The business model of the main social networks, starting with Meta, is at risk: personalized ads on Facebook, Instagram and WhatsApp are in fact to be considered illegal if they have not been authorized in a clear and incontrovertible way by users.

The EDPB, i.e. the European personal data board, has thus agreed with Mark Schrems, the Austrian activist who has been fighting for years for the effective application of the GDPR, and who has almost made a business out of this battle. Among others, the European sentences that brought down the transfer of personal data from Europe to the United States (rightly called Schrems I and II) are attributable to him.

EDPB has essentially adopted a decision whereby Meta cannot force users to undergo personalized ads without their prior consent. The decision is going to affect substantially the business model of the Big Tech of Zuckerberg, also in light of the next developments towards the Metaverse.

It all starts in May 2018, when the GDPR came into force in the EU. At the time Meta had considered that, to legally circumvent the obligation of consent, it was sufficient to insert an ad hoc clause in the conditions of the service, thus referring to the art. 6.1b of the GDPR according to which the processing of data is lawful (thus: it can be done without requesting users’ consent) if it is necessary for the execution of the contract. It sounds like saying that targeted advertising and social networks live in symbiosis, thus somewhat obscuring the lovely story of the “free service”. The issue on the consent is legally complex and therefore Meta’s lawyers will still have to say on the merits.

On 25 May 2018, Schrems’ organisation, Noyb, filed several complaints with national data protection authorities in European countries. Among these, the directly competent one is DPC, the Irish authority, since the European headquarters of the social network are based in Ireland. Being a topic of great importance and which had an impact on the numerous European markets, EDPB was asked to take the lead on the matter (pursuant to Article 65 of the GDPR) and prepare an assessment to be valid for everyone. EDPB has now expressed a decision that will have to be respected by the national authorities, starting from the Irish one. DPC has often been accused of being too light on Big Tech, because, it is said, Ireland would not want to let escape those organizations that have chosen it for tax reasons and that do not disdain benevolent treatment also in terms of privacy. In fact, the subject of Meta’s personalized advertising had been going on for 4 years with the Irish regulator, who even seemed to want to agree with the US giant.

The EDPB has instead rejected this potential approach and has now clarified the legal bases that will have to be respected by DPC for the final decision (to be taken within a month). The Irish authority will have to establish that the consent for personalized advertising cannot be included in the generalized acceptance of the clauses of the social network service, but must be expressed in a distinct and effective way. A hefty fine, in the order of one billion euros, is expected, in addition to the fact that Meta as well as other online operators will have to review the way they advertise.

Remarkably, only targeted advertising has been declared illegal, but the same cannot be said for “contextual” advertising, that is to say the ads we receive consistently with the pages we are visiting: when, for example, I browse on a group of motorbike lovers and ads on the same theme appear. But if I leave the motorcycle page and continue to receive the same ads, then it’s no longer contextual advertising, but targeted.

Certainly Meta will challenge* the decision of the Irish data protection authority and therefore the matter will end up reaching, after various stages of the process, the EU Court of Justice, which will have to rule on the exact interpretation of the art. 6,1b of the GDPR: whether it is legitimate, or not, to assume that joining a social network includes acceptance of personalized advertising. The legal dispute is therefore destined to last for years, the journey has just started.

* One could wonder whether Meta could challenge directly the EPDB’s decision. The answer seems to be negative, because that decision is addressed to DPC, the Irish Authority, not Meta itself. A similar chase has been dealt today December 7, 2022.  The EU General Court dismissed as inadmissible the action brought by WhatsApp against a decision of the EDPB in the case T-709/21, WhatsApp Ireland v European Data Protection Board