EDPB prohibits personalized advertisements on Facebook and Instagram
A few days ago, Meta thought it had made European regulators happy with the introduction of subscriptions for Facebook and Instagram. This allows users to prevent the serving of personalized advertisements in Facebook and Instagram. Unfortunately for Meta, these solutions are not to the liking of the European Data Protection Board (EDPB) and the various privacy regulators. They have it together today announced that Meta must stop unlawfully offering personalized advertisements on Facebook and Instagram within Europe.
No valid legal basis
This decision is the result of an emergency procedure started by the Norwegian privacy regulator. It has previously banned Meta from serving personalized advertisements in its own country. The emergency procedure has now been completed, meaning that the Norwegian ban will apply throughout Europe.
It is clear that Meta is not exactly happy with these new developments. Opposite Reuters a company spokesperson said: “EDPB members have been aware of this plan for weeks and we have been working with them to achieve a satisfactory outcome for all parties. This development wrongly ignores that careful and robust regulatory process. ”
The supervisors within the EDPB have found that Meta unlawfully processes personal data of users on Facebook and Instagram. This includes information such as place of residence, age and education, but also information about which messages they click on and like or share. Meta uses this data to create profiles of its users. And those profiles are interesting for advertisers. That is one of Meta’s revenue models.
Irish regulator must act within two weeks
Formally, the action against Meta must be carried out by the Irish privacy regulator, the IDPC (Irish Data Protection Commission) because Meta has its European headquarters there. The EDPB has now instructed its Irish counterparts to take definitive measures within two weeks. This means ensuring that Meta complies with the ban on serving personalized advertisements and acts fully in accordance with European privacy legislation (GDPR).
This also means that if Meta wants to show advertisements in the future that are based on click and like behavior, whether or not in combination with other personal information from customers’ accounts, for the collection of user and usage data, must explicitly ask its customers for permission.
Subscriptions are not a solution
Earlier this week, Meta thought its solution to offer ad-free subscriptions already complied with European rules. We wrote then that it was still questionable whether that assumption was justified. For users of Facebook and Instagram who do not subscribe, personal data and information about what they click on and what they like are still collected in order to show personalized advertisements. Nothing changes for them, and according to the EDPB this is not in accordance with the GDPR rules.
In any case, Meta will have to explicitly ask all its users for permission if it wants to collect and use the personal and usage data for commercial purposes.
“Meta keeps track of what you post, click or like on Facebook and Instagram and uses that information to offer personalized advertisements. The wrongful processing of the personal information of millions of people on Facebook is a revenue model for Meta. By putting an end to this people’s privacy is better protected,” said Aleid Wolfsen, chairman of the Dutch Data Protection Authority and vice-chairman of the EDPB.
