Remember the Who Targets Me browser extension from privacy activists at Noyb? The group yesterday filed explosive complaints based on log records from the extension that claim six of Germany's political parties broke European data law when they targeted voters on Facebook's adtech platform.

The group is claiming the allegedly GDPR-busting activity took place during the country's 2021 federal elections, and filed six complaints yesterday with the Berlin and Bavarian data protection watchdogs against parties spanning the entire German political spectrum. So that's SPD (center left), AfD (right-wing, Eurosceptic), the CDU (Christian, center right), Bündnis 90/Die Grünen (eco green party, center left), Die Linke (the left, democratic socialist), and ÖDP (the eco democrat party). Of the parties that have seats in the Bundestag, Germany's parliament, just two didn't see a filing yesterday: the FDP and the CSU.

Targeted advertising based on certain characteristics is not unlawful "per se," the activists admitted. However, Noyb is claiming the users were selected because Facebook had "evaluated their political views in the background."

[1]

Political opinions are specifically protected under Article 9 of Europe's General Data Protection Regulation, says Noyb, which claims both the parties and the social network violated the GDPR by running the ads. Noyb confirmed it hadn't filed a complaint against Facebook parent Meta in this particular case – presumably it has enough Meta/Facebook complaints on the boil.

[2]

[3]

At the core of these complaints appears to be allegations the political parties were trying to nick voters from each other by targeting people known to be interested in another political party.

The complaint against the leftwing Die Linke org

[4]PDF

, for example, alleges it targeted voters it knew to be interested in Bündnis 90/Die Grünen (the Greens).

[5]

The filing alleges ( [6]translated from the German):

According to this recorded information, the respondent's advertisement was targeted at female voters, for whom there was data that they lived in Germany, were aged between 6 and 53 and had an interest in "Alliance '90/The Greens" (i.e. "Bündnis 90/Die Grünen").

The complaints claim that "a derived interest – i.e. calculated or extrapolated from other information – in a specific political current is to be regarded as a special category of personal data."

Our understanding is you have to be 13 to open a Facebook account, so we've asked Noyb about the wording here. Meta has been accused of [7]targeting the youth , but six sounds very young indeed, and especially young to care about politics. Noyb confirmed it was alleging the ad may be displayed to any female "in this age bracket," but added: "However, this does not necessarily mean that Facebook accepts users that are that young."

Noyb (None of Your Business) was founded by Max Schrems, the lawyer who filed the complaint that ultimately led to the [8]fall of EU-US Safe Harbor and Privcy Shield data transfer systems , and has been working on a number of focused data protection campaigns over the years.

Schrems is a big presence on the Euro digital rights scene, whose raison d'être is to push back against data-slurping by Silicon Valley's tech platforms. Facebook was a big part of two landmark judgments ( [9]Schrems I, the Safe Harbor one, and Schrems II, the Privacy Shield one ), both of which forced through plenty of changes on how American and European companies must secure sensitive data in public clouds and how they handle personal data more generally.

[10]Long data privacy notices aren't foolproof, Euro watchdog tells Meta

[11]Ireland fines Meta $414m for using personal data without asking

[12]EU takes another step towards US data-sharing agreement

[13]Using personal info for ads without consent puts Meta in EU's gunsights

Microtargeting – as the redacted complaints point out – was reportedly used by Cambridge Analytica during the 2016 US presidential election, and is said to have played its part in the narrow victory of Donald Trump in various US states. Meanwhile, in the UK, after the Brexit referendum, microtargeting was probed by the UK Information Commissioner's Office and sanctioned by several companies and parties.

How the Facebook money funnel is shaping British elections [14]FROM THE ARCHIVES

We asked the political parties for comment. Die Linke said (translated from the German) that it generally does not provide companies such as Facebook and Google with any personal data, use "dark posts", or other questionable means such as Cambridge Analytica has reportedly used. It added that it hadn't been aware of the specific complaint and will now examine it legally. ÖDP said it was also looking into it.

How Who Targets Me works

The browser extension captures the Facebook ads you're targeted with.

The ads are matched against lists of political advertisers maintained by noyb.

The group provides users with [15]personalized data about who's tracking and targeting them with ads and how they're doing it.

Noyb says users can stop participating or delete their data automatically at any time.

An SPD spokesman, meanwhile, said the party does not use microtargeting. In a statement, translated from German, he added: "The tailoring of our campaigns is based on socio-demographic characteristics, in particular gender, language and age preferences, as well as occupation and interests. Ads can also target regions. For reasons of transparency and data protection, the SPD does not use tools such as Facebook Pixel or Facebook SDK."

AfD told us it does not use micro-targeting strategies, adding that it hadn't used any micro-targeting strategies during the federal election either.

[16]

The CDU and Bündnis 90/Die Grünen hadn't responded by the time of publication and Meta declined to comment. ®

Get our [17]Tech Resources



[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZBs0O6JlvxxnkMnzVD604gAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZBs0O6JlvxxnkMnzVD604gAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZBs0O6JlvxxnkMnzVD604gAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[4] https://noyb.eu/sites/default/files/2023-03/C061-06_redacted.pdf

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZBs0O6JlvxxnkMnzVD604gAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://noyb.eu/sites/default/files/2023-03/C061-06_redacted%20en-GB.pdf

[7] https://www.theregister.com/2023/01/10/schools_sue_meta_google/

[8] https://www.theregister.com/2020/07/16/privacy_shield_struck_down/

[9] https://www.theregister.com/Tag/Schrems%20I%20and%20Schrems%20II/

[10] https://www.theregister.com/2023/01/13/long_data_privacy_meta/

[11] https://www.theregister.com/2023/01/04/meta_fined_390_for_using/

[12] https://www.theregister.com/2022/12/14/eu_us_data_sharing_agreement/

[13] https://www.theregister.com/2022/12/08/meta_eu_personal_info/

[14] https://www.theregister.com/2017/05/30/facehook_and_british_general_elections/

[15] https://results.whotargets.me/

[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZBs0O6JlvxxnkMnzVD604gAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[17] https://whitepapers.theregister.com/