Meta announces a change in the legal basis for delivering ads based on its users’ personal data

Meta announces a change in the legal basis for delivering ads based on its users’ personal data

Behavioural advertising by Meta is once again in the spotlight. However, what’s surprising this time is that it appears to be a hopeful development, which has been cautiously welcomed by data protection expert associations.

This concerns the decision to change the legal basis for justifying the processing of personal data required to provide behavioural advertising to its users. In this way, the current and widely questioned legitimate interest would become obsolete, and instead, user consent would be applied.

Behavioural advertising: what is it, and why is it causing so many problems for Meta?

The advancement of technology has led to the evolution of marketing practices so that businesses can better understand the tastes or preferences of their target audience and how to effectively reach or influence them. In this context, continuous observation of the target audience and their behaviour (such as the websites they visit, previously purchased products, or interests displayed on social media) helps brands determine their preferences with relative accuracy and show them the most relevant ads.

The truth is that this practice, known as behavioural advertising, is widely adopted among internet giants, although it’s not without controversy.

Background that may have justified this decision

The seed for this decision may lie in the €390 million fine imposed by the Irish Data Protection Authority in December 2022 on the platform for processing personal data necessary to provide behavioural advertising to its users using the contractual necessity as the legal basis under Article 6.1.b) of the General Data Protection Regulation.

This decision revealed something that had been evident for years: personal data cannot be considered a marketable product in a way that allows its fundamental right to data protection to be exchanged or traded through a contract.

Following this setback, the platform announced in March 2023 that it would change its privacy policy to support the processing of data subject to the fine under Article 6.1.f), i.e., its legitimate interest.

However, doubts about the suitability of this decision arose, as the Italian Data Protection Authority had already halted TikTok in July 2022 when it attempted to take the same path, believing it violated European and national data protection laws.

Several months after Meta implemented the change in legal basis, the Norwegian Data Protection Authority announced that it would temporarily ban the platform from processing its users’ personal data for the purpose of delivering behavioural advertising.

To ensure compliance with its decision, the Norwegian authority would impose a fine of nearly €89,000 for each day that Meta violates the aforementioned ban.

This decision, which has been in effect since August 14, has been seen as a blow to the internet giant, which, in response, has requested the Norwegian courts to temporarily suspend this penalty.

What are the implications of Meta’s new decision?

In this context, Meta announced at the beginning of August its decision to take a new approach, namely, to request consent to process certain information for the purpose of delivering behavioural advertising.

Although details of how this change will be implemented or when it will occur have not been confirmed yet, this decision has been celebrated and viewed positively by many who believe that it will mean Meta will stop using its users’ data to profit and promote consumerism among them without obtaining their prior consent and/or ensuring they are at least aware of the implications of publishing their personal data on platforms like Facebook or Instagram.

However, others urge caution, as Meta has not yet disclosed the details of the method it will use to obtain user consent, and some fear, given its history of data protection abuses, that it will be implemented incorrectly or involve “dark patterns”, that is, unethical techniques designed to influence users into giving their consent (e.g., avoiding providing all the necessary information, including it in fine print that is difficult to read, etc.).

At Letslaw by RSM we are specialists in personal data protection, and we can help you make your international transfers safely.