Adtech giants like Meta must give EU users real privacy choice, says EDPB

The European Data Protection Board (EDPB) has published new guidance that has major implications for ad tech giants like Meta and other major platforms.

The guidance, which was confirmed on Wednesday as we reported earlier, will determine how privacy regulators interpret the bloc’s General Data Protection Regulation (GDPR) in a critical area. The EDPB’s full opinion on so-called “consent or payment” is 42 pages long.

Other large ad-supported platforms should also take note of the granular guidance. But Meta appears to be the first to feel the regulatory chill that would result for its surveillance-based business model.

In fact, since November 2023, the owner of Facebook and Instagram has forced users in the European Union to agree to be tracked and profiled for its advertising targeting activity, otherwise they must pay a monthly subscription to access the Ad-free versions of the app. services. However, a market leader imposing this type of binary choice does not appear viable, according to the EDPB, an expert body made up of representatives from data protection authorities across the EU.

“The EDPB notes that negative consequences are likely to occur when large online platforms use a ‘consent or payment’ model to obtain consent to processing”, considers the Council, highlighting the risk of an “imbalance of power” between the individual and the user. data controller, as in cases where “an individual relies on the service and the primary audience of the service”.

In a press release accompanying the publication of the opinion, Council President Anu Talu also highlighted the need for platforms to offer users “real choice” regarding their privacy.

“Online platforms should give users a real choice when using ‘consent or pay’ models,” Talu wrote. “The models we have today generally require individuals to give up all their data or pay. As a result, most users consent to processing in order to use a service and do not understand the full implications of their choices.

“Data controllers must be careful at all times to avoid turning the fundamental right to data protection into a feature that individuals must pay to benefit from. Individuals must be fully aware of the value and consequences of their choices,” she added.

In a summary of its opinion, the EDPB writes in the press release that “in most cases” it will “not be possible” for “large online platforms” that implement consent or consent models. payment to comply with the “valid consent” requirement of the GDPR. — if they “only confront users with a choice between consenting to the processing of personal data for behavioral advertising purposes and paying a fee” (i.e. as is currently the case with Meta) .

The Notice defines large platforms, non-exhaustively, as entities designated as very large online platforms under the EU Digital Services Act or as gatekeepers under the EU Digital Services Act. digital marketplaces (DMA) – again, like Meta (Facebook and Instagram are regulated by both laws). .

“The EDPB considers that offering only a paid alternative to services involving the processing of personal data for behavioral advertising purposes should not be the default route for data controllers,” the committee continues. “When developing alternatives, large online platforms should consider offering individuals an “equivalent alternative” that does not involve paying fees.

“If data controllers choose to charge a fee for access to the “equivalent alternative”, they should seriously consider offering an additional alternative. This free alternative should be free of behavioral advertising, for example with a form of advertising involving the processing of less or no personal data. This is a particularly important factor in assessing valid consent under the GDPR.

The EDPB is careful to point out that other core principles of the GDPR – such as purpose limitation, data minimization and fairness – continue to apply to consent mechanisms, adding: “In addition, large Online platforms should also consider respecting the principles of necessity and fairness. proportionality, and it is their responsibility to demonstrate that their processing generally complies with the GDPR.

Given the detail of the EDPB’s opinion on this controversial and thorny topic – and the suggestion that a lot of case-by-case analysis will be required to make compliance assessments – Meta can be confident that nothing will change short term. Clearly, it will take time for European regulators to analyze, integrate and follow the Council’s advice.

Contacted for comment, Meta spokesperson Matthew Pollard emailed a brief statement downplaying the guidelines: “Last year, the Court of Justice of the European Union (CJEU) ruled that the Model d Subscription is a legally valid way for businesses to obtain consent from people for personalized services. advertisement. Today’s EDPB opinion does not change this judgment and the ad-free subscription complies with EU laws.

The Irish Data Protection Commission, which oversees Meta’s GDPR compliance and has been reviewing its consent model since last year, declined to say whether it would take action in light of the EDPB’s guidance, as it stated that the matter was ongoing.

Since Meta launched the “ad-free subscription” offering last year, it has continued to claim that it complies with all relevant EU regulations – building on a line from the July 2023 decision of the EU’s highest court in which judges did not explicitly rule out the possibility of charging an alternative without tracking, but instead stipulated that any such payment must be “necessary” and “appropriate”.

Commenting on this aspect of the CJEU’s decision in its opinion, the Council notes — contrary to Meta’s repeated assertions that the CJEU had essentially sanctioned its subscription model in advance — that this was “not central to the determination of the Court”.

“The EDPB considers that certain circumstances must be met for a tax to be imposed, taking into account both the possible alternatives to behavioral advertising which involve the processing of less personal data and the position of the data subjects,” he continues emphasizing. “This is suggested by the words “necessary” and “appropriate”which shall not, however, be construed as requiring that the imposition of a fee is “necessary” within the meaning of Article 52(1) of the Charter and European data protection law.

At the same time, the Council opinion does not entirely deny large platforms the right possibility to charge for a no-tracking alternative – so that Meta and its tracking ad-funded ilk can be confident that they can find succor in 42 pages of granular discussion of the cross-requirements of Data Protection Law. (Or, at least, that this intervention will keep regulators busy trying to understand the complexities on a case-by-case basis.)

However, the guidelines notably encourage platforms to offer free alternatives to ad tracking, including ad-supported and privacy-friendly offerings.

The EDPB gives examples of contextual advertising, “general advertising” or “advertising based on topics that the data subject has selected from a list of topics of interest”. (And it’s also worth noting that the European Commission has also suggested that Meta could use contextual ads instead of forcing users to consent to ad tracking as part of its oversight of the tech giant’s compliance with the DMA .)

“Even if there is no obligation for large online platforms to always offer free services, making this additional alternative available to data subjects reinforces their freedom of choice,” the Commission continues, adding: “ This makes it easier for data controllers to demonstrate that consent is freely given.

While there are more discursive nuances in what the Council released today than instant clarity on a crucial topic, the intervention is significant and appears poised to make it more difficult for traditional ad tech giants like Meta to frame and operate within false binary privacy. hostile choices in the long term.

Building on these guidelines, European data protection regulators should We need to ask why such platforms don’t offer much less privacy-invasive alternatives – and ask that question, if not literally today, then very, very soon.

For a tech giant as dominant and well-resourced as Meta, it’s hard to see how it can avoid meeting this demand for long. Although it will surely stick to its usual GDPR strategy of spinning things around for as long as possible and appealing every possible final decision.

The privacy nonprofit noyb, which has been at the forefront of fighting consent or pay tactics in the region in recent years, says the advisory’s opinion EDPB makes it clear that Meta can no longer rely on the “pay or accept” trick. However, its founder and chairman, Max Schrems, told TechCrunch that he was concerned that the Board had not gone far enough to muddle this divisive forced consent mechanism.

“The EDPB recalls all the relevant elements, but does not unequivocally state the obvious consequence, namely that ‘pay or accept’ is not legal,” he told us. “It cites all the things Meta is illegal for, but there are thousands of other pages for which there are no answers yet.”

As if 42 pages of guidance on this thorny subject weren’t already enough, the Council also has other projects in the works: Talus says it intends to develop guidelines on consent or remuneration models “with a broader scope,” adding that it will. “collaborate with stakeholders on these next guidelines”.

European news publishers were early adopters of the controversial consent tactic, so the EDPB’s upcoming “broader” opinion is likely to be closely followed by those in the media industry.