Meta may not use personal data for advertising
A heavy blow for Meta's business model in Europe: In the future, the Facebook group will no longer be allowed to use its users' personal data for advertising personalization without being asked. This was decided by the responsible Irish data protection authority DPC on Wednesday.
At the same time, it imposed a fine of 390 million euros. The DPC announced that the group had violated the EU's General Data Protection Regulation with its Facebook and Instagram platforms.
Both cases are about personalized advertising and the way Meta collects and processes users' personal data. Facebook will be fined 210 million euros for the infringement, and Instagram 180 million euros.
Demand from EU authority
The Irish regulator had long been reluctant to take action against Facebook or Meta following complaints from Facebook customers and privacy activists. In December, the European Data Protection Board overruled the DPC and called on the Irish authority to take decisive action against the Internet giant.
Since 2018, the General Data Protection Regulation (GDPR) has regulated the conditions under which personal data may be used. In some cases, this can be done without the explicit consent of the customer, for example when an online store transfers data to the parcel service provider.
Interpretation not accepted
After the entry into force of the GDPR in 2018, Facebook (now Meta Platforms) had declared in its terms of use the playing of personally tailored advertising as part of the service, for which no separate consent was required. This interpretation has now been overturned.
The authority concluded that the company then in a sense pressured its users to accept certain conditions, as otherwise the services would no longer have been usable for them. In a first reaction, Facebook stated: "We strongly believe that our approach respects the GDPR and are therefore disappointed by these decisions."
The Irish authority is also requiring Meta to change its data processing practices within three months.
Data protection activist Max Schrems, who is one of the complainants, criticized Meta's approach, saying, "Instead of having a yes/no option for personalized advertising, they simply moved the consent clause to the terms and conditions. That's not only unfair, it's clearly illegal."
