Since the General Data Protection Regulation (GDPR) came into force in 2018, Meta (Facebook, Instagram and WhatsApp) has been at the center of many controversies. Often condemned for non-compliance or failure to comply with the regulation, Meta is once again in the spotlight.
Currently, the issue of personal data processing for targeted advertising purposes is causing a stir. Between Meta’s dodges to circumvent the GDPR, and Europe’s determination to make the firm give in, back to a never-ending battle.
The problem of consent for the processing of personal data
Since the GDPR came into force, Meta has often been sanctioned. European Union (EU) vs Meta’s battle concerns, in particular, users’ consent to be able to process their personal data for advertising purposes. Since the arrival of the regulation, Internet users should be able to clearly choose if they consent to targeted advertising or not.
The French Data Protection Authority (CNIL) defines targeted advertising as “an advertising technique that aims to identify people individually in order to deliver specific advertising messages based on individual characteristics”. To accomplish this, websites use cookies. These are text files stored by the browser on the surfer’s hard disk. This file records the user’s path and browsing information. Then, a system of algorithms and data is used to determine, for example, a person’s age, gender, location, or interests.
The GDPR does not prohibit target advertising, but it does require explicit consent from the Internet user. In Article 4, the GDPR defines consent as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”.
And yet, for five years now, the EU and Meta have been in disagreement regarding consent. Targeted advertising brings in far more revenue than traditional advertising (5 to 6 euros per month per user in Europe for Facebook). Furthermore, Meta is aware that if the possibility of refusing targeted advertising were given, most Internet users would refuse. In order not to lose money, Meta has tried to circumvent this obligation.
Measures taken by the European Union to try and force Meta to comply with the GDPR
After several judgments, Meta decided to add the consent provisions to its terms of service. These changes obliged, therefore, users to give their consent, without knowing it.
This relocation of the consent clause was contested, at the end of 2022, by the European Data Protection Board (EDPB), which brings together all the European Data Protection Authorities. On January 4, 2023, the Irish Data Protection Commission (DPC), acting on behalf of the European Union, fined Meta 390 million euros and required it to comply with European legislation within three months.
Meta, considering that there would be a drop in its sales, modified only the legal basis justifying its processing of personal data. The company then relied on legitimate interest.
Despite these changes, the Court of Justice of the European Union, on July 4, 2023, in its “Meta v Bundeskartellamt” judgment, considered that the company still did not comply with the European regulation.
It was therefore logical that the Norwegian authority, Datatilsynets, banned Meta from all behavioral advertising for 3 months, or until Meta changed the way it handled consent. Having made no changes, Meta began receiving daily fines of 90 000 euros in mid-August. Datatilsynets has decided to take the question to the EDPB.
Thus, on October 27, 2023, the EDPB adopted an urgent binding decision ordering the Irish regulator, where Meta is headquartered, to act within two weeks to prohibit the processing of personal data for targeted advertising purposes on the legal basis of contract and legitimate interest throughout the European Economic Area.
Anu Talus, President of the EDPB, points out that “already in December 2022, binding decisions by the EDPB clarified that the contract does not constitute an appropriate legal basis for Meta’s processing of personal data for behavioral advertising purposes”. In her opinion, “it is high time for Meta to bring its processing into compliance and put an end to unlawful processing”.
Meta’s response: the introduction of a subscription system
At the same time, Meta was working on setting up subscriptions to avoid targeted advertising, in order to better comply with European regulations. The principle is simple: either you pay and your personal data will not be processed, or you accept the processing of your personal data for the purposes of targeted advertising.
Meta made its official announcement on October 30, 2023. Its subscriptions range from 9.99 to 12.99 euros per month.
Following this announcement, Meta played the card of incomprehension in the face of the EDPB’s restrictive decision. The company explained that the EDPB had been informed of the implementation of this project, so it did not understand why this restrictive decision had been taken.
European concerns about the system imposed by Meta
Europeans largely rejected this solution, which quickly sparked a rebellion from many NGOs. A group of 28 NGOs wrote an open letter to the EDPB, expressing their opposition to the concept of having to choose between paying or consenting to the use of their personal data, which they consider to be unlawful. In particular, they point out that it is unacceptable to impose a charge for the protection of the fundamental right to privacy. The EDPB pronounced itself on April 17, stating that “consent or pay models should offer real choice”. The committee considered that if data controllers, including Meta, choose the ‘pay or ok’ solution, they should consider offering an additional free alternative. For example, this free solution could offer untargeted advertising.
Olivia MARTIN
M2 Cyberjustice – Promotion 2023/2024
Sources :
EDPB Urgent Binding Decision on processing of personal data for behavioural advertising by Meta.
Pour respecter le RGPD, Meta lance un abonnement payant à Facebook et Instagram en Europe.
