Privacy win: EU Bans Personalised Ads on Facebook and Instagram

Targeted ads have been heavily criticized in the EU and beyond. Now this business model could finally come to an end!

Reuters titles: “Facebook owner Meta faces EU ban on targeted advertising”. The news behind this is rather simple: The European data regulator has agreed to expand Norway’s ban on “behavioural advertising” on Facebook and Instagram to cover all 30 countries in the European Union and the European Economic Area (EEA).

While Norway is currently fining Meta 1 million crowns (~$90,000) per day for breaching users’ privacy by using their data for personalized ads, this temporary fine will stop beginning of November. However, Tobias Judin, the head of Datatilsynet’s international section in Norway told Reuters:

“Since we now will get a permanent ban, non-compliance with the EU/EEA-wide ban would in itself be a violation of the GDPR, which could be sanctioned with up to 4% of global turnover.”

This is great news on the privacy front and we will update you here whether Meta now changes its practice or keeps pushing for a**pay-for-your-privacy approach**.

Read here how it all started and how the small country of Norway has taken on the tech giant. In August we originally asked “Will David be able to bring down Goliath?” Now it very much looks like this is exactly what is going to happen!!!

—

Original news from August 14th:

Meta fined for privacy violations

Starting today Facebook must pay $90.000 to Norway each day for violating our right to privacy.

Starting today Norway has issued a daily fine of ~$90,000 (NOK 1,000,000) to Meta as declared last month According to Norway, personalized advertising on Facebook and Instagram are illegal. If the U.S. company continues violating this ban on targeted advertising, the fine will be issued each day.

While the amount seems rather small for a tech giant like Meta, these two facts could put an end to the company’s business model regardless:

1. $90,000 per day for a country with ~5.4 million people is a lot. If even 20 percent used Facebook regularly, then that would still be 10 cents per user per day. It’s unlikely that Meta is generating so much profit per user - every day.

2. The fine by Norway is only the start. The Norwegian Data Protection Authority is calling on European authorities to also take measures against Facebook’s and Instagram’s targeted and personalized advertisement practice.

Privacy violation by Facebook and Instagram

With its fine the Norwegian Data Protection Authority is directly attacking the core of Facebook’s and Instagram’s business model: targeted advertisement.

Norway is known for fighting against targeted ads. For instance, the Norwegian Consumer Council published a report calling for a ban on surveillance-based ads in 2021, which was followed by a call from privacy-first companies like Tutanota to ban targeted ads.

The criticism of Facebook and Instagram by the Norwegian authority goes as follows:

“Meta tracks in detail the activity of users of its Facebook and Instagram platforms. Users are profiled based on where they are, what type of content they show interest in and what they publish, amongst others. These personal profiles are used for marketing purposes – so called behavioural advertising. The Norwegian Data Protection Authority considers that the practice of Meta is illegal and is therefore imposing a temporary ban of behavioural advertising on Facebook and Instagram.”

The decision to declare Facebook’s and Instagram’s profiling and targeted advertisements as illegal comes shortly after the European Court of Justice (ECJ) ruling that prohibits Meta from collecting personal data from users such as location, behavior, etc. for advertising purposes.

Prior to that, in December 2022, the Irish Data Protection Commission issued a decision on behalf of all data protection authorities across the European single market (EEA) which established that Meta has conductedillegal behavioural advertising. While Meta has made certain changes, these were not deemed sufficient as Meta’s behavioural advertising still does not comply with the law. That’s why the ECJ issued its new ruling.

The Norwegian authority Datatilsynet has referred its complaints to the European Data Protection Board, which could extend the penalty across Europe.

”It is so clear that this is illegal that we need to intervene now and immediately. We cannot wait any longer,” Tobias Judin, head of Datatilsynet’s international section, told Reuters. The goal is to put “additional pressure” on Meta.

Norway can take its own actions against Meta as it is a member of the European single market, but not a member of the EU.

It’s so good to see that Norway is taking action against these practices, particularly since Facebook has violated the privacy of its users even further. News went viral that Facebook used its app privileges to spy on SnapChat users, and it has shared Facebook direct messages with Netflix.

Temporary ban on targeted ads

The Norwegian Data and Protection Authority points out that it “does not ban Facebook or Instagram in Norway. The purpose is rather to ensure that people in Norway can use these services in a secure way and that their rights are safeguarded.”

The Norwegian Data Protection Authority does not ban personalised advertising on Facebook or Instagram as such. The decision does not for example stop Meta from targeting advertising based on information a user put in their bio, such as place of residence, gender and age, or based on interests a user has provided themselves. Nor does the decision stop Meta from showing behavioural advertising to users who have given valid consent to it.

But: “All business models must respect privacy as a human right. Users must have sufficient control over their own data, and any tracking must be limited,” said Judin. And: “Invasive commercial surveillance for marketing purposes is one of the biggest risks to data protection on the internet today.”

The Norwegian Data and Protection Authority argues that Meta has immense power to influence people by posting targeted advertisements - and also by not posting other ads that do not seem to match the person’s profile. This affects freedom of expression and freedom of information, particularly when it comes to political advertisements. In addition, there is a risk that behavioural advertising strengthens existing stereotypes or could lead to unfair discrimination of various groups.

European measures ahead

With its headquarters in Dublin, Ireland, the Irish Data Protection Commission (DPC) is responsible for supervising Meta and, thus, also Facebook and Instagram. However, the Irish DPC in the past has been criticized for not doing its job properly. It only issued the largest fine against Facebook ever - 1.2 billion euros - after pressure from European courts and institutions.

The Norwegian Data Protection Authority has now intervened directly against Meta because there was an urgent need to act, in particular because Meta has recently received both a decision and an EU judgment on its illegal tracking practices to which the tech giant has not aligned with adequately enough. “If we don’t intervene now, the data protection rights of the majority of Norwegians would be violated indefinitely,” the Norwegian authority said.

”Moving forward, we may take the matter to the European Data Protection Board (EDPB), of which we are a member, after the summer. The EDPB will decide whether the decision may be extended beyond its initial three month validity period.”

Threads not launched in EU

In is also noteworthy that the new Meta platform Threads, dubbed as the new Twitter alternative, has still not launched in the EU, though it’s already available in the USA and in the UK.

This is another sign that Meta is seeing serious headwind from the EU against its business model of personalized advertisements.

The next few months are going to be very interesting: Will the EU finally defend the privacy rights of 450 million people?