Pinterest accused of illegal ad tracking in GDPR breach

Social media platform Pinterest is the latest tech giant to have fallen foul of data protection and privacy stalwart Max Schrems, following accusations that it is using consumers’ personal data without their consent to serve them advertising.

NOYB, the organisation founded and fronted by Schrems, maintains Pinterest falsely claims to have a “legitimate interest” in tracking users, arguing that most other websites abandoned this “legally flawed” process years ago.

The site, which has more than 130 million users in the EU, allows consumers to search for all sorts of topics, be it home decor, food recipes, fashion or travel tips.

As with most social media platforms, Pinterest is partly funded by personalised advertising, but NOYB maintains the company tracks users without ever asking for their consent, as required by law.

Instead of seeking opt-in consent under Article 6(1)(a) GDPR, it falsely claims to have a “legitimate interest” in processing people’s personal data under Article 6(1)(f) GDPR. Tracking is turned on by default and would require an objection (opt-out) by each user to stop.

NOYB data protection lawyer Kleanthi Sardeli said: “This allows Pinterest to unlawfully profit from people’s personal data without them ever finding out.”

NOYB is acting on behalf of a single complainant who only found out about Pinterest’s ad tracking by chance. After using the platform for some time, she checked the “privacy and data” settings and found out that the “ads personalisation” was turned on by default.

According to these settings, Pinterest uses information from visited websites and from other third parties to show users personalised ads.

In addition, Pinterest tracks on-site activity “to improve the ads about Pinterest you’re shown on other sites or apps.” NOYB insists this practice is unlawful since the introduction of the GDPR in 2018.

The organisation cites a ruling in the case C252/21 Bundeskartellamt from 2023, in which the Court of Justice of the European Union found again that personalised advertising cannot be based on legitimate interest under Article 6(1)(f) GDPR.

Sardeli continued: “It appears that Pinterest is actively ignoring a European Court of Justice ruling in order to maximise its profits. The CJEU made it clear that personalised advertising cannot be based on legitimate interest.”

To find out more about the personal data processed by Pinterest, the complainant filed an access request. She received a copy of her data on the same day, but quickly realised that it did not include any information about the recipients of her data. Even after two additional requests, Pinterest failed to provide details about the categories of data that were shared with third parties. In other words: Pinterest failed to adequately respond to the access request under Article 15(1)(c) GDPR.

NOYB has now lodged a complaint against the site with the French regulator CNIL, rather than with the company’s main EU regulator in Ireland, which NOYB has long criticised for its record.

The organisation is also demanding that Pinterest erases the data processed for personalised ads and that the recipients be informed of the erasure. In addition, NOYB is calling for Pinterest to comply with the complainant’s access request and is urging CNIL to impose an administrative fine to prevent similar violations in the future.