group, noyb.
However, the EDPB has not disclosed its decision yet as protocol dictates that it must pass its decision back to the Irish Data Protection Commission (IDPC), as Meta’s European operations are based in the Emerald Isle. Once this has happened, the IDPC will issue the final decision.
The Wall Street Journal has reported that Meta’s ad model will face restrictions in the EU.
“The board’s rulings Monday, which haven’t yet been disclosed publicly, don’t directly order Meta to change practices but rather call for Ireland’s Data Protection Commission to issue public orders that reflect its decisions, along with significant fines,” the WSJ wrote, citing anonymous sources familiar with the situation.
The EDPB said in a statement that its binding decision settles ”
the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising, in the cases of Facebook and Instagram, and for service improvement, in the case of WhatsApp.”
As a result, Meta could be forced to ask users in the EU whether they want to be tracked. Currently on Facebook and Instagram, users are asked to be tracked or denied the service.
If Meta is forced to offer users the choice, it would likely turn its business model on its head. Users typically shy away from personalisation of services through ad targeting when given a choice. Currently Apple’s App Tracking Transparency request to track feature has an opt-in rate of around 25 per cent.
Meta could potentially argue that, as the GDPR rules came into force, it switched from claiming consent as the legal basis for behavioural ad processing to declaring it necessary for the performance of a contract. In effect, Meta is saying that Facebook and Instagram users are in a binding deal with Meta to receive targeted adverts.
