Will GDPR’s Win Against Facebook Change Advertising?
We’ve just written about the mounting problems for Facebook and its parent company Meta. And to that list of issues can be added another one, potentially the biggest so far, since it goes to the heart of the business model used by Meta for Facebook, Instagram and WhatsApp: micro-targeted advertising based on constant online surveillance.
An unconfirmed report in the Wall Street Journal drawing on “people familiar with the decision” says that EU privacy regulators have ruled that Meta cannot force users to agree to personalized ads as part of its terms of service. Instead, users must give their explicit consent to being tracked for the purposes of advertising. If they don’t, they can’t be blocked from using the service.
Facebook Tried to Bypass the GDPR
This long-running saga goes back to the very start of the GDPR era, in May 2018. As PIA wrote back then, just six minutes after the enforcement of the EU’s GDPR began, the privacy activist Max Schrems filed four complaints, against Google, Facebook, WhatsApp and Instagram, over the issue of “forced consent” to online tracking.
The Irish Data Protection Commission (DPC) drafted a response to the complaint, since Facebook/Meta has its EU headquarters in Ireland. In October 2021, the DPC supported Facebook’s attempt to make surveillance part of the contract between the company and users, which allowed Facebook to bypass GDPR requirements for consent.
However, other data protection authorities in the EU disagreed, and jointly issued guidelines that such a bypass of the GDPR is illegal and must be treated as consent. The DPC said that is was “not persuaded” by this view of its colleagues.
The GDPR foresaw this situation of disagreement by EU data protection authorities, and in Article 65 of the legislation laid down a dispute resolution process. It requires the European Data Protection Board (EDPB) to adjudicate the issue. As the FAQ explains: “The decision is adopted by a two-thirds majority of the members of the Board, and in case a decision cannot be adopted within 2 months, the decision is adopted within the next 2 weeks by a simple majority.”
Facebook’s Future Is Decided
The EDPB has now adopted three dispute resolution decisions concerning Meta’s three platforms. However, it has not yet made those public. First, the DPC must make its final rulings, on the basis of the EDPB’s binding decisions. It must do this within a month, which means that the details will probably be released sometime in January next year.
Even Max Schrems must wait until then to find out exactly what the EDPB has ruled. Fortunately, the Wall Street Journal’s story contains enough details for him to comment on the likely implications of this ruling:
- Substantial fine expected. In addition to an overall stop of personalized ads, the EDPB has insisted on a massive fine for Meta, according to the WSJ. After all, the company has based most commercial data processing on a legal basis that was clearly ruled out by the EDPB in explicit Guidelines in 2019, leading to clearly intentional violations of the law. Meta has already been hit with more than € 1 billion in GDPR fines so far and has to pay this fine to the Irish state.
- No personalized ads, perhaps the most important outcome. The decision means that Meta must allow users to have a version of all apps that does not use personal data for ads. The decision would still allow Meta to use non-personal data (such as the content of a story) to personalize ads or to ask users for consent to ads via a yes/no option.
Users must be able to withdraw consent at any time and Meta may not limit the service. While this will limit Meta’s profits dramatically in the EU, it would not fully prohibit ads. Instead the decision will put the company on the same level as other websites or apps that need to provide a yes/no option to users.
A lawyer himself, Schrems notes that Meta can appeal against the decision, but that:
the chances to win such an appeal are minimal after an EDPB decision. There is also two similar cases before the Court of Justice of the EU (CJEU) on Meta’s consent bypass that may settle the issue and all appeals for good. Users may also take action over the illegal use of their data for the past 4.5 years.
The requirement to allow users to have a version of the service that does not gather personal data for the purpose of advertising will presumably apply to many larger online services that are offered in the EU, not just Meta’s. It could dramatically re-shape the advertising landscape there.
According to one 2021 study, 96% of US users running Apple’s IOS 14.5 opted out of tracking by apps, a possibility introduced by Apple with its operating system from that version. Research carried out a year after the release of IOS 14.5 found greater levels of acceptance, with around three-quarters of users opting out of tracking.
Will Meta Finally Give Users the Power to Decide?
Even the higher level of opt-in would require a massive shift towards contextual advertising by most sites. Some examples of what that looks like can be seen in a couple of articles explaining how it works, and why it is better than the more intrusive kind. An interesting post on the IBM Watson Advertising site points out that advances in AI means that contextual advertising is getting better thanks to more intelligent page content analysis, which should ease the transition away from the non-contextual systems employed today.
The EU’s GDPR has already set the standard for privacy legislation around the world. In the same way, the latest ruling by the EDPB, if confirmed, is likely to accelerate the move away from intrusive, behavioral advertising based on surveillance towards the more respectful but still effective contextual kind. Although that will begin in the EU, it is likely to spread globally as more people demand an end to non-stop surveillance when they go online.
Featured image created with Stable Diffusion.
