{"id":22934,"date":"2023-01-12T03:41:55","date_gmt":"2023-01-12T11:41:55","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=22934"},"modified":"2023-04-18T01:28:18","modified_gmt":"2023-04-18T08:28:18","slug":"meta-intensifies-battle-against-gdpr","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/meta-intensifies-battle-against-gdpr\/","title":{"rendered":"Meta’s Tracking Woes Confirmed As It Intensifies Its Battle For Control Of The EU’s GDPR"},"content":{"rendered":"\n

In December 2022, we discussed the leak of an important ruling<\/a> by EU privacy regulators regarding Meta\u2019s micro-targeted advertising, a system entirely based on constant online surveillance. The two parts of the decision have now been published (Facebook ruling<\/a>, Instagram ruling<\/a>), and a more complete analysis of its likely impact has been made by Max Schrems, the privacy expert and activist who brought the original complaint against Meta and Google<\/a>, just six minutes after the enforcement of the EU\u2019s GDPR began in May 2018. <\/p>\n\n\n\n

The subsequent, rather unusual history of the action was detailed in our previous post on the topic.<\/a> Schrems and his team at the noyb.eu<\/a> project explain the key issue as follows:<\/p>\n\n\n\n

\n

The GDPR allows for six legal bases to process data, one of which is consent under Article 6(1)(a). Meta tried to bypass the consent requirement for tracking and online advertisement by arguing that ads are a part of the \u201cservice\u201d that it contractually owes the users. The alleged switch of legal basis happened exactly on 25 May 2018 at midnight when the GDPR came into force. So-called \u201ccontractual necessity\u201d under Article 6(1)(b) is usually understood narrowly and would e.g. allow an online shop to forward the address to a postal service, as this is strictly necessary to deliver an order. Meta, however, took the view that it could just add random elements to the contract (such as personalized advertisement), to avoid a yes\/no consent option for users.<\/p>\n<\/blockquote>\n\n\n\n

Meta Trying to Be \u2018Cute\u2019 with GDPR<\/h2>\n\n\n\n

Meta\u2019s argument<\/a> is that when people sign up to Facebook and Instagram they want a personalized service, including personalized ads. In order to provide that service, Meta claims that it must collect personal data to power its micro-targeted advertising \u2013 making it a \u201ccontractual necessity\u201d that does not require explicit consent.<\/p>\n\n\n\n

The draft decision by the data protection authority with responsibility for the case, the Irish Data Protection Commission (DPC), accepted this argument<\/a>. However, the supervisory European Data Protection Board (EDPB) disagreed, and has now ruled that Meta must instead provide its users with an explicit yes\/no option that requires them to opt in if they wish to be tracked for the purpose of advertising. <\/p>\n\n\n\n

Otherwise, user data cannot be used for micro-targeted ads. This is a general requirement that will also apply to other digital platforms operating in the EU. EDPB Chair Andrea Jelinek said<\/a>: <\/p>\n\n\n\n

\n

These decisions may also have an important impact on other platforms that have behavioural ads at the centre of their business model.<\/p>\n<\/blockquote>\n\n\n\n

The ruling does not mean that targeted advertising will be banned unless there is user opt-in. As we pointed out many times, it is possible to use contextual advertising<\/a> to provide tailored ads without infringing on the privacy of users, or building huge stores of personal data that risk being leaked. Meta\u2019s argument that it \u201cmust\u201d track users in order to provide the personalized advertising they sign up for is incorrect.<\/p>\n\n\n

\n
\"\"
Why would a data protection authority take the side of tech companies\u2026 and not their users?<\/figcaption><\/figure>\n<\/div>\n\n\n

Micro-Targeted Advertising Is Incompatible with GDPR<\/h2>\n\n\n\n

Moreover, a detailed legal analysis carried out last year of \u201creal-time bidding<\/a>\u201c, the main ad sales technique used by Meta and other companies, concluded that it is \u201cdifficult to reconcile with core tenets of the GDPR<\/a>\u201c. That\u2019s yet another powerful reason for companies to adopt contextual advertising instead.<\/p>\n\n\n\n

The EDPB imposed on Meta Ireland a fine of \u20ac210 million in the case of Facebook, and \u20ac180 million in the case of Instagram (an additional fine in respect of WhatsApp is expected). Significantly, this is around ten times higher than the fine that the DPC had proposed in its draft resolution of the complaint. <\/p>\n\n\n\n

The increased sums are a further reflection of the fact that the official ruling by the EDPB represents a massive defeat for the Irish DPC, which has consistently taken Meta\u2019s side in this case. In addition to approving the use of \u201ccontractual necessity\u201d as a legal basis for collecting personal data, the DPC even went so far as to lobby other EU data protection authorities<\/a> to make Meta\u2019s GDPR bypass an officially recognized approach.<\/p>\n\n\n\n

The DPC\u2019s strong support for Meta during this complaint may relate to the disproportionate importance of Internet companies to the Irish economy, and a desire by the government there to keep the investments flowing. That support even manifests itself in the context of the latest EDPB decision. Although the DPC has now published its decisions, Schrems wrote that initially:<\/p>\n\n\n\n

\n

the DPC informed noyb \u2026 that despite being one of the two parties in the procedure, the DPC will not release the decision to noyb. The DPC suddenly cited alleged \u201cconfidentiality\u201d of the decision as a reason. The decision should be released to the plaintiff at a later stage \u2013 possibly even after the deadline for an appeal has lapsed. This is contrary to previous information by the DPC that the parties would receive the decision before any publications by the DPC.<\/p>\n<\/blockquote>\n\n\n\n

The Irish DPC Continues to Fight for Meta<\/h2>\n\n\n\n

As that mentions, Meta can appeal, and has already said that it will<\/a>, against what it calls \u201cthe substance of the decision\u201d. That presumably means that the requirement to implement the EDPB\u2019s ruling within three months will be put on hold until after the appeal has been decided. <\/p>\n\n\n\n

In another sign of the DPC\u2019s determination to push its own interpretation of the GDPR, the Irish authority has announced<\/a> that it \u201cconsiders it appropriate that it would bring an action for annulment before the Court of Justice of the EU in order to seek the setting aside of the EDPB\u2019s directions.\u201d<\/p>\n\n\n\n

This extraordinary move by the DPC is an indication that what is at stake here is nothing less than who gets to decide how data protection should be policed in the EU: whether it is individual authorities such as the DPC acting autonomously, or the EDPB imposing consistent, top-down rules. <\/p>\n\n\n\n

The outcome of this battle for the soul of the GDPR will have important ramifications, as will the final ruling on Meta\u2019s use of personal data, which will determine how the entire adtech world operates in the EU, and likely far beyond.<\/p>\n\n\n\n