META, behavioural advertising & why it should matter to you beyond META.
It’s been a while since we checked in on the noyb case against META, and the developments, in this case, are well worth telling.
Firstly, describing a little digital marketing jargon and informing you about behavioural advertising is essential.
In a very simplistic explanation, behavioural advertising tracks surfing behaviours and feeds you content based on your surfing behaviours.
The legal issue was lodged with the Irish Data Protection Commission (DPC) back in 2018 by privacy campaigners noyb, which took umbrage at the legal basis META listed for tracking people’s surfing behaviours.
(Why Ireland? Because it is where META chose to house their EU HQ).
Sticking to the legal facts, before we get into the intra-data protection authorities fighting element, the legal basis that META wanted to use in this case was that it held a “contract” with the users.
The original decision that the Irish DPC settled on was a mixed bag, which looked to be very pro-META. Although it proposed a fine on Facebook of $36 million, which would only reportedly take them a couple of hours of revenue to pay, it still allowed Facebook to mock the GDPR by claiming users are giving it their data because they’re in a contract with Facebook to get, targeted advertising.
Other data protection authorities (DPAs), including the Austrian, Dutch, French, German, Italian, Norwegian, Polish, Portuguese and Swedish authorities, raised formal objections against the Irish DPC decision. However, under the GDPR legal mechanism, cross-border complaints and investigations are led by a single authority; typically where the company in question has its legal base in the EU.
So what happens when DPA’s fall out?
They call in big momma, the EDPB.
The European Data Protection Board (EDPB) is an independent European body, which contributes to the consistent application of data protection rules throughout the European Union, and promotes cooperation between the EU’s DPAs; well, that is what their website says! But this may be the first significant fallout between DPA’s
Since they were unable to “play nicely” with each other, big momma stepped in and delivered a ruling:
Meta Ireland Ltd. believed it could bypass the GDPR requirement to get opt-in consent from users by simply adding a provision in the terms and conditions. The EDPB has decided that Meta cannot force users to agree to personalised ads, and Meta may not use personal data for ads based on an alleged “contract”. Users, therefore, need to have a yes/no consent option.
The EDPB has overturned a previous draft decision by the Irish DPC that believed that Meta’s bypass of the GDPR was legal. It also decided that Meta cannot force WhatsApp users to agree to use their data for “service improvements” and “security”.
The EDPB further requested a substantial fine. Ordering the Irish DPC to quantify how much revenue Meta had generated by infringing the GDPR and to factor that sum into its fine. The Irish DPC responded, stating “the Commission is unable to ascertain an estimation of the matters” and that it is, therefore “, unable to take these matters into account”. This is despite having the power to demand such information from Meta under Article 58(1) of the GDPR.
The binding decision that the EDPB issued stated the use of data for “the purposes of behavioural advertising, for marketing purposes, as well as for the provision of metrics to third parties and the exchange of data with affiliated companies” must be investigated.
The decision issued by the Irish DPC and the ruling made by the EDPB are not aligned, so this issue will continue on several fronts, including a challenge from noyb concerning their original legal challenges not being answered.
The EDPB ruling will eventually have to be followed, so in the not-so-distant future behavioural advertising will be a restricted practice, if not outlawed, in the EU and UK, across all organisations, not just META and its’ related organisations. Adtech as an industry will be changing.
So why should this legal decision matter to you and your business?
Behavioural advertising is a dark art that infringes on your personal information rights. So what’s the next method of getting adverts in front of the people who want to see the next product or service? It could be “Contextual advertising”.
Contextual and behavioural targeting is similar, albeit different. Whereas behavioural advertising tracks surfing behaviours, contextual ads are determined by the environment in which the audience is browsing.
Your cookies are also a part of this issue! The information about your surfing behaviours is stored in these little bytes of internet activity. Although the legal questions about cookies have yet to be answered, we will see further challenges and appeals around the hungry META machine gobbling up your behaviours.
