Latest European privacy crackdown results in 390M euro fine for Meta

61

On Wednesday, Meta, the parent company of Facebook, was hit with hundreds of millions of euros in fines by European Union regulators for privacy violations. The company was also banned from forcing users in the EU to agree to personalized ads based on their online activity. The Irish Data Protection Commission imposed two fines totaling 390 million euros ($414 million) in its decision, which could potentially disrupt Meta’s business model of targeting users with ads based on their online activity. Meta plans to appeal the decision. A third case involving Meta’s WhatsApp messaging service is expected to be decided on later this month.

Meta and other Big Tech companies have come under scrutiny from the EU’s strict privacy rules. Irish regulators have already imposed four other fines on Meta for data privacy violations totaling more than 900 million euros and have numerous other open cases against several Silicon Valley companies. In addition, Meta faces regulatory challenges from EU antitrust officials in Brussels, who accused the company of distorting competition in classified ads last month.

The Irish watchdog, which serves as Meta’s lead EU data privacy regulator because its regional headquarters is located in Dublin, fined the company 210 million euros for violating EU data privacy rules involving Facebook and an additional 180 million euros for breaches involving Instagram. The decision is based on complaints filed in May 2018 when the EU’s privacy rules, known as the General Data Protection Regulation (GDPR), took effect.

Prior to GDPR, Meta obtained informed consent from users to process their personal data in order to serve them with personalized, or behavioral, ads based on their online searches, website visits, and video clicks. However, when GDPR was implemented, Meta changed the legal basis for processing user data by adding a clause to the terms of service for advertisements, effectively forcing users to agree to the use of their data. This action violates EU privacy rules.

The Irish watchdog initially sided with Meta but changed its stance after its draft decision was sent to a board of EU data protection regulators, many of whom objected. In its final decision, the Irish watchdog stated that Meta “is not entitled to rely on the ‘contract’ legal basis” to deliver behavioral ads on Facebook and Instagram.

In a statement, Meta said, “we strongly believe our approach respects GDPR, and we’re therefore disappointed by these decisions and intend to appeal both the substance of the rulings and the fines.” Meta has three months to ensure that its “processing operations” comply with EU rules, although the ruling does not specify what actions the company needs to take. Meta pointed out that the decision does not prevent it from displaying personalized ads, but only covers the legal basis for handling user data.

Max Schrems, the Austrian lawyer and privacy activist who filed the complaints, believes that the ruling could significantly impact Meta’s profits in the EU because “people now need to be asked if they want their data to be used for ads or not” and can change their mind at any time. Schrems added, “The decision also ensures a level playing field with other advertisers that also need to get opt-in consent.”

Implementing changes to comply with the decision could increase costs for Meta, which is already facing growing business challenges. The company reported two consecutive quarters of declining revenue due to a drop in advertising sales caused by competition from TikTok, and it laid off 11,000 workers amid broader tech industry struggles.