Earlier this year, Norway’s data protection agency deemed that Meta’s behavioral advertising practices were out of compliance with General Data Protection Regulations (GDPR) and began levying a daily fine against the company. After failing to stop it with an injunction, Meta is now looking at an EU ban after the European Data Protection Board (EDPB) reached a decision on the case.
The terms of the decision require Meta to stop behavioral advertising across most of the EU by November 10. Meta has already declared that it will start asking EU users for consent, and will steer those that do not toward a new paid subscription option that will provide access to all of its services (such as Instagram) for the equivalent of about $10.50 per month.
Faced with EU ban, Meta must make big and sudden business model changes
The Norwegian behavioral advertising ban initiated in August of this year and came with an order to Meta to pay 1 million kroner per day (about $100,000) that it remained in violation. Norway’s law limits the time a company can be fined in this way to three months, and that initial action expired on November 3.
Meta reportedly let the fines pile up while continuing to conduct business as usual, even after an Oslo court refused its request for a temporary injunction in late August. With quarterly revenues of about seven billion dollars in Europe, Meta may have been content simply paying off the accumulated fines at some point. Norway’s data protection board thus opted to refer the case to the EDPB for an urgent binding decision on an EU ban, given that it involves a finding of a GDPR violation.
The EDPB has now agreed that Meta’s model for user consent does not meet GDPR requirements. That means the Norwegian ban has become an EU ban, and Meta may be subject to further fines in other countries. Meta has said that it will cooperate with the decision, changing its consent model to actively ask users to opt in. However, it appears that users who choose to opt out will not be able to use the company’s services; that is, unless they purchase the new ad-free subscription.
These new developments may land Meta in even more GDPR hot water. The regulation states that consent must be freely given, something very much complicated if users will be blocked from the service unless they pay to have behavioral advertising removed from the experience. The only clear paths out of the EU ban are informed consent, or switching to a less intrusive advertising model.
Meta continues to dig in against informed consent for behavioral advertising
At this point, Meta has an established track record of digging in its heels against informed consent in its behavioral advertising. The company has fought and attempted to circumvent the GDPR’s rules on this at every step of the way since it went into force in 2018, and at this point has had every prior attempt slapped down by either the EDPB, its primary EU regulator (the Irish DPC) or the Court of Justice of the European Union (CJEU).
Prior penalties in this area have included a $1.3 billion fine, but the EU ban presents even greater potential for financial damage. Meta could find itself facing daily fines across the entire bloc and essentially in perpetuity, something that has prompted it to scramble to find one last way to push users into consent that they might otherwise not give.
The GDPR provides only a handful of specific exceptions to collecting clear user consent for behavioral advertising. Meta has tried every feasible one at this point. It was previously under the “Legitimate Interests” basis, which allows companies to skip collecting consent if they can demonstrate users have a “reasonable expectation” of personal information being collected. Meta was forced to pivot to this from the “Contractual Necessity” exception in late 2022, under which it claimed the contract (terms of service) the users agree to is sufficient to waive consent requirements. That tactic was shot down by the Irish DPC and EDPB in late 2022.
Meta still has options for an ad-driven free-to-use Facebook and Instagram in the face of the EU ban, though they will not rake in the giant piles of money that behavioral advertising does. The company can switch to a “contextual” ad model, which selects ads based on the content of the page or post that is currently being viewed rather than a personal profile that can roam to third-party data sources. Amazon is likely the biggest platform to operate in this way, and X/Twitter uses something of a hybrid version that can draw on previous tweets and followers but keeps its information sources within the platform.