Meta Fined for Serving European Users Personalized Ads in Violation of Privacy Law

The tech giant may be forced to change the way it handles personalized ads on Facebook and Instagram in the EU.

Katie Collins Senior European Correspondent
Katie a UK-based news reporter and features writer. Officially, she is CNET's European correspondent, covering tech policy and Big Tech in the EU and UK. Unofficially, she serves as CNET's Taylor Swift correspondent. You can also find her writing about tech for good, ethics and human rights, the climate crisis, robots, travel and digital culture. She was once described a "living synth" by London's Evening Standard for having a microchip injected into her hand.
Katie Collins
2 min read
Mark Zuckerberg in front of EU flag

Meta begins the year with a privacy fine.

Ohn Thys/AFP via Getty Images

What a way to start the year for Meta. On Wednesday, the company was hit with more fines after being found to have violated European privacy laws by serving people personalized ads without their consent. 

The Irish DPC, which has jurisdiction over Meta in Europe, announced that it was closing two investigations into the company, tying them up with a final bill of more than 390 million euros ($414 million). In addition to the fines, the company will be required to make changes to its ad business in the European Union.

The DPC's decision represents a landmark ruling under Europe's General Data Protection Regulation, or GDPR, the sweeping EU privacy law that came into effect in 2018. It could undercut Meta's business across Facebook and Instagram across the bloc. The company will still be able to serve personalized ads, but according to the ruling must seek a binding contractual agreement to process people's data for this purpose.

In a blog post published on Wednesday, Meta said it was disappointed in the DPC's decision, as it previously found no problems with Meta's approach to personalized ads. "We strongly believe our approach respects GDPR," the company said, adding that it intends to appeal both the substance of the rulings and the fines.

Meta has also complained that the debate around the legal bases in this case has been ongoing for some time, with companies, including itself, lacking regulatory certainty. The DPC had originally agreed with Meta on its interpretation of the law, but was later overruled by a board made up of representatives of other EU member states.

The complaint against Meta's ad model can be traced back to 2018, when lawyer and privacy activist Max Schrems raised it with the DPC. He was especially concerned that users were not being presented with a specific option to say yes or no to personalized ads -- instead it was included in Meta's terms and conditions.

On Wednesday, Schrems said in a statement that the DPC's decision was a huge blow to Meta's profits in the EU. "People now need to be asked if they want their data to be used for ads or not," he said. "They must have a 'yes or no' option and can change their mind at any time. The decision also ensures a level playing field with other advertisers that also need to get opt-in consent."