The European Data Protection Board (EDPB) has issued a binding decision to ban Meta's processing of personal data for behavioural advertising, marking a fundamental shift in how the advertising technology industry can operate in Europe.
The decision applies to Facebook and Instagram users across EU member states and European Economic Area (EEA) countries and stems from a request by Norway's data protection authority, Datatilsynet, to extend a previously issued interim advertising ban in Norway to the whole of Europe. While the existing ban is due to expire on 3 November, Meta has now been given a week to comply with the new ruling. The Irish Data Protection Commission (DPC), Meta's lead supervisory authority in the EU, notified the company of the EDPB's binding decision on 31 October, which means the EU/EEA-wide ban will take effect on 7 November.
In a statement, EDPB Chair Anu Talus said that after a thorough evaluation, the EDPB has directed the DPC to enforce an EU/EEA-wide ban on processing personal data by Meta. This decision comes after the DPC found that Meta had failed to comply with the orders issued at the end of last year. It is, therefore, imperative for Meta to bring its processing methods into compliance and cease all unlawful processing.
In an IAPP article examining the decision, News Editor Joe Duball writes that the decision will have far-reaching implications for the advertising landscape. While the fate of Meta's business model was sealed when the DPC issued its €390 million fine in January, considering the company's place within the advertising space (see lumascape), all adtech companies operating in the EU have been on unofficial notice since that decision. This is particularly the case considering responsibility is shared among processors under the EU General Data Protection Regulation (GDPR). The focus for all the stakeholders should now be to look at some of the tools and business models proposed by privacy sandboxes. According to one contributor, the Norwegian DPA and subsequent EDPB decision should be the "start of a meaningful, industry-driven change in the digital advertising market."
The EDPB's decision comes days after Meta announced that it will offer users in the EU, EEA and Switzerland the choice to pay a monthly subscription to access Facebook and Instagram without any ads.
In a statement to Reuters, a spokesperson for Meta said that EDPB members have been aware for weeks that it had agreed to give users in the region the opportunity to consent to receive behavioural ads and that the company was fully engaged to arrive at a satisfactory outcome for all parties. "This development unjustifiably ignores that careful and robust regulatory process."
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 4,350 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.
