There are numerous websites in France that follow this model - accept all cookies/adverts/tracking or subscribe...

Which is illegal.

Other people breaking the law doesn't make it OK for Meta.

I think that's heyrick's point; the French sites are also acting illegally At least that's how I read it.

It's not illegal. "Pay or Okay" was also allowed by the AEPD (Spanish regulator) which [1]followed the French regulator's lead , as did the German regulator. The Spanish regulator gave a date for any organisation which wanted to convert to "Pay or Okay" - that was the 11th of January. Low and behold, most of the Spanish press did that. The big newspapers each charged their own individual subscription fees, the smaller media outlets set up a common platform where paying one subscription got you access to all of them.

National EU regulators capitulated to national press lobbying and Facebook are simply citing precedent saying what's good for national press outlets is equally good for them. [2]Now it's up to the EDPB to say to Facebook "what you're doing is already allowed, carry on" or find against the national regulators that are already allowing this . The EDPB is all the national regulators in the EEA, many of whom don't want to lose face doing a volte-face.

This does not affect UK-GDPR so oddly enough UK-GDPR is now better than GDPR in that respect.

[1] https://blog.didomi.io/pay-or-okay-breaking-down-the-paywall-situation-in-2024

[2] https://cybernews.com/news/meta-privacy-policy-edpb-gdpr/

UK too. Or have to toggle off a thousand individual "legitimate interest" options, which are presented in a separate tab to the main cookies options.

Some sites are getting better though, with "Reject All" for cookes and "Object All" for legitimate interset. But the default state is usally everything on, and you have to opt out, which is contrary to the rules.

They need to start enforcing some of this and making a strong example of some offenders.

The number of sites operating in violation of EU law does not mitigate the seriousness of the transgression(s). Actually, it just makes it more grotesque.

But the real killer here is that there is no enforcement .

This is one of these cases where I'd like to see reversal of burden of proof. Every website should publicly proof their complete and correct handling of any data within EU law. The proof and trail leading to it should be accessible by any person in the EU without any limitations. Failure to do so should automatically cause the company to be shuttered and prevented from doing any business, anywhere.

I can't imagine EU law does gives you the fundamental right to enjoy any service you like without paying for it.

asked to say yes to data processing – to "choose to continue to use Facebook and Instagram with ads" – or to pay up for a "subscription service with no ads on Facebook and Instagram." Meta, of course, made the changes in an attempt to comply with EU law.

But privacy rights folks weren't happy about it from the get-go, with privacy advocacy group noyb (None Of Your Business), for example, sarcastically noting Meta was basically proposing you pay it in order to enjoy your fundamental rights under EU law.

I don't quite understand this. What fundamental right is this? Why aren't Facebook allowed to monetize their users? There are three choices, "pay for Meta", "allow Meta to show advertising", or "don't use Meta". Why do they have to provide a fourth option "Use Meta for free and opt out of tracking"?

I'm going to get downvotes for this for sure... its not like I'm on Meta's side here, but I just can't understand why they aren't allowed to choose the conditions in which users access Meta.

You can't offer free and insist on tracking.

They are indeed welcome to make it a pay only site. And then the only "tracking" that can be imposed is the log-in cookie.

It's not about the adverts or being a pay walled site as such.

Facebook are welcome to monetise all of their users.

They can still sell and serve advertising, they just aren’t allowed to use non consensual intrusive data gathering to (allegedly) improve the targeting of that advertising.

Obviously they’ve so far managed to persuade advertisers that non-targeted advertising is less valuable and they might have to develop a pricing model which reflects that, but, on the basis of what the current model puts in front of me that would probably be more reflective of its actual value to the advertiser… :-)

Perhaps they can charge extra for non-targetted because it "increases the likelihood your ad is seen by the select demographic of our most privacy-conscious users"?

I'm presently looking at a car brand that requires three separate logins to be created to use its vehicles in full, one of which is for Google.

What they're trying to do is to slope-shoulder their GDPR requirements whilst offering Google in the dashboard, but the direct implication is that they're selling cars with features that require you to part with your privacy before you can actually use them or suffer reduced functionality. None of that is in the glossy brochures or made clear at the point of purchase, which amount to forced disclosure which just happens to be illegal under GDPR. Add to that a very liberal use of 'legitimate interest' in their privacy statements (read; enthusiastic abuse of a backdoor that can only have been the result of heavy lobbying because it basically neutralises your protection, with offenders likely to claim "wir haben es nicht gewußt" when caught) and frankly, they should be made to complain about toilet brushes because they hurt.

I know Mozilla did a study of car privacy, but that was very US centric. Maybe there's a need for one on this side of the pond because we're definitely on a road to nowhere here.

Why is "advertising" being elided with "data theft"?

