News: 1713442759

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

EU tells Meta it can't paywall privacy

(2024/04/18)


The EU's Data Protection Board (EDPB) has told large online platforms they should not offer users a binary choice between paying for a service and consenting to their personal data being used to provide targeted advertising.

The EDPB [1]opinion [PDF] published yesterday addresses whether it is valid in terms of data protection law to process personal data for the purposes of behavioral advertising in the context of "consent or pay" models as introduced by Meta.

It followed requests by the Dutch, Norwegian, and Hamburg Data Protection Authorities and complaints about Meta, the social media company that owns Facebook, WhatsApp, and Instagram.

[2]

"Most users consent to the processing in order to use a service, and they do not understand the full implications of their choices," EDPB chair Anu Talus said in [3]a statement .

[4]

[5]

The request from data protection authorities followed complaints by consumer and privacy organizations about Meta's decision to introduce a so-called "pay or okay" model.

In October last year, the social media giant [6]said it would be possible to pay Meta to stop Instagram or Facebook feeds of personalized ads and prevent it from using personal data for marketing for users in the EU, EEA, or Switzerland.

[7]

Meta then announced a subscription model of €9.99/month on the web or €12.99/month on iOS and Android for users who did not want their personal data used for targeted advertising.

EDPB said, in the majority of instances, it would not comply with the legal requirements for valid consent in the use of personal data if they confront users only with a choice between consenting to the processing of personal data for behavioral advertising purposes and paying a fee.

"In most cases, it will not be possible for large online platforms to comply with the requirements for valid consent if they confront users only with a binary choice," the opinion said.

[8]96% of US hospital websites share visitor info with Meta, Google, data brokers

[9]Next-gen Meta AI chip serves up ads while sipping power

[10]Lawsuit claims Meta hobbled Facebook Watch to help Netflix

[11]Meta accused of snarfing people's Snapchat data via traffic decryption

But a Meta spokesperson said: "Last year, the Court of Justice of the European Union ruled that the subscriptions model is a legally valid way for companies to seek people's consent for personalized advertising. Today's EDPB opinion does not alter that judgment and subscription for no ads complies with EU laws."

Meta is expected to continue engaging with the Irish Data Protection Commission, its lead regulator in the EU. The opinion is not anticipated to have an impact on Meta's services.

[12]

In November last year, privacy activist group noyb (None Of Your Business) [13]filed a complaint with the Austrian data protection authority against Meta for introducing the subscription model.

At the time, Felix Mikolasch, data protection lawyer at noyb, said: "EU law requires that consent is the genuine free will of the user. Contrary to this law, Meta charges a 'privacy fee' of up to €250 per year if anyone dares to exercise their fundamental right to data protection."

In February, [14]consumer groups filed their own complaint to stop Meta giving EU users a "fake choice" between the subscription offer and consenting to being profiled and tracked via data collection.

Complaints filed by eight European Consumer Organisation (BEUC) members are based on the EU's General Data Protection Regulation (GDPR). They argue that Meta's pay-or-consent model breaches data protection principles of the law, including the principles of purpose limitation, data minimization, fair processing, and transparency, with said processing enabling the company to "infer private details about the consumer." ®

Get our [15]Tech Resources



[1] https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZiFDnyDzx9FxbJkKV2BtXQAAAEY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://www.edpb.europa.eu/news/news/2024/edpb-consent-or-pay-models-should-offer-real-choice_en

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZiFDnyDzx9FxbJkKV2BtXQAAAEY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZiFDnyDzx9FxbJkKV2BtXQAAAEY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2023/10/31/meta_ad_free_europe/

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZiFDnyDzx9FxbJkKV2BtXQAAAEY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[8] https://www.theregister.com/2024/04/11/hospital_website_data_sharing/

[9] https://www.theregister.com/2024/04/10/meta_mtia_chip/

[10] https://www.theregister.com/2024/04/02/meta_facebook_watch_netflix/

[11] https://www.theregister.com/2024/03/27/meta_snapchat_data/

[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZiFDnyDzx9FxbJkKV2BtXQAAAEY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[13] https://www.theregister.com/2023/11/28/metas_eu_privacy_fee_triggers/

[14] https://www.theregister.com/2024/02/29/meta_gdpr_complaints/

[15] https://whitepapers.theregister.com/



Thank you!

Dinanziame

Though apparently Facebook is sticking to its guns that what they do is legal. I'm looking forward to the inevitable billion dollars fine.

Re: Thank you!

b0llchit

And then, still, it wouldn't be a high enough fine.

This behaviour must be discouraged by a binary choice from the authorities: Either you comply and stop your illegal practice or you get to pay a fine that will bankrupt you and all your assets will be seized and sold off.

Re: Thank you!

Zibob

Inevitable billion dollar fines.

