{"id":25989,"date":"2024-01-19T01:48:46","date_gmt":"2024-01-19T09:48:46","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=25989"},"modified":"2024-01-19T01:49:29","modified_gmt":"2024-01-19T09:49:29","slug":"the-latest-instalment-in-the-privacy-battle-between-schrems-and-meta","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/the-latest-instalment-in-the-privacy-battle-between-schrems-and-meta\/","title":{"rendered":"The Latest Instalment in the Privacy Battle between Max Schrems and Meta Just Dropped"},"content":{"rendered":"\n

Last month we wrote about the latest development in a long-running saga<\/a> to make Meta abide by the EU\u2019s GDPR privacy law. It\u2019s a vital battle for two reasons: first, because Meta is a huge company that impacts the lives of billions of people around the world, so it\u2019s important that it not only follows the law, but is seen to do so. The second reason derives from this: the rules Meta abide by will also apply to every other major company operating in the EU. The outcome is also likely to determine the shape of the online privacy landscape globally, such is the influence of the GDPR.<\/p>\n\n\n\n

Last month\u2019s post detailed how the privacy expert and activist Max Schrems, and his noyb.eu organization, have filed a complaint against Meta with the Austrian data protection authority because of Meta\u2019s new ad-free subscription scheme<\/a>. The principal concern was that this was not \u201cfree consent\u201d as required by the GDPR, and that Meta\u2019s subscription fee to remove ads was far too high: \u20ac120 (about $130) a year on websites, or \u20ac156 (about $170) a year on iOS and Android apps. Schrems pointed out that this was a big problem, because industry numbers quoted by noyb.eu suggest that only 3% of people want to be tracked, but that more than 99% decide against a payment when faced with any kind of \u201cprivacy fee.\u201d Setting the subscription level so high almost guarantees that few people will take that option \u2013 doubtless what Meta hopes. Noyb.eu\u2019s latest complaint<\/a> builds on the issue of expensive ad-free subscriptions.<\/p>\n\n\n\n

\n

Meta\u2019s seriously flawed approach to free consent isn\u2019t the only issue at hand. Once users have consented to being tracked, there\u2019s no easy way to withdraw it at a later date. This is illegal. Despite Article 7 of the GDPR clearly stating that \u201cit shall be as easy to withdraw as to give consent\u201d, the only option to \u201cwithdraw\u201d the (one-click) consent, is to buy a \u20ac 251.88 subscription. In addition, the complainant had to navigate through several windows and banners to find the page where he could actually revoke consent.<\/p>\n<\/blockquote>\n\n\n\n

According to noyb.eu, GDPR rules mean withdrawing consent must be as easy as giving it. But paying \u20ac251.88 (about $275) \u2013 the annual amount required for a Facebook account together with a linked Instagram account \u2013 is clearly much more difficult than simply pressing an on-screen button to accept Meta\u2019s tracking. As noyb.eu points out:<\/p>\n\n\n\n

\n

The European Data Protection Board (EDPB) [the top EU data protection body] even mention monetary costs as an example of a burden that is incompatible with the principle of Article 7 GDPR in its guidelines, making it clear that Meta is making the withdrawal of consent not nearly as easy as to give consent.<\/p>\n<\/blockquote>\n\n\n\n

Noyb.eu has filed a complaint with the Austrian data protection authority (DSB) on behalf of one complainant. It requests that the DSB should order Meta to bring its processing operations in compliance with European data protection law and to provide users with an easy way to withdraw their consent \u2013 without having to pay a fee. In addition, noyb.eu wants the Austrian data protection authority to impose a fine on Meta \u201cto prevent further violations of the GDPR.\u201d Interestingly, the DSB has an FAQ about precisely the kind of \u201cpay or okay\u201d system that Meta introduced last year. In the opinion of the Austrian data protection authority, the following points must be observed by any company that adopts the \u201cpay or okay<\/a>\u201d approach (translation by DeepL):<\/p>\n\n\n\n