In September, Norway's data protection authority officially requested the European Union regulator to issue a binding decision on the emergency sanctions imposed on Facebook and Instagram for tracking and profiling users without consent. This could become a permanent measure applied throughout the entire EU single market, rather than just locally.
If the European Data Protection Board (EDPB) agrees with this request, it could potentially lead to a complete ban on Meta running tracking advertisements without user consent across the entire EU.
|
“We are disappointed by today’s decision and will now consider our next steps,” -Meta (Source: Reuters) |
Previously in July, the Datatilsynet (Norwegian data protection authority) had imposed a local ban on Meta's tracking and profiling practices without consent, citing powers under the General Data Protection Regulation (GDPR). These measures were temporary, lasting for three months and applied to their market to urgently protect citizens' data. While the Irish Data Protection Commission (DPC) remains the lead regulator for GDPR compliance by Meta, the Norwegian DPA's emergency actions allowed them to bypass the "one-stop-shop" mechanism and refer ongoing concerns to the EDPB, as they have now done.
|
“Meta continues to process personal data unlawfully throughout the EEA. Referring the matter to the EDPB is the only way to ensure that Meta respects Facebook and Instagram users’ rights” -Tobias Judin, Head of International department, Datatilsynet (Source: Datatilsynet) |
In August, Meta announced its intention to transition to obtaining user consent for its tracking ads in the EU but has not yet done so. In response to the DPA's referral to the EDPB, a Meta spokesperson stated that they are in active discussions with data protection authorities and will share more information in due course but did not specify a timeframe for the transition to consent-based advertising.
In summary, Meta is facing increased scrutiny and potential regulatory action in the EU, which may force it to end its practice of tracking and profiling users without their consent, a practice that has fueled its adtech business for years at the expense of user privacy.
In addition to the EU's consideration of a ban, the company is grappling with uncertainties surrounding the legality of its international data transfers in accordance with the General Data Protection Regulation (GDPR).
Moreover, it has been officially identified as one of the prominent "gatekeeper" firms subject to the Digital Markets Act. This designation obliges Meta to fully adhere to the Act's provisions by March 2024.
What do you think about giving consent to advertisements shown by Meta? Join the conversation in our Yes We Trust community, a free discussion group for data privacy professionals and enthusiasts, on LinkedIn: