Are online targeted advertisements legal?

The Irish Data Protection Authority (DPC) has been thinking about this for a long time.

Now they have concluded in two different cases, both relating to Meta, reports the Irish Data Protection Authority itself A press release.

210 million euros for violations of the GDPR in connection with Facebook, and 180 million euros in connection with Instagram. In total, it will be more than four billion crowns.

– Meta was also asked to bring the data processing into compliance with the rules within three months, writes DPC.

The case is based on two different complaints, both already registered in May 2018, when the GDPR came into force.

– A blow to Meta’s business model

So far, Meta has included consent to personalized or targeted advertising in the terms of service, arguing that the ads are part of the service they offer. This is not good, concluded DPC.

It should be possible to use the service while opting out of targeted advertising, said Max Schrems and his privacy organization NOYB.

Now they have won.

– A blow to Meta’s business model, writes NOYB alone websites.

Decided at the highest level

Ireland’s data protection authority has been criticized both for long delays in dealing with cases and for being overly cautious in sentencing.

– This case is about a simple legal issue. Meta asserts that the “bypass” took place with the approval of the DPC. For years, DPC dragged its feet and insisted that Meta could circumvent the GDPR, writes Max Schrems.

In 2022, the DPC first concluded that the clause in the Terms of Service was sufficient to meet the GDPR requirements. The EU’s central data supervisory authority, the EDPS, disagreed with this. The EDPS also disagreed with the rather conservative DPC fines, and insisted on a tenfold increase in fines.

DPC therefore had to turn around.

Meta now has three months to roll out a feature that allows users to make a conscious “yes please/no please” choice whether to consent to personal data being used for advertising purposes.

Contextual advertising, advertising related to the theme of the page you are on, is not affected. Nonetheless, the decision will likely affect the company’s bottom line. Targeted advertising is lucrative and fundamental to the social media business model.

Meta is expected to appeal the decision, but as the case has already been subject to wide European scrutiny, they are unlikely to succeed.

Data Surveillance Threatens Lawsuit Against Data Surveillance

The case was characterized by a power struggle between the Irish Data Protection Authority and the EU’s central data oversight.

Not only has the DPC been overturned on several significant assessments, but the EDPB’s latest ruling contains language that appears to compel the DPC to conduct a new investigation that could include all of the data processing that Facebook and Instagram do.

The DPC reacts to this.

– The decisions of the DPC naturally contain no reference to new investigations, they write and continue:

– The EDPS does not have a general supervisory role over independent national authorities. It is not for the EDPS to instruct and order an authority to engage in open and speculative investigations.

It could be an “excess on the part of the EDPS”, considers the DPC, which threatens “to introduce an action for annulment” to cancel the order.