Meta says it has the ‘intention’ to adjust the legal basis for offering targeted advertisements. The American tech company changes the legal basis from ‘legitimate interest’ to ‘consent’. She says she is doing this because of a different interpretation of the GDPR and “evolving and emerging regulations” in the EU and Switzerland.
Meta announced the policy change Tuesday in an update to a blog post on the subject.
DPC: ‘Offering targeted ads is not a contractual necessity
Meta needs help finding the right legal basis for collecting and processing user data. Article 6, paragraph 1 of the General Data Protection Regulation (GDPR) prescribes six of these bases. Consent of users, performance of a contract and legitimate interest are the three best-known legal bases that are articulated in the article.
For years, Meta used the implementation agreement as a basis to collect data from users of Facebook and Instagram. That was necessary to be able to offer the social networks. The Data Protection Commission (DPC) whistled the technology company back, arguing that this ‘contractual necessity’ violated the GDPR. For years of unlawful user data collection, the Irish regulator imposed a fine of 390 million euros on Meta.
Court: ‘Targeted advertising is not a legitimate interest’
Meta then decided in March to adjust the user conditions. Instead of executing an agreement, the company said it collects user data on the basis of “legitimate interest”. Offering targeted advertisements is part of the service, which means that the tech company does not have to ask users for permission to collect their data explicitly.
The European Court of Justice stopped this at the beginning of July. The Court ruled that providing targeted advertisements is not a legitimate interest. According to the Court, a party may only collect user data without consent if this is “necessary for the performance of the contract with the data subject”. The targeted provision of advertisements does not meet this condition.
The Norwegian privacy regulator Datatilsynet decided last month to temporarily ban Meta for serving targeted advertisements. Due to “highly opaque and intrusive monitoring and profiling activities,” Meta is prohibited from serving targeted ads to Facebook and Instagram users for three months starting Friday, August 4.
Meta: ‘A different basis is needed due to evolving and emerging regulatory requirements.’
Meta takes another tack again. In an update to an older weblog, the company announces that it has the ‘intention’ to change the basis for targeted advertising – Meta speaks of ‘behavioural advertising’ – again. Instead of ‘legitimate interest’, the company opts for ‘consent’.”This change is intended to address a number of evolving and emerging regulatory requirements in the region,” Meta explains the change. Legal rulings from the Irish regulator DPC and the European Court of Justice have shed a different light on the interpretation of European privacy legislation. Meta also anticipates the entry into force of the Digital Markets Act (DMA). This law was devised to make competition between tech companies fairer in the EU and to protect the privacy of Europeans better.
Noyb happy with Meta’s new insight but has doubts about implementation
Noyb says in a response that he is happy with Meta’s intention. “After more than five years of litigation, Meta has finally come to the conclusion that it should ask people whether it can spy on them for advertisements,” said Max Schrems, chairman of the Austrian privacy foundation.
At the same time, he doubts whether the American tech company will actually apply the consent requirement. “Up to now, they’re talking about ‘highly personalized’ or ‘behavioural’ ads, and it’s unclear what this means. The GDPR covered all forms of personalization, including things like your age, which is not ‘behaviour’.” Schrems says he will sue Meta if it does not fully apply European privacy legislation.