EDPB Orders Stop to Meta’s Behavioral Advertising

On October 27, the European Data Protection Board (EDPB) adopted an urgent binding decision that the Irish Data Protection Authority (DPA) must ban Meta from behavioral advertising in the European Economic Area by November 10th. The decision comes at the urging of the Norwegian DPA, which issued a three-month ban on Meta’s behavioral advertising in August which was set to expire November 3. The bans stem from Meta using a faulty legal basis to process personal data for behavioral advertising. Norway, and now the EDPB, determined that legitimate interest and contract could not serve as a legal basis for data processing in this context. Meta has proposed future behavioral advertising based on consent, but this proposal is still being evaluated by the Irish authority and concerned supervisory authorities.

Meta has faced problems with their targeted advertising practices before. Last year, the EDPB ruled that Meta’s terms of service was not enough to allow Meta to collect personal data for targeted advertising. The Irish authority fined Meta €390 million for unlawfully processing personal data under the old system and ordered them to bring their advertising practices into GDPR compliance as well.

EPIC has repeatedly called for a ban on behavioral/targeted/surveillance advertising, co-drafting and signing on to a coalition call for a ban, writing extensively about the reach and harms of surveillance advertising, supporting the Banning Surveillance Advertising Act, and submitting comments in the FTC rulemaking on surveillance advertising.