After $414M fine, Meta tries to avoid seeking user consent for personalized ads

For four years, Meta has been battling European Union regulators over how its apps, Facebook and Instagram, collect user data to personalize ads. The key question for regulators was whether Meta’s so-called contract legal basis—which lumps the user consent agreement into its apps’ terms of services—forced its users to choose between consenting to data collection or losing all access to the social platforms.

Yesterday, the EU’s lead privacy watchdog, the Irish Data Protection Commission (DPC), finally reached two decisions, deciding that Meta had illegally forced consent from both Facebook and Instagram users. Now, Meta must pay a $414 million fine and update its apps over the next three months to come into compliance with the EU’s General Data Protection Regulation (GDPR).

Ars could not immediately reach DPC for comment.

DPC has kept the substance of the decisions confidential—not even sharing its decisions with complainants—but in a statement said that Meta “is not entitled to rely on the ‘contract’ legal basis in connection with the delivery of behavioral advertising as part of its Facebook and Instagram services.”

Meta plans to appeal both the “substance of the ruling and the fines,” providing a statement that says the company “strongly” disagrees with the ruling. Due to “a lack of regulatory clarity,” Meta claims that the contractual legal basis that it’s relied on to gain user consent since 2018 had previously been deemed acceptable by EU regulators. Currently, Meta says the appropriateness of this legal basis under GDPR is still “being debated by the highest courts in the EU.” Because the matter appears to still be undecided, Meta says that it believes that an appeal will prove that its apps “fully” comply with GDPR—alleging that no app updates are necessary.

Meta plans to avoid requesting user consent

Shortly after the DPC’s decisions were announced, Meta claimed that there has been some “inaccurate speculation and misreporting on what these decisions mean.”

Some have speculated that the ruling meant that Facebook and Instagram would have to start asking users to respond “yes or no” to give consent for data collection used for personalized ads. Recent history suggests that this move would seemingly be unappealing to Meta. When Apple switched to this consent legal basis for data collection, Wired UK reported that the move “screwed” Facebook by triggering “an unstoppable collapse” in Facebook’s ability to collect user data.

Asked if Meta was considering a consent legal basis, a Meta spokesperson reiterated the company’s statement to Ars, saying that the DPC’s decisions “do not mandate the use of consent.” Instead, Meta would be “assessing a variety of options that will allow us to continue offering a fully personalized service to our users,” seemingly seeking ways to do so without asking for user consent.

https://arstechnica.com/?p=1908035