Meta dragged kicking and screaming into ad opt-out

Five years and countless hours of legal wrangling later, Meta has finally bowed to pressure to offer consumers an opt-in and opt-out box to consent to receive personalised ads on both Facebook and Instagram, although critics are already warning the move could be yet another fudge.

The consent issue was first raised by privacy organisation NYOB – set up by Austrian lawyer and long-term Facebook nemesis Max Schrems – back in 2018, just days after GDPR came into force.

NYOB claimed that all Meta’s platforms used a strategy of “forced consent” to process users’ personal data as they had no choice over whether to have their information collected for advertising if they wanted to use the sites.

After a landmark ruling in January – which came with a €390m (£346m) fine – Meta was given three months to changed the process. Right on deadline, the tech giant introduced a scheme based on “legitimate interest” to track user data for personalised ads.

But another ruling in the EU Court of Justice has forced Meta to ditch this method, meaning users will now get an opt-in or opt-out box to tick. Facebook and Instagram are both heavily reliant on advertising – Facebook made $135.94bn in revenue from ads in 2022 alone.

Following Brexit, by law the changes only affect users in the EU and Switzerland and it is not known whether the UK will also be covered.

But in a face saving move, Meta claims it is making the change after listening to “concerns” from the Irish Data Protection Commission and the European Data Protection Board but in reality it is being dragged kicking and screaming into the change.

Even so, the wording of its statement is still not clear. Meta refers to not using personal data for “behavioral advertisements” which is not defined in EU law, and says the legal basis will change for how it processes “certain” data for that purpose. The EU does not make exceptions for different types of data being processed, and requires consent for all data.

In response, Max Schrems is cautious. He said: “We will see if Meta is actually applying the consent requirement to all use of personal data for ads. So far they talk about ‘highly personalised’ or ‘behavioural’ ads and it’s unclear what this means.

“GDPR covers all types of personalisation, also on things like your age, which is not a ‘behaviour’. We will obviously continue litigation if Meta will not apply the law fully.”

Share with friends and colleagues

Related Articles