In July, Datatilsynet, the national Data Protection Authority (DPA) for Norway, imposed a temporary ban on “behavioral advertising” on the U.S. tech giant Meta, the parent company of Facebook and Instagram, until October.
Now, the European Data Protection Board (EDPB) has agreed to extend this temporary ban on behavioral advertising on Facebook and Instagram to cover all 30 countries in the European Union and the European Economic Area (EEA). The urgent binding decision followed a request from the Norwegian Data Protection Authority (NO DPA).
For those unaware, behavioral advertising targets users’ web-browsing behavior based on their location, the content they are interested in, what they publish, and so on. This allows advertisers to build personalized profiles for targeted advertising based on users’ online activity and estimated locations.
On October 27, 2023, the EDPB instructed the Data Protection Commission (DPC) in Ireland, where Meta’s European headquarters are located, to impose a permanent ban on the processing of personal data for behavioral advertising on the legal basis of contract and legitimate interest across the entire EEA within two weeks.
Meta was notified about the EDPB’s urgent binding decision by the Irish DPC on October 31, 2023. The Californian giant has one week to comply with the order once the Irish data regulator finishes evaluating the company’s proposal.
“After careful consideration, the EDPB considered it necessary to instruct the IE SA to impose an EEA-wide processing ban, addressed to Meta IE. Already in December 2022, the EDPB Binding Decisions clarified that contract is not a suitable legal basis for the processing of personal data carried out by Meta for behavioural advertising,” EDPB Chair Anu Talus said in a statement.
“In addition, Meta has been found by the IE SA to not have demonstrated compliance with the orders imposed at the end of last year. It is high time for Meta to bring its processing into compliance and to stop unlawful processing.”
In response to this development, Meta on Wednesday said it had already notified that it intends to provide EU and EEA users with the opportunity to consent to behavioral advertising. It also has plans to offer a subscription model in November that complies with the regulatory requirements.
“EDPB members have been aware of this plan for weeks and we were already fully engaged with them to arrive at a satisfactory outcome for all parties. This development unjustifiably ignores that careful and robust regulatory process,” the company spokesperson said, expressing disappointment over the decision.
This extension of the ban has substantial implications for Meta, as it is already subject to daily fines in Norway of 1 million crowns ($90,000) for using the personal data of users for targeted ads without their explicit consent.
Previously, the Norwegian data regulator, Datatilsynet, had referred the ongoing fine to the European regulator, as the fine was valid only in Norway and scheduled to expire on November 3, 2023. With the EDPB’s decision, the fine will now be made permanent.
The ban on behavioral advertising is estimated to affect approximately 250 million Facebook and Instagram users in Europe.
