Facebook, Instagram and WhatsApp can no longer run personalized ads without user consent in EU

[usonian]

https://noyb.eu/en/noyb-win-personalized-ads-facebook-instagram-and-whatsapp-declared-illegal

As reported by The Wall Street Journal, the EDPB has decided that Meta cannot force users to agree to personalized ads. In May 2018, when the GDPR came into force in the EU, Meta Ireland Ltd. believed it could "bypass" the requirement to get opt-in consent from users, by simply adding a provision in the terms and conditions. On 25 May 2018, the digital rights organization noyb filed complaints with the relevant Data Protection Authorities (DPAs). Now, 4.5 years later, the European Data Protection Board (EDPB) found Meta's alleged "bypass" of the GDPR illegal. The EDPB also rejected the view of the Irish Data Protection Commission (DPC) who previously sided with Meta, after taking four years to investigate the case. ...

Meta wanted to "bypass" consent. The GDPR allows for six legal bases to process data, one of which is consent under Article 6(1)(a). Meta tried to bypass the consent requirement for tracking and online advertisement by arguing that ads are a part of the "service" that it contractually owes the users. The alleged switch of legal basis happened exactly on 25 May 2018 at midnight when the GDPR started to apply. So-called "contractual necessity" under Article 6(1)(b) is usually understood narrowly and would e.g. allow an online shop to forward the address to a postal service, as this is strictly necessary to deliver an order. Meta, however, took the view that it could just add random elements to the contract (such as personalized advertisement), to avoid a yes/no consent option for users.

Max Schrems: "Instead of having a yes/no option for personalized ads, they just moved the consent clause in the terms and conditions. This is not just unfair but clearly illegal. We are not aware of any other company that has tried to ignore the GDPR in such an arrogant way."

DPC and Meta cooperated on "bypass". During the course of the procedure, Meta has relied on ten confidential meetings with the Irish DPC in which the DPC has allegedly allowed Meta to use this "bypass". It was later revealed that the DPC has even tried to influence relevant EDPB Guidelines in the interest of Meta. Nonetheless, the other European DPAs rejected the DPC's view back in 2018 and again in the final EDPB decision. The case took more than 4.5 years and lead to hundreds of pages of reports and submissions, despite the case being about a rather simple legal question.

Big takeaway: People now need to be asked if they want their data to be used for ads or not. They must have a 'yes or no' answer and can change their mind at any time.

[intrepidity]

1. No doubt they'll deploy those "opt in/out" pages that are completely ambiguous

Those are ubiquitous and frustrating beyond belief. Impossible to tell which way the toggle switch favors what you expect/want.