To be more precise, these two things are absolutely NOT RELATED:

(1) Meta pushes advertising to its customers

(2) Meta reads and stores and sells data extracted from customer transactions

Item #1 has nothing to do with GDPR.

Item #2 is illegal.

So....Meta customers might pay to switch off item #1......so what?

It's a simple bait & switch-

...which they said were unfair because it "misleads" consumers into thinking that "by opting for the paid subscription as it is presented, they get a privacy-friendly option involving less tracking and profiling."

If people opt to pay to get an ad-free FaceMelta experience, they should be free to do so. They should also be free to opt out of FaceMelta's cyber stalking and data rape, as is a requirement under GDPR. Don't pay and get raped is extortion, plain and simple.

Problem is they've been allowed to get away with it. So I was just thinking about how to solve this problem, admittedly in the context of energy policy and discovered-

Cape Enniberg, Faroe Islands, 750 m above North Atlantic

Which I propose naming the Cliffs of Stupidity. Build 3 walls leaving the cliff side open, secure those. Then place FaceMelta execs, and other assorted lying scumbags inside. This isn't capital punishment given they're free to make a choice. Put video feeds on PPV, or just have those ad funded and it would quickly pay for itself. The prospect of a meaningful punishment might also discourage other data rapists and assorted scumbags.

You are correct on #1 and #2, but this is an issue with #3:

Meta are providing a free service conditional to consent to tracking.

GDPR requires users be able to revoke consent at any time.

Forcing a user to pay to revoke consent is the breach of GDPR as a) some users may not have the facility or funds available at that time, b) making a payment requires provision of sensitive information that has to be processed and stored (not subject to GDPR - it's a legal requirement) and the user may not want to provide those details.

Now, if Meta provided their service free with adds, but they didn't track the user - that would be fine. It's the forced consent for tracking that's the problem.

it's an ongoing battle. Legislation, government and the law all take their own sweet time. So I may be wrong - but the feeling I'm getting is that there'll be all these cases at the edges, and no major effect.

Facebook were allowed to build a global face-recognition system right under our very noses, with barely a peep from anybody. They never got consent for it, they just suddenly said, "we can tag your photos" and users lapped it up. Nobody did very much of anything, and even with our new data laws, this doesn't appear to be an area of policy interest. Who knows who else has got access to that - it's probably all been sold into AI models - and every government who wants it.

Then we have the incredibly creepy data-theft that Facebook do whenever they get their claws into someone's phone. Put the app on there, and your contacts have gone off to Facebook HQ to allow them to associate even more data. A friend today got one of those friend recommendations on FB. For a bloke she met on an online dating site a couple of years ago. Presumably he's just pub FB on his phone, it's taken their two numbers and put them back in touch.

When I used Facebook my account was on an old email address. But I started getting friend links to people I knew. I'm guessing through some association of friends' gobbled data with them also having my actual email address - I guess Facebook were able to connect the dots and then find other people who had mine in their address books. Not a problem for me. I only used a different email because I'm awkward - and I barely used it for friends (I was on there for family stuff). But it's a lot more worrying for people with reason to need privacy, and it's the sort of creepiness that these laws should be addressing, and really don't seem to have made a dent in this business model from Google, Facebook et al.

There's a fundamental misunderstanding here. One that Meta is doing their very best to exploit.

Tracking is not advertising.

The GDPR is about tracking, not ads. You can serve ads on a web page without tracking, it's how it was done in the 90s. If you do, GDPR won't stop you in the least.

If Meta wants to offer a paid service with no ads, good for them, but that's irrelevant. If they want to be compliant that way, they need to offer a paid service with no tracking . But they don't want to do that, because tracking is where they make their real money.

After all, it takes a global-scale service like Meta or Google to make tracking really useful... but anyone can serve untracked ads with equal effectiveness. If it got established that you can't track users without informed consent, and you can't leverage refusal of service to gain consent, and this was actually enforced, then the advertising monopoly would dissolve overnight. Even the argument that tracking is useful for users in the form of better search result is hollow in the face of how web search results on major sites are steadily getting worse .

So they're trying to muddle the issue by saying "oh, but we offer an ad-less service, so that's fine!" - no, it's not fine, we're talking about tracking, not ads. Even offering a service where the ads don't target me is irrelevant, as long as you keep tracking me.

Conflating tracking and advertising, believing that they are one and the same, that you can't advertise without tracking and that therefore the only way to fund a website is either through payment or through tracking, is IMHO a big part of how we got into this mess, and furthering this confusion is outright deceptive on Meta's part.

There's also the not-insignificant problem that, at this point, even if Meta offered a paid track-less service, nobody in their right mind would trust them to actually not take your money and then track you anyway.