Meta Fined for Serving European Users Personalized Ads in Violation of Privacy Law
The tech giant may be forced to change the way it handles personalized ads on Facebook and Instagram in the EU.
Meta begins the year with a privacy fine.
What a way to start the year for Meta. On Wednesday, the company was hit with more fines after being found to have violated European privacy laws by serving people personalized ads without their consent.
The Irish DPC, which has jurisdiction over Meta in Europe, announced that it was closing two investigations into the company, tying them up with a final bill of more than 390 million euros ($414 million). In addition to the fines, the company will be required to make changes to its ad business in the European Union.
The DPC's decision represents a landmark ruling under Europe's General Data Protection Regulation, or GDPR, the sweeping EU privacy law that came into effect in 2018. It could undercut Meta's business across Facebook and Instagram across the bloc. The company will still be able to serve personalized ads, but according to the ruling must seek a binding contractual agreement to process people's data for this purpose.
In a blog post published on Wednesday, Meta said it was disappointed in the DPC's decision, as it previously found no problems with Meta's approach to personalized ads. "We strongly believe our approach respects GDPR," the company said, adding that it intends to appeal both the substance of the rulings and the fines.
Meta has also complained that the debate around the legal bases in this case has been ongoing for some time, with companies, including itself, lacking regulatory certainty. The DPC had originally agreed with Meta on its interpretation of the law, but was later overruled by a board made up of representatives of other EU member states.
The complaint against Meta's ad model can be traced back to 2018, when lawyer and privacy activist Max Schrems raised it with the DPC. He was especially concerned that users were not being presented with a specific option to say yes or no to personalized ads -- instead it was included in Meta's terms and conditions.
On Wednesday, Schrems said in a statement that the DPC's decision was a huge blow to Meta's profits in the EU. "People now need to be asked if they want their data to be used for ads or not," he said. "They must have a 'yes or no' option and can change their mind at any time. The decision also ensures a level playing field with other advertisers that also need to get opt-in consent."