Meta, Facebook’s parent company, is facing another lawsuit over its data protection and privacy policy. 

A technology and human rights activist, Tanya O’Carroll, has filed a lawsuit against Facebook, saying that her right to object to being surveilled is being ‘disregarded’ by Facebook, and is unlawful under GDPR. 

The lawsuit, filed at London’s High Court, demands that Facebook stop collecting personalised data from users for targeted advertising and marketing purposes. 

O’Carroll says that her attempts to opt out of having her personal information monitored and shared for advertising were dismissed by Facebook. 

Facebook’s terms and conditions require users to accept that their data will be used for advertising – O’Carroll hopes her lawsuit will show that this is unlawful under current data privacy and protection laws. 

Under GDPR, individuals are able to opt in to data collection by companies, and equally, have the “right to object” to data collection. 

The court case could force Facebook’s terms of service to change, as they currently do not allow users to opt out of personalised advertisements and data usage as part of their contract of use.

Surveillance Ads

The main issue that O’Carroll’s lawsuit addresses is the practices Facebook employs to track and collect user data to better target them. 

This targeting is not just to find you that perfect washing machine you’ve been after – Facebook uses sensitive information and categories to target certain demographics with advertisements, and even leave people out of seeing potentially pertinent ads. 

According to Foxglove, Facebook has tracked sensitive information including user’s age, gender, race, religion, political leanings, marital status, and if they have children. 

In the UK, women have been excluded from seeing ads for engineering jobs on Facebook; in the US, non-white users were left out of housing ads.

The Case

O’Carroll says that, even though she selected options to stop Facebook from using her data, the company has continued to do so.

Facebook announced that it would stop and delete targeting ad options on topics people consider ‘sensitive’ and the changes would be complete in March 2022. 

After this deadline, however, O’Carroll found that many sensitive topics were still assigned to her profile. The document of the lawsuit shows that Meta has 708 ‘Ad Topics’ assigned to O’Carroll as of 14 October 2022. 

Topics include: ‘child’, ‘childbirth’, ‘childcare’, ‘wedding’, ‘first-time buyer’ (of homes), ‘activism’, ‘homosexuality’, and ‘Weed, California’. 

From this, Facebook could target personalised ads having to do with weddings, child care products, home-owner loan programmes, or advertisements targeting the LGBTQ+ community. 

Sensitive Ad Interests remained assigned to O’Carroll even after Meta claimed they had scrubbed these from people’s profiles. 

These sensitive topics include: ‘Love’, ‘pleasure’, ‘female’, ‘parent’, ‘ancestry’, ‘self-esteem’, ‘well being’, ‘ethical consumerism’, ‘gender studies’, and ‘politics’. 

The lawsuit states that Facebook has continued to use this personal data to select and deliver ‘Direct Marketing Material.’ 

O’Carroll originally attempted to disable ad settings to stop the application of “demographic and behavioural” categories to her Facebook in February 2021. However, the company continued to use this data, and O’Carroll tried the process again later in June 2021. 

AWO, O’Carroll’s legal representative, sent a letter to Meta in June 2021, objecting to the company’s processing of her data for marketing purposes, directly citing GDPR’s guarantee for the right to object to data processing for marketing. 

Meta responded with their own letter in September 2021, stating that “Personalstation, including personalised advertising, is an essential, contracted-for component of the Facebook service…Users cannot turn off personalisation because this is the essence of the service for which they have contracted.” 

Essentially, Facebook has made the mining of personal data for targeted advertising an integral part of their business model – the social media giant therefore cannot be used by people to simply connect with their friends and family without accepting that their personal data will be used for direct targeted marketing. 

O’Carroll’s case argues that Facebook must allow the ‘right to object’ or it is breaking UK data privacy laws. 

Facebook’s response also brings to question the validity of their ‘Ad Settings’ and ‘Privacy Settings’ section – after all, O’Carroll initially selected settings that Facebook made available. The case argues that it would therefore not be unreasonable for consumers to assume that their selections would be followed by the company. 

Implications

Currently, the UK is planning a break away from GDPR. How similar the UK’s new data policies will be to current legislation is still unclear. 

The information page for the Data Protection and Digital Information Bill 2022-23, which has yet to be formally approved, does state that it would “allow for the sharing of customer data, through smart data schemes, to provide services such as personalised market comparisons and account management.”

Where the line lies on customer data and if consumers have the opportunity, as they do now, to opt in or out of these proposed data sharing schemes, remains to be seen. 

Recommended

• Winners announced at 2022 Scottish Cyber Awards
• Scottish games and tech industry collaboration key to future success
• New broadband project to boost connectivity in the Scottish Highlands

This court case could have major implications going forward – can companies make data collection and personalised ad targeting a valid part of their business model? Or does the public have the right to use unrelated services – like the Facebook social media platform to connect with other users – without having to give up their personal data to the whims of advertisers?

Further, will different advertisers have different abilities to use Facebook’s targeted ad algorithm? 

Previously, Facebook has come under fire for political ads targeting different users based on their personal data, including their race. The Trump campaign reportedly used targeted Facebook ads to stop black voters from participating in the 2020 presidential election. 

The nature of Facebook’s business model has largely kept it immune from such attacks and concerns, as the company continues to flourish despite data privacy violations, leaks, and accusations of being a monopoly. 

Antitrust legislation has targeted Meta – the EU will reportedly charge the company for antitrust violations, and Turkey has done the same.

In September, the Federal Trade Commission of the US filed a lawsuit against the company for its monopolistic tendencies. 

The Competition and Markets Authority (CMA) has called for regulation of Meta, labelling the company, along with Google, as a monopoly. In 2020, it went so far as to label Facebook as a “must-have” mechanism for consumers to stay connected.

This current lawsuit will formally challenge how Meta’s monopoly has essentially placed it above the law in terms of data privacy and protection. 

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.