Privacy regulators in the European Union have ruled that Meta, parent company of Facebook and Instagram, canât make giving up data for targeted ads a condition of joining the social networks, according to reports published Tuesday in theWall Street Journal andReuters. The decision threatens to upend the social media giantâs business model and alter the financial underpinnings of the internet.
Signing up for Facebook or Instagram means clicking past a privacy policy and consenting to the social networksâ digital surveillance for advertising purposes. If you donât agree, you canât have an account. But the European Data Protection Board (EDPB) made up of all of Europeâs privacy regulators issued a series of new decisions Monday reportedly declaring that this kind of coerced consent violates theGeneral Data Protection Regulation (GDPR), the EUâs sweeping privacy law.
The EDPB confirmed it had reached a binding decision about the legality of data collection on Facebook, Instagram and WhatsApp in apress release, but hasnât made the contents of the ruling public. However, key details leaked to the press Tuesday.
The decision wouldnât just affect Meta. Every company that serves targeted ads works in much the same way as the social media giant. You can sometimes opt out of having data from other parts of the internet used for advertising on social media, but the new ruling seeks to limit companies from using the data they collect on their own networks. It would be a sea change to how privacy works online.
âThe EU regulatorsâ decision, if it is upheld, would have a dramatic impact on Metaâs revenue in Europe, kneecapping its ability to use information about its usersâ on-platform activities in order to sell targeted advertising,â said Debra Aho Williamson, a principal analyst at Insider Intelligence, in an email. âHowever, we expect Meta to fight vigorously to defend its business, and it could be months, if not years, before any impact is truly felt.â
Meta did not respond to a request for comment on the ruling.
The ruling doesnât immediately force Meta to change its practices. Instead, it calls on Irelandâs Data Protection Commission to issue specific orders within a month, which are likely to include substantial fines, Reuters reported. Meta will likely appeal the decision as well, which may allow the status quo to continue during litigation.
But depending on how the ruling plays out, it could mean that Meta and other companies it owns have to get real, informed consent before they chew up all your personal information and spit out ads. What would that look like? Itâs not clear yet.
When people are presented with a choice of whether to be tracked online (and still use a given site or app), they tend to say no. Over the last year, Apple rolled out a privacy setting which makes apps ask permission before they track users, âAsk App not to Track.â The vast majority of people say no, and Metaâs businesstook a nosedive as a resultâthe company said it lost $10 billion thanks to Appleâs privacy setting alone. An EU ruling against Meta could spell financial crisis for the company, whose share price has already fallen like a rock this year. Metaâs stock was down 6.79% at the closing bell Tuesday after the news.
But the ruling is likely far bigger than Meta. Lots of other companies, from Google to TikTok to smaller players, operate via a similar legal model: consent to targeted ads or go use some other platform. Itâs unclear how widely the EU ruling would apply across the continent, but itâs possible that one of the foundational models of online business could be disrupted.
The open secret of the tech industry is lots of companies, apps and websites havenât come up with a way to make money aside from harvesting data and targeting ads. If companies canât use your data, they can still show you âcontextualâ ads, which are based on the content youâre looking at (imagine an ad for Hondaâs on an article about cars). But contextual advertising is cheaper than ads tailored via your personal information, and therefore less profitable for the companies selling it.
An EU ruling only has a direct effect on businesses operating in the EU, but itâs a sign that governments may finally be changing their tune when it comes to privacy. So far, lawmakers have been willing to pass privacy rules that make certain data practices more cumbersome for the business world, but this is the first time that a major government body has taken steps to curtail targeted ads outright.
But the GDPR serves as a model for the privacy laws in the United States and across the globe. If this strict interpretation of the law is successfulâhowever you define successâit could hint at a far more private future.
Update 12/07/21, 12:05 p.m. ET: This story has been updated with details about a press release from the European Data Protection Board.
