Yes or no? — After $414M fine, Meta tries to avoid seeking user consent for personalized ads Privacy activists explain why asking for consent may be Meta’s only option.

Ashley Belanger – Jan 5, 2023 7:41 pm UTC EnlargeFRANCESCO ZERILLI/ZERILLIMEDIA/SCIENCE PHOTO LIBRARY | Science Photo Library reader comments 4 with 0 posters participating Share this story Share on Facebook Share on Twitter Share on Reddit

For four years, Meta has been battling European Union regulators over how its apps, Facebook and Instagram, collect user data to personalize ads. The key question for regulators was whether Meta’s so-called contract legal basiswhich lumps the user consent agreement into its apps terms of servicesforced its users to choose between consenting to data collection or losing all access to the social platforms.

Yesterday, the EUs lead privacy watchdog, the Irish Data Protection Commission (DPC), finally reached two decisions, deciding that Meta had illegally forced consent from both Facebook and Instagram users. Now, Meta must pay a $414 million fine and update its apps over the next three months to come into compliance with the EUs General Data Protection Regulation (GDPR).

Ars could not immediately reach DPC for comment.

DPC has kept the substance of the decisions confidentialnot even sharing its decisions with complainantsbut in a statement said that Meta is not entitled to rely on the contract legal basis in connection with the delivery of behavioral advertising as part of its Facebook and Instagram services.”

Meta plans to appeal both the substance of the ruling and the fines, providing a statement that says the company strongly disagrees with the ruling. Due to a lack of regulatory clarity, Meta claims that the contractual legal basis that its relied on to gain user consent since 2018 had previously been deemed acceptable by EU regulators. Currently, Meta says the appropriateness of this legal basis under GDPR is still being debated by the highest courts in the EU. Because the matter appears to still be undecided, Meta says that it believes that an appeal will prove that its apps fully comply with GDPRalleging that no app updates are necessary. Advertisement Meta plans to avoid requesting user consent

Shortly after the DPCs decisions were announced, Meta claimed that there has been some inaccurate speculation and misreporting on what these decisions mean.”

Some have speculated that the ruling meant that Facebook and Instagram would have to start asking users to respond yes or no to give consent for data collection used for personalized ads. Recent history suggests that this move would seemingly be unappealing to Meta. When Apple switched to this consent legal basis for data collection, Wired UK reported that the move screwed Facebook by triggering an unstoppable collapse in Facebooks ability to collect user data.

Asked if Meta was considering a consent legal basis, a Meta spokesperson reiterated the companys statement to Ars, saying that the DPCs decisions do not mandate the use of consent.” Instead, Meta would be assessing a variety of options that will allow us to continue offering a fully personalized service to our users, seemingly seeking ways to do so without asking for user consent. Page: 1 2 Next → reader comments 4 with 0 posters participating Share this story Share on Facebook Share on Twitter Share on Reddit Ashley Belanger Ashley Belanger is the senior tech policy reporter at Ars Technica, writing news and feature stories on tech policy and innovation. She is based in Chicago. Email ashley.belanger@arstechnica.com // Twitter @ashleynbelanger Advertisement Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars