The recent binding decision from the European Data Protection Board on Meta's personalized advertising practices might just be the tip of the iceberg for advertising technology companies and ad-based business models in the EU.
Industry-wide impacts are expected from the decision and the potential enforcement of Meta's move to an ad-free subscription model for EU Facebook and Instagram users aimed at rectifying EU General Data Protection Regulation violations. But EU data protection authorities are prepared to put the industry under a microscope beyond Meta's practices.
Regulators from Belgium, France and Germany made clear at the IAPP Europe Data Protection Congress that adtech privacy changes are imminent, going as far as indicating the potential demise of personalized advertising across the board.
Berlin Commissioner for Data Protection and Freedom of Information Meike Kamp said the mounting decisions against targeted advertising in the GDPR contexts of legal basis of a contract, legitimate interest and consent are creating "very, very strong doubts" that companies can arrive at lawful practices with their "very intensive profiling of behavioral data."
Kamp was referring to separate decisions by the EDPB and Ireland's Data Protection Commission against Meta that found performance of a contract to conduct personalized advertising did not meet GDPR standards. Additionally, the Court of Justice of the European Union ruled in July that Meta "cannot justify, as a legitimate interest," data processing for personalized advertising "in the absence of the data subject's consent."
"I think it's quite interesting nowadays because it seems that all of the sudden stakeholders are realizing the implementation of the GDPR is effective," said Bertrand du Marais, a commissioner at France's data protection authority, the Commission nationale de l'informatique et des libertés. "I would like to stress though that this implementation is most effective and not detrimental."
Unlike Kamp, du Marais would not go as far as saying personalized advertising could not continue. He said the CNIL and other authorities should "deal with this on a case-by-case basis," noting there are dependent and variable factors that require consideration in a given case.
The Meta domino effect
The viability of behavioral advertising in the EU may well hinge on where authorities land with Meta's "pay or OK" consent-based subscription. Norway's Datatilsynet, which forced the EDPB's binding decision on Meta via its own national decision, has already pre-judged the subscription model as noncompliant without discussion with board members.
However, the EDPB dialogue on the matter is ongoing with no definitive timeline for a decision. In the meantime, Meta is moving forward with its plan under the theory of compliance.
"There will be some kind of common view on this by the European authorities soon, but the view is not there yet," Belgium Data Protection Authority Litigation Chamber President Hielke Hijmans said. "I think it's really important that we do this together as DPAs and not as one."
Despite the ongoing EDPB review, Hijmans did not shy away from his take on Meta's plan. He discussed the clear choice being given to Facebook and Instagram users, but implied other outstanding issues remain.
"You can say it's 10 euros a month and also say maybe you need to pay once a year. But if you're a teenager and you want access you have to pay 156 euros at once. That's quite a lot money," Hijmans said.
Plus, Hijmans asked, "What happens to the data which has already been collected in the past? Will it still be used for profiling? Those are questions I think we have to pay attention t0."
Alternative services at a cost is potentially permissible under the CJEU July ruling, which did not explicitly rule against providing such an option to maintain targeting practices.
Du Marais leaned into the idea that a shift to subscription models is a sign of "an evolution of the business model and the market for social networks," while indicating recent studies suggest this "segmentation" is "favorable to consumer privacy."
The subscription model is in fact not about advertising in general, but data collection that fuels those ads. Bearing that in mind, Kamp said "business as usual" will "probably not be possible" given the requirements of the GDPR do not change based on a user payment or consent.
"If you're paying, there's still the question of what happens to your data? And how far can this data be used for any kind of purpose," Kamp said, falling back to Article 6(1) of the GDPR and whether legitimate interest can be applied. "If you're not paying and giving consent … then this will still have half the GDPR to be applicable to that concept."
