Ireland’s Data Protection Commission imposed a $414 million fine on Meta for using its contracts with Facebook and Instagram users to send them ads based on their online activity, without explicit consent
A top European Union privacy regulator Ireland’s Data Protection Commission decided that Meta Platforms violated EU privacy laws by saying personalised ads based on users’ online activity are necessary to execute contracts with customers.
The Commission has fined Meta Ireland a total of €390: €210 million (for breaches of the GDPR relating to Facebook), and €180 million (for breaches linked to Instagram service).
The ruling means that Meta will potentially have to allow users to opt out of ads based on interaction with its own apps. At the moment, such an option is available only for personalised ads based on data the company receives from users’ activity on third-party websites and apps.
Ireland’s decisions give the company three months to stop relying on its contracts with users to justify the use of so-called behavioural ads. Although the Irish regulator initially objected to that ruling, a board representing all privacy regulators in the bloc ordered it to do so.
Meta, on the other hand, disagrees with the ruling and plans to appeal both the decision and related fines. Although legal battles may take years, sticking to the decision would hurt Meta’s core business.
In-house online activity data is one of Meta’s main tools for customised advertising. The company earned $83 billion in advertising revenue for the nine months ended Sept. 30, nearly a quarter of which came from Europe.
Although the decisions don’t specifically order Meta to seek users’ for targeted ads, they eliminate the contractual legal justification Meta currently uses to omit explicit consent. Therefore, it would be hard for the company to justify such ads under EU law.
Nevertheless, Meta said Wednesday that the decisions didn’t prevent personalised advertising on its platforms per se. Thus, it is considering legal options to continue offering personalised services. At the moment, the company rejects the idea to seek users’ consent for targeted ads, citing “a lack of regulatory certainty in this area.”