EDPB Clarifies Ban on Meta’s Processing of Personal Data for Targeted Advertising

On November 10th, the Irish Data Protection Agency, on behalf of the European Data Protection Board (EDPB), declared a ban on Meta’s processing of personal data for targeted advertising across the European Economic Area (EEA). In response, Meta announced a paid subscription option for consumers in EEA countries that did not serve targeted ads, while allowing consumers to use their services unchanged for free. On December 7th, the EDPB clarified that a contract is not a legitimate purpose for Meta’s processing of personal data, thereby striking down the subscription service model.

Meta has faced problems with their targeted advertising practices before. Last year, the EDPB ruled that Meta’s terms of service was not enough to allow Meta to collect personal data for targeted advertising. The Irish authority fined Meta €390 million for unlawfully processing personal data under the old system and ordered them to bring their advertising practices into GDPR compliance as well.

EPIC has repeatedly called for a ban on behavioral/targeted/surveillance advertising, co-drafting and signing on to a coalition call for a ban, writing extensively about the reach and harms of surveillance advertising, supporting the Banning Surveillance Advertising Act, and submitting comments in the FTC rulemaking on surveillance advertising.