Share This Article
The response from Meta to privacy concerns was to introduce a paywall model with an ad-free subscription option for Facebook and Instagram, following significant legal scrutiny over personal data usage.
After an announcement last August 2023, Meta has finally changed the legal basis used for processing its users’ data to show personalized advertisements. Specifically, Meta has introduced the possibility of ad-free subscription to the Facebook and Instagram platforms. Many users these days have already received Meta’s invitation to subscribe: those, however, who decide to continue to benefit from the free service will be forced to accept targeted advertising.
This solution, however, seems not to have had the desired effects yet. Not even time to introduce the new premium service and the European Data Protection Board (EDPB) announced on November 1 that it had adopted a new emergency measure against Meta. The EDPB’s order was issued on October 27, but has not yet been published, leaving industry players in uncertainty. Meanwhile, the Irish Data Protection Authority (which serves as the Lead Authority for Meta) is still assessing the legality of the new solution proposed by the U.S. company, but we are sure that its intervention will not be long in coming.
Irish Data Protection Commission’s GDPR sanction against Meta
This is just the latest act in the European authorities’ battle against online behavioral advertising broadcast by the big players in the industry. Indeed, 2023 has proved to be a crucial year, particularly for Meta, which has been the subject of a succession of sanctioning measures regarding the ways in which the Menlo Park giant collects and processes the personal data of registered users.
Among them, early 2023 saw the Irish Data Protection Commission (DPC) imposed a fine of nearly 400 million euros on the company because of the contractual legal basis chosen by Meta to show its personalized ads to users of its platforms.
The company, in fact, argued that users’ acceptance of its social network’s Terms of Service was sufficient to base the processing of personal data related to the provision of its services, including behavioral advertising, on the execution of a contract with those users.
Crucial to the DPC’s decision was the binding opinion issued by the EDPB in which it was stated that the need to execute a contract cannot be considered a legitimate legal basis for targeted advertising and profiling activities.
The Court of Justice of the European Union (CJEU) also intervened on the issue in July, finding in Meta’s conduct not only a violation of the GDPR, but also an abuse of a dominant position in the behavioral advertising sector.
This is how the DPC first and the CJEU later, passing also through the EDPB, ruled that not even Meta’s legitimate interest in using behavioral advertising to fund its social networks is sufficient to justify the processing of users’ data without their consent.
Norwegian regulator’s response: quarterly ban on Meta’s display of behavioral advertising
The matter took a few weeks later a further turn with the intervention of the Norwegian Data Protection Authority (Datatilsynet), which, as of August 4, 2023, subjected Meta to a quarterly ban on the use of behavioral advertising on its platforms in the Scandinavian country.
The Norwegian authority justified its decision by stating: “The invasive commercial surveillance for marketing purposes is one of the biggest privacy risks on the Internet today.” The danger would be inherent in the fact that the use of behavioral advertising has the power to influence the user and, for this reason, cannot take place “silently.” According to Datatilsynet, the data subject must therefore be properly informed about the risks and dynamics of this activity.
Even before the three-month ban deadline expired by now last November 4, and in view of Meta’s continued inaction, the Norwegian Supervisory Authority finally requested decisive action from the EDPB on the issue.
EDPB’s intervention and Meta’s response
It was for this reason that, on October 27, 2023, the EDPB then issued an urgent binding decision, instructing the DPC, as lead supervisory authority, to take final measures against Meta within two weeks, imposing a ban on the processing of personal data for behavioral advertising on the legal bases of contract and legitimate interest throughout the European Economic Area (EEA). In the press release, the EDPB stressed the urgency of ending Meta’s illegal practices and emphasized the importance of respect for privacy as a fundamental right.
In response, Meta announced on October 30, 2023, that it would implement a new business strategy. In addition to adjusting the legal basis for consent, the company explained that it would introduce the option for users in the EU and Switzerland to pay a monthly subscription fee to use Facebook and Instagram without ads.
In the press release, the U.S. giant emphasized that “the ability to purchase a subscription to go ad-free balances the requirements of European authorities, giving users choice and allowing Meta to continue to serve all citizens of the EU, EEA and Switzerland,” pointing out how the CJEU in its decision also expressly recognized that “a subscription model, such as the one we are announcing, is a valid form of consent for an ad-funded service.”
The paywall campaign from Meta and the reaction of privacy authorities
For a few days now, therefore, European (and Swiss) users of the social networks Facebook and Instagram have been receiving a subscription offer from Meta with a banner upon login. Specifically, users are now being asked to choose (via a three-step process) whether to take out a paid subscription to use Meta’s products without ads or to continue using the service for free by agreeing to receive targeted ads. This offer, however, is not without conditions. Depending on the place of purchase, the cost will be 9.99 euros/month on the web or 12.99 euros/month on iOS and Android, and from March 1, 2024, costs will be differentiated according to the number of connected accounts.
The responses of the European Privacy Supervisory Authorities to the decision from Meta to introduce a paywall were not long in coming. In a recently issued press release, Datatilsynet announced its intention to keep a close eye on the new solution adopted by Meta, pointing out that many have already expressed skepticism that the new solution actually meets regulatory requirements, in part because you have to pay if you don’t “consent.”
On the other hand, the subscription model introduced by Meta is reminiscent of the so-called paywall phenomenon so dear to online publishing, whereby access to certain premium content can be granted by leaving users with the alternative between paying a price and agreeing to the installation of profiling cookies. Such an approach, which is still under consideration by the European Privacy Authorities, would, in fact, clear the way for users to monetize their data through a paywall setting better rules to address privacy concerns not only for Meta but also for any other player in the market.
All that remains now is to await the publication of the EDPB’s ruling and the subsequent decision of the Irish lead authority, in the hope that the latter will mark a definitive end to the affair.
On the topic, the following articles may be of interest: “Why is Meta’s new social media, Threads, NOT available in Europe?“.
Authors: Deborah Paracchini and Chiara Fiore of DLA Piper
