EU Board Rules Meta Can’t Forcibly Collect Personal Data for Behavioral Advertising

Privacy regulators in the European Union ruled this week that Meta may not use its terms of service as a basis to forcibly collect personal data and target ads at Facebook and Instagram users. The decision by the European Data Protection Board could significantly limit the data that Meta can use for behavioral advertising.

The EU’s General Data Protection Regulation generally prohibits companies from forcing users to submit to personal data collection in exchange for a service. Since 2018, Meta has argued that the GDPR’s contractual necessity exception still empowers the company to collect personal data to fulfill its terms of service—and that personal data collection for behavioral advertising is a necessary aspect of the platform. In other words: Meta claims that users are in a contract to receive personalized ads.

But the EDPB rejected Meta’s use of the contractual necessity exception. In a statement, the Board said that the decision settles “the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising[.]”

Enabling consumers to opt out of all behavioral advertising could have a significant impact on Meta’s ad-based business model. Meta argues that it already allows users to opt out of personalized ads, but the current opt-out mechanism only applies to advertising based on a user’s activity on external websites and apps; consumers cannot avoid ads based on user activity from Meta platforms. When Apple recently required iPhone apps to provide users with an easy mechanism to opt out of cross-app tracking, Meta lost $10 billion in ad sales for 2022.

EPIC has long supported protections for the privacy of social media users. EPIC recently submitted comments concerning the Federal Trade Commission’s commercial surveillance rulemaking, urging the FTC to adopt regulations on a number of issues related to behavioral advertising. In addition to calling for a ban on targeted advertising directed at minors, EPIC reiterated its call for the FTC to adopt a data minimization rule to ensure that businesses only collect data consistent with consumer expectations. EPIC explained that “out-of-context secondary uses of data—including its sale to and use by data brokers, surveillance advertising firms, and other entities trafficking in consumer profiles—and the overcollection that feeds them are inconsistent with the reasonable expectations of online consumers.”