Severe defeat for Meta’s business model in Europe: In the future, the Facebook group will no longer be allowed to use its users’ personal data for the personalization of advertising without being asked. This was decided by the responsible Irish data protection authority DPC on Wednesday. At the same time, it imposed a fine of 390 million euros. The DPC announced that the group had violated the EU General Data Protection Regulation (GDPR) with its Facebook and Instagram platforms. Both cases are about personalized advertising and the way in which Meta collects and processes personal data from users. 210 million euros are due for the Facebook violation and 180 million euros for Instagram.
The Irish regulator has long refrained from taking action against Facebook and Meta after complaints from Facebook customers and data protection activists. In December, the European Data Protection Board overruled the DPC and called on the Irish authority to take decisive action.
Since 2018, the GDPR has regulated the conditions under which personal data may be used. In some cases, this can also be done without the customer’s explicit consent, for example if an online shop transfers data to the parcel service provider. After the GDPR came into force in 2018, Facebook (today Meta Platforms) declared in its terms of use that personally tailored advertising was part of the service for which no separate consent was required. This interpretation has now been dismissed. The authority concluded that the company then effectively urged its users to accept certain terms, otherwise the services would no longer have been usable for them.
In a first reaction, Facebook said: “We strongly believe that our approach respects the GDPR and are therefore disappointed with these decisions.” The Irish authority also requires Meta to change its data processing practices within three months. Data protection advocate Max Schrems, who is one of the complainants, criticized Meta’s approach: “Instead of having a yes/no option for personalized advertising, they simply moved the consent clause to the general terms and conditions. That’s not only unfair, it’s clear illegal.”