Meta Offers Ad-Free Subscriptions in EU, but Is Banned from Using Behavioral Advertising without Consent

One of the most important and longest-running privacy battles has been taking place over Meta’s use of behavioral ads on Facebook and Instagram. As we shared back in August, the end seems to be close for surveillance advertising in the EU, with Meta announcing that it will seek user consent for behavioral ads.

A big question remained: how did Meta intend to do this? It has just announced a no-ad subscription option in Europe. Meta will offer people in the EU, EEA, and Switzerland the option to pay a monthly subscription to use Facebook and Instagram without any ads. Alternatively, people in these countries can continue to use the sites for free, but with ongoing behavioral advertisements shown as they deal with now.

The subscription fee is substantial: it will cost €120 (about $127) a year on the web, or €156 (about $160) a year on iOS and Android. This is a huge departure for online services. As the privacy expert and activist Max Schrems writes on the noyb.eu site:

Fundamental rights cannot be for sale. Are we going to pay for the right to vote or the right to free speech next? This would mean that only the rich can enjoy these rights, at a time when many people are struggling to make ends meet. Introducing this idea in the area of your right to data protection is a major shift. We would fight this up and down the courts.

The same PIA blog post mentioned above noted that one reason for Meta’s promise to seek user consent was probably a July decision by Datatilsynet, the Norwegian data protection authority. As its press release explains, on the basis of a decision by the Irish Data Protection Commission in January 2023 and a judgment from the EU’s top court in July, Datatilsynet issued a temporary ban on Meta carrying any surveillance advertising on Facebook or Instagram for users in Norway.

In the event of non-compliance, Meta could be fined up to one million Norwegian kroner per day – around $89,000. Datatilsynet explained why it felt it needed to stop the use of behavioral advertising by Meta, noting that “tracking and profiling can be used to paint a detailed picture of these people’s private life, personality and interests,” and that “behavioural advertising strengthens existing stereotypes or could lead to unfair discrimination of various groups.” However, it also emphasized:

The Norwegian Data Protection Authority does not ban personalised advertising on Facebook or Instagram as such. The decision does not for example stop Meta from targeting advertising based on information a user put in their bio, such as place of residence, gender and age, or based on interests a user has provided themselves. Nor does the decision stop Meta from showing behavioural advertising to users who have given valid consent to it.

Meta naturally took legal action, asking the Oslo District Court to suspend the decision. The court declined, stating that the Norwegian data protection authority’s decision was valid, and that there were no grounds for an injunction against it. However, Datatilsynet was only authorized to make a temporary decision regarding Meta, and so in September, Datatilsynet went further, and requested a binding decision from the European Data Protection Board (EDPB). It asked for its temporary ban on behavioral advertising on Facebook and Instagram to be made permanent and to be extended to the entire EU/EEA. This was because “we believe that the GDPR must be interpreted consistently throughout the EU/EEA”.

The EDPB, which ensures a consistent application and enforcement of data protection law across Europe, has now imposed “a ban on the processing of personal data for behavioural advertising on the legal bases of contract and legitimate interest,” leaving consent as the only option for Meta. It made the Norwegian ban on behavior-based advertising on Facebook and Instagram without valid consent both permanent and applicable across most of Europe, not just in Norway. In its press release on the EDPB decision, Datatilsynet made the following important remark (original in Norwegian) about consent-based approaches (via Google Translate): “Datatilsynet also has strong doubts as to whether Meta’s proposed consent solution, which means that those who do not consent to behavioural marketing must pay a fee, will be legal.” As the privacy expert Alexander Hanff writes on Mastodon:

The only option for Meta should they wish to continue to fund their platforms through advertising in a lawful manner, would be to move away from behavioural advertising entirely and switch to advertising based on context or brand advertising (two options which actually perform very well with evidence to support that they perform better than behavioural advertising).

That would be a huge win for contextual advertising, something that has been advocated here on PIA blog many times. Hanff also points out:

Of course this will not end at Meta – in order for this to be seen as fair and not targeting a single company – the same rules will need to be applied to other platforms with the same business model as Meta; which would include most of Alphabet’s services as well as many news publishers, ecommerce sites such as Amazon and more.

Hanff writes that “This single step against Meta, could literally be the death blow to behavioural advertising in the EU.” It’s too early to call that yet, given the litigation by Meta, Google, and others that is likely to arise from the latest moves by the Norwegian data protection authority, backed up by the EDPB. But it is clear that we are getting much closer to that point, which would be amazing news for online privacy.

Feature image by Minette Lontsie.