Measured in minutes, hours and days of operation.

Filippo

> But a Meta spokesperson said: "[...] subscription for no ads complies with EU laws."

More deliberate obfuscation from Meta. The problem isn't ads. Subscription for no ads has been a thing since before Meta even existed, it's never been a problem, and it's not a problem now. The problem is tracking . Meta needs to get rid of tracking and/or make it a whole lot more user-transparent.

Khaptain

"Meta needs to get rid of tracking "

That's all that anyone wants, no alternative solutions, just this. And while they are at it, can they also kindly include Google, Apple, Microsoft and all of the other clown-shows that thrive on tracking.

Andy The Hat

Exactly. Display ads to raise revenue, just not targeted, personal-data-driven ads.

France, are you listening?

heyrick

The French data protection outfit (CNIL) said this rancid behaviour was okay, which has led to quite a number of sites saying "allow our eight hundred partners to track you, or cough up".

The massive elephant in the room is that there's actually a third option - refuse cookies, respect non tracking, and serve up non targetted adverts based upon what the site in question is (like cooking stuff at Marmiton might be more relevant than a new sofa...).

But since everybody is a greedy bastard, that option was swept under the carpet and forgotten about.

Re: France, are you listening?

Anonymous Coward

Spain's DPA also allows the same behaviour as France. Let's see how they back out of this because they've only been allowing it since January.

It's Zuckerberg

Pascal Monett

I will not trust that individual to respect anything he promises.

I trust that he will find a way to track people who have subscribed and opted out of advertising, will get caught and try to brush it off with another "Oops, sorry Your Honor, we made a mistake. Won't happen again, pinky promise."

And then it will happen again.

The usual response...

Frank Bitterlich

As usual, Facebook wants to gaslight not only its users, but also regulators, into thinking that "advertising" equals "tracking". Newsflash: It does not.

The model of "subscribe or see ads" is nothing new, and a valid way to earn money.

But "subscribe or we'll track you all over the internet and across all your devices" is, obviously, not. That is asking the user for a ransom to comply with the law. But according to Meta, that is somehow different from the local branch of the Legitimate Businessmen Club TM showing up at you door asking for a donation so they don't do anything illegal...

Re: The usual response...

jmch

"Legitimate Businessmen Club"

Nice data you have there, would be a pity if anything happened to it.....

Not quite

Mike 137

' a Meta spokesperson said: "Last year, the Court of Justice of the European Union ruled that the subscriptions model is a legally valid way for companies to seek people's consent" '

THe ECJ didn't rule on this -- it was an obiter dictum -- efectively a passing comment -- that any alternative to ads must be 'necessary' and the fee must be 'appropriate. The statement did not thererfore have the force of law to grant anyone the right to seek implied consent via a paywall. The ECJ has now apparently ruled to the contrary.

Helcat

In one place in the article it says the subscription was to avoid targeted adds which would mean no tracking but it gives room to still show adds.

In another, it's implied that the subscription stops adds being shown, but it says nothing about stopping tracking.

Adds / no adds is one option in and of itself - pay the subscription and no adds, else you get adds. That's fine (unless it's excessive - then along comes methods to block those adds).

BUT tracking is an entirely separate issue: That should always be Consent based.

Oddly, Google are pushing the consent based tracking approach - which is strange considering this is google we're talking about... unless it's them saying 'no one who wants to use our analytics tools can track without consent... except for us!'.

Probably the latter. It's google, after all.

Anyhow: As noted in other comments I've made on this: Paying means you're giving up additional information to Facebook, which negates a chunk of what you think you're paying to avoid. If anything, it just makes things worse as they can now track that payment method, especially if they only offered an 'ad free' experience and said nothing about not tracking you...

well done, Register

EvaQ

"EU tells Meta" ... hurrah ... the Register is able to write "EU" in title when "EU" is meant.

Well done. Keep it up.

EU tells Meta it can't paywall privacy

Anonymous Coward

it can't, it shouldn't, or else?

Dollars per minute

Zibob

The heads of the groups that hand down fines to these companies should have a simple and large clock on the wall that displays FD/m (Facebook Dollars/minute) and use that number to multiply by 3 months worth of time minimum.

They seem far apart, but displaying their sawy in Dollars per Minute helps to put in mind of those tasked with punishing them, how much power they have, how little they have to care about conventional fines and how meaningless conventional fines and legal systems are from the view point of the sentencing body.

And applied in minimums starting at 3 months of yearly time passing, not working hours, but a full quarter of the year in real terms. This means you potentially get 3 of these in a year before your company is running negative and starting to eat into previous years profits. The 4th would be more than a years full profit.

This is the only way they will actually pay attention.

Until such a time, they are minor inconveniences. Meerly a latte in terms of their yearly profits.

Profanity is the one language all programmers know best.