{"id":22696,"date":"2022-12-09T01:28:06","date_gmt":"2022-12-09T09:28:06","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=22696"},"modified":"2022-12-09T01:28:08","modified_gmt":"2022-12-09T09:28:08","slug":"gdpr-win-facebook","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/gdpr-win-facebook\/","title":{"rendered":"Will GDPR’s Win Against Facebook Change Advertising?"},"content":{"rendered":"\n

We\u2019ve just written about the mounting problems for Facebook<\/a> and its parent company Meta. And to that list of issues can be added another one, potentially the biggest so far, since it goes to the heart of the business model used by Meta for Facebook, Instagram and WhatsApp: micro-targeted advertising based on constant online surveillance. <\/p>\n\n\n\n

An unconfirmed report in the Wall Street Journal<\/a> drawing on \u201cpeople familiar with the decision\u201d says that EU privacy regulators have ruled that Meta cannot force users to agree to personalized ads as part of its terms of service. Instead, users must give their explicit consent to being tracked for the purposes of advertising. If they don\u2019t, they can\u2019t be blocked from using the service.<\/p>\n\n\n\n

Facebook Tried to Bypass the GDPR <\/h2>\n\n\n\n

This long-running saga goes back to the very start of the GDPR<\/a> era, in May 2018. As PIA wrote back then, just six minutes<\/a> after the enforcement of the EU\u2019s GDPR began, the privacy activist Max Schrems filed four complaints, against Google, Facebook, WhatsApp and Instagram, over the issue of \u201cforced consent<\/a>\u201d to online tracking.<\/p>\n\n\n\n

The Irish Data Protection Commission (DPC) drafted a response to the complaint, since Facebook\/Meta has its EU headquarters in Ireland. In October 2021, the DPC supported Facebook\u2019s attempt<\/a> to make surveillance part of the contract between the company and users, which allowed Facebook to bypass GDPR requirements for consent. <\/p>\n\n\n\n

However, other data protection authorities in the EU disagreed, and jointly issued guidelines<\/a> that such a bypass of the GDPR is illegal and must be treated as consent. The DPC said that is was \u201cnot persuaded\u201d by this view of its colleagues.<\/p>\n\n\n\n

The GDPR foresaw this situation of disagreement by EU data protection authorities, and in Article 65 of the legislation<\/a> laid down a dispute resolution process. It requires the European Data Protection Board (EDPB) to adjudicate the issue. As the FAQ explains<\/a>: \u201cThe decision is adopted by a two-thirds majority of the members of the Board, and in case a decision cannot be adopted within 2 months, the decision is adopted within the next 2 weeks by a simple majority.\u201d<\/p>\n\n\n\n

Facebook\u2019s Future Is Decided <\/h2>\n\n\n
\n
\"\"
Everyone else has to follow the law, why shouldn\u2019t Facebook?<\/figcaption><\/figure>\n<\/div>\n\n\n

The EDPB has now adopted three dispute resolution decisions concerning Meta\u2019s three platforms. However, it has not yet made those public. First, the DPC must make its final rulings, on the basis of the EDPB\u2019s binding decisions. It must do this within a month, which means that the details will probably be released sometime in January next year. <\/p>\n\n\n\n

Even Max Schrems must wait until then to find out exactly what the EDPB has ruled. Fortunately, the Wall Street Journal\u2019s story contains enough details for him to comment on the likely implications<\/a> of this ruling:<\/p>\n\n\n\n

<\/blockquote>\n\n\n\n

Users must be able to withdraw consent at any time and Meta may not limit the service. While this will limit Meta\u2019s profits dramatically in the EU, it would not fully prohibit ads. Instead the decision will put the company on the same level as other websites or apps that need to provide a yes\/no option to users.<\/p>\n\n\n\n

A lawyer himself, Schrems notes that Meta can appeal against the decision, but that:<\/p>\n\n\n\n

\n

the chances to win such an appeal are minimal after an EDPB decision. There is also two similar cases before the Court of Justice of the EU (CJEU) on Meta\u2019s consent bypass that may settle the issue and all appeals for good. Users may also take action over the illegal use of their data for the past 4.5 years.<\/p>\n<\/blockquote>\n\n\n\n

The requirement to allow users to have a version of the service that does not gather personal data for the purpose of advertising will presumably apply to many larger online services that are offered in the EU, not just Meta\u2019s. It could dramatically re-shape the advertising landscape there. <\/p>\n\n\n\n

According to one 2021 study, 96% of US users<\/a> running Apple\u2019s IOS 14.5 opted out of tracking by apps, a possibility introduced by Apple with its operating system from that version. Research carried out a year after the release of IOS 14.5 found greater levels of acceptance, with around three-quarters of users<\/a> opting out of tracking.<\/p>\n\n\n\n

Will Meta Finally Give Users the Power to Decide?<\/h2>\n\n\n\n

Even the higher level of opt-in would require a massive shift towards contextual advertising by most sites. Some examples of what that looks like can be seen in a couple<\/a> of articles<\/a> explaining how it works, and why it is better than the more intrusive kind. An interesting post on the IBM Watson Advertising site points out that advances in AI means that contextual advertising is getting better<\/a> thanks to more intelligent page content analysis, which should ease the transition away from the non-contextual systems employed today.<\/p>\n\n\n\n

The EU\u2019s GDPR has already set the standard for privacy legislation around the world. In the same way, the latest ruling by the EDPB, if confirmed, is likely to accelerate the move away from intrusive, behavioral advertising based on surveillance towards the more respectful but still effective contextual kind. Although that will begin in the EU, it is likely to spread globally as more people demand an end to non-stop surveillance when they go online.<\/p>\n\n\n\n