Under the direction of EU regulators, Meta is to change its legal basis for targeting users with personalised advertisements, and will now require consent.

Users in the EU, European Economic Area and Switzerland will be asked for consent, in the form of choosing to opt-in or opt-out of targeted advertising on Facebook and Instagram.

The move comes after pressure from the EU over Meta’s previous legal basis for targeted advertising, which relied on ‘Legitimate Interest’ to track user data for personalised advertisements.

Legitimate interest is one of the broadest legal basis companies can use for processing data, but does have strict limitations. Essentially, it means that companies have the ability to process data in a way users would expect, in a way that is integral to their business, or in a way that would be necessary for security purposes.

Meta only changed their legal basis for personalised advertisements to ‘legitimate interest after a landmark fine in January which found their previous use of a contractual basis as in violation of GDPR.

The move then relied on legitimate interest of users and the company as a legal basis for collecting user data for targeted ads, with the company saying users had the option to “opt-out” of the tracking.

After this, another case saw the EU Court of Justice say Meta could not use ‘legitimate interest’ as a valid legal basis to continue using consumer data for personalised advertisement.

Facebook and Instagram both rely on money from advertisers – Facebook made $135.94 billion in revenue from ads in 2022 alone.

Meta now says that it is making the change after listening to concerns from the Irish Data Protection Court (DPC) and the EU Data Protection Board (EUDPB), but in reality, they are listening to strict rulings which found the major tech company to be GDPR non-compliant.

Recommended

• Meta Found to be Non-Compliant in Landmark GDPR Case
• Meta hit with €17m GDPR Fine for Breaching EU Data Privacy Laws
• Survey: 58% of Firms Have Had a GDPR-related Data Breach

Importantly, Meta refers to not using personal data for “behavioral advertisement” which is not defined in EU law, and says the legal basis will change for how it processes “certain” data for that purpose. The EU does not make exceptions for different types of data being processed, and would require consent for all data.

NYOB, the data protection rights group founded by Max Shrems, who has brought up myriad data protection suits to the EU including several against Meta, has shown cautious optimism in reaction to Meta’s announcement.

“We will see if Meta is actually applying the consent requirement to all use of personal data for ads,” Shrems said.

“So far they talk about ‘highly personalized’ or ‘behavioural’ ads and it’s unclear what this means. The GDPR covered all types of personalization, also on things like your age, which is not a ‘behaviour’. We will obviously continue litigation if Meta will not apply the law fully.”

Meta has assured advertisers that there will be no immediate impact on their services in the EU so far, and that advertisers will still be able to run personalised ads once the new legal basis is put in place.