The EDPB adopts an urgent and binding decision to ban behavior-based advertising practices by Meta in Europe
El European Data Protection Board (EDPB) adopted, on October 27, a binding and urgent decision urging the Irish data protection authority to impose Meta Ireland, within two weeks, the prohibition of the processing of personal data for advertising based on the behavior of its users throughout the European Economic Area (EEA).
This decision, adopted following a request from the data protection authority in Norway in July 2023 (which ordered Meta to stop processing user data for the purpose of sending them targeted advertising), is based on the fact that the legal bases adopted (execution of the contract and legitimate interest) are insufficient to justify the processing of data, considering it a violation of the GDPR.
According to Anu Talus, president of the EDPB, “already in December 2022, the binding decisions of the EDPB clarified that the contract is not an adequate legal basis for the processing of personal data carried out by Meta for behavioral advertising”. In addition, it states in its statement that the European Data Protection Commission has found that Meta has not demonstrated compliance with the orders imposed at the end of last year. It's time for Meta to bring its treatment into compliance and put an end to illegal treatment.”
In response, meta announced to the market on October 30, the same day it received notification of this decision, the proposal to implement a paid subscription category for the use of its products, worth 9.99 euros per month, for those who do not want their personal data to be processed for the purpose of segmented advertising.
The company states that users who do not wish to pay for the subscription will be able to continue using the platforms free of charge as long as they accept that their data will be processed for this purpose. The EDPB has commented that it will be necessary to carry out a new evaluation of this new proposed strategy to evaluate the legality of the collected consent.