EU Regulators Rule Against Meta's Use of Personalized Ads

The ruling would still permit Meta to customize advertisements or to request users' agreement to ads via a yes/no choice while using non-personal data. Users must always have the option to revoke their consent, and Meta cannot restrict the service. 

While drastically reducing Meta's revenues in the EU, this decision does not completely forbid ads. Instead, the choice will bring Meta on par with other websites or apps that must provide consumers with a yes/no option.

Although Meta didn’t provide an immediate response to the ruling, a spokesperson for the social media giant said, “This is not the final decision and it is too early to speculate. GDPR allows for a range of legal bases under which data can be processed, beyond consent or performance of a contract. Under the GDPR there is no hierarchy between these legal bases, and none should be considered better than any other. We’ve engaged fully with the DPC on their inquiries and will continue to engage with them as they finalize their decision."

Looking forward, the decision must be delivered to Meta in Ireland and Noyb in Austria within a month, that being January 2023. Meta can then challenge the ruling, although there is little possibility of success once an EDPB judgment has been made.

Numerous class action privacy lawsuits have already been filed against Meta in Europe. Meta had set aside $3 billion for fines related to data protection in 2022 and 2023, the majority of which had not yet been paid. The moment for damages claims will only increase as the GDPR is further enforced.

Update - Meta’s Ad Model Fined $400M

Meta was hit with nearly $400 million in fines after decisions against its Facebook and Instagram platforms on January 4. 

The company also needs to find a new legal foundation for its sprawling targeted advertising model as soon as possible.

After European Union regulators determined that the present legal basis for advertising that Facebook and Instagram utilize is invalid, Meta has three months to legitimize its data-targeting strategy, according to the principal regulatory body for Meta in Ireland. 

The orders put additional strain on Meta's sources of income just as the EU is completing a new set of regulations that will tighten restrictions around online advertising.

A representative for Meta said the tech giant was disappointed with the rulings but emphasized that it has other legal options for processing data and had not intended to rely on user consent.

“We strongly disagree with the DPC’s final decision, and believe we fully comply with GDPR by relying on Contractual Necessity for behavioral ads given the nature of our services. As a result, we will appeal the substance of the decision.” Meta spokesperson said.

Max Schrems responded to Meta that, “This is a huge blow to Meta’s profits in the EU. People now need to be asked if they want their data to be used for ads or not. They must have a ‘yes or no’ option and can change their mind at any time. The decision also ensures a level playing field with other advertisers that also need to get opt-in consent.”