Photo: Sergei Elagin (Shutterstock)
According to reports published in the Wall Street Journal and Portal on Tuesday, data protection authorities in the European Union have ruled that Meta, the parent company of Facebook and Instagram, does not make giving up data for targeted advertising a condition of joining the social network can make. The decision threatens to turn the social media giant’s business model on its head and alter the financial foundations of the internet.
Signing in to Facebook or Instagram means you click past a privacy policy and consent to digital monitoring of social networks for advertising purposes. If you do not agree, you cannot have an account. But a panel of European data protection regulators on Monday issued a series of new decisions declaring that this type of enforced consent violates the General Data Protection Regulation (GDPR), the EU’s comprehensive data protection law.
Although the verdict was not made public, key details were released to the press on Tuesday. The decision would not only affect meta. Any company that serves targeted ads operates in a similar way to the social media giant. You can sometimes opt out of having data from other parts of the internet used for social media advertising, but the new rule seeks to prevent companies from using the data they collect on their own networks. It would be a sea change in how privacy works online.
“Upholding the EU regulators’ decision would have a dramatic impact on Meta’s revenues in Europe and would affect its ability to use information about its users’ activities on the platform to sell targeted advertising,” said Debra Aho Williamson. a senior analyst at Insider Intelligence, in an email. “However, we anticipate that Meta will fight vigorously to defend its business and it could be months, if not years, before the impact is really felt.”
Meta did not immediately respond to a request for comment on the ruling.
The ruling doesn’t immediately force Meta to change its practices. Instead, it is asking the Irish Data Protection Commission to issue specific orders within a month, which are likely to include significant fines, Portal reported. Meta is also likely to appeal the decision, which could allow the status quo to continue during the litigation.
But depending on the verdict, it could mean Meta and other companies it owns need to get real, informed consent before chewing up all of your personal information and spewing out ads. How would that look? Its not clear yet.
When people are given the choice of being tracked online (and still using a particular website or app), they tend to say no. Last year Apple introduced a privacy setting that forces apps to ask permission before tracking users, “Ask App not to Track”. The vast majority of people say no, and Meta’s business took a nosedive as a result — the company said it lost $10 billion thanks to Apple’s privacy settings alone. An EU ruling against Meta could mean a financial crisis for the company, whose share price has already fallen like a stone this year. Meta’s stock fell 6.79% Tuesday after the close of trade news.
But the verdict is probably a lot bigger than meta. Many other companies, from Google to TikTok to smaller players, operate under a similar legal model: consent to targeted ads or use another platform. It’s unclear how far the EU ruling would apply across the continent, but it’s possible that one of the fundamental models of online business will be disrupted.
The open secret of the tech industry is that many companies, apps, and websites haven’t found a way to make money aside from collecting data and targeting ads. If companies can’t use your data, they can still show you “contextual” ads based on the content you’re looking at (imagine an ad for Honda in an article about cars). However, contextual advertising is cheaper than ads tailored to your personal information and therefore less profitable for the company to sell.
An EU ruling will only have a direct impact on companies operating in the EU, but it’s a sign that governments may finally be changing their minds when it comes to data protection. So far, lawmakers have been willing to pass privacy rules that make certain data practices more cumbersome for the business community, but this is the first time a major government agency has taken steps to limit targeted advertising entirely.
But the GDPR serves as a model for privacy laws in the United States and around the world. If this strict interpretation of the law succeeds — however you define success — it could portend a far more private future.