{"id":28024,"date":"2023-01-05T21:53:19","date_gmt":"2023-01-05T21:53:19","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/05\/irish-data-protection-authority-under-pressure-from-other-eu-officials-says-metas-clickwrap-agreement-is-no-legal-basis-for-targeted-ads\/"},"modified":"2023-01-05T21:53:19","modified_gmt":"2023-01-05T21:53:19","slug":"irish-data-protection-authority-under-pressure-from-other-eu-officials-says-metas-clickwrap-agreement-is-no-legal-basis-for-targeted-ads","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/05\/irish-data-protection-authority-under-pressure-from-other-eu-officials-says-metas-clickwrap-agreement-is-no-legal-basis-for-targeted-ads\/","title":{"rendered":"Irish Data Protection Authority, Under Pressure From Other EU Officials, Says Meta\u2019s Clickwrap Agreement Is No Legal Basis For Targeted Ads"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

from the much-ado-about-something<\/i> dept<\/h3>\n

Some big news out of the EU this week as the Irish data protection authority has fined Meta over $400 million<\/a>, claiming it violated the GDPR. The full details of the ruling are not yet out (apparently, the officials are working with Meta over what needs to be redacted \u2014 which is not out of the ordinary in the EU, but still feels sketchy), but the basic idea is that Meta sought to get around some of the GDPR\u2019s consent rules regarding using data for customization \/ targeting by including \u201cconsent\u201d directly in the terms of service. The Irish regulator overseeing the case had initially indicated that this was legitimate, but apparently changed their minds.<\/p>\n

Meta is pushing back on the ruling<\/a>, claiming that the GDPR allows you to collect and process this data for personalization so long as it\u2019s considered a \u201ccontractual necessity.\u201d <\/p>\n

\n

GDPR allows for a range of legal bases under which data can be processed. The rules of GDPR are clear: there is no hierarchy between these legal bases \u2013 none should be considered better or more legitimate than any other. Which basis is most appropriate to use depends on the specific situation. Like many companies, Meta uses a combination of legal bases to provide various services.\u00a0<\/em><\/p>\n

Facebook and Instagram are inherently personalised, and we believe that providing each user with their own unique experience \u2013 including the ads they see \u2013 is a necessary and essential part of that service. To date, we have relied on a legal basis called \u2018Contractual Necessity\u2019 to show people behavioural advertisements based on their activities on our platforms, subject to their safety and privacy settings. It would be highly unusual for a social media service not to be tailored to the individual user.<\/em><\/p>\n<\/blockquote>\n

That said, there\u2019s a bit more background here that is worth understanding. As you may recall, last year, we noted that officials on the EU Commission were getting annoyed<\/a> that the Irish data protection authority was seen as going easy on US internet companies. There has been a variety of efforts to update the GDPR to effectively give more power to either the Commission itself in Brussels, or possibly other country data protection authorities, to avoid the situation where US companies set up an EU \u201cheadquarters\u201d in Ireland in order to be regulated by that DPA.<\/p>\n

Given that, the Irish DPA has been somewhat under pressure to come up with a scalp to show the rest of the EU to prove that it\u2019s \u201cserious.\u201d This is why we\u2019ve mentioned that Elon Musk\u2019s Twitter might be an easy target<\/a>. But, as always, going after the \u201cbig guys,\u201d is always preferable.<\/p>\n

This might also explain why it looked like the Irish regulators were originally okay with Meta\u2019s clickthrough \/ browserwrap arrangement, and then reversed course.<\/p>\n

While it\u2019s fun to see Meta struggle (especially given all the troubles its had recently after Apple effectively kneecapped<\/a> a whole bunch of Meta\u2019s data collection efforts) and face some consequences after playing fast and loose with data for years\u2026 it does feel like this kind of decision could have serious problematic consequences going forward. I\u2019m loathe to give Meta any credit for anything that it does, but it\u2019s kinda true that when people are signing in to most social media these days they do expect personalization. <\/p>\n

Are there ways that Meta could give users a lot more control? Yes. Could Meta be more transparent about how it\u2019s using data? Also yes. But I fear that the end result of this ruling is that we\u2019re going to just end up with even more<\/em> useless and annoying \u201ccookie pop up\u201d type warnings in which every company is going to feel the need to make you \u201copt-in\u201d to personalization over and over again in a manner that is extremely annoying and does nothing to really protect anyone\u2019s privacy.<\/p>\n

But, alas, this is the state we live in today with the European approach to privacy laws, where most of the focus is just on getting companies to do something that is annoying for users, but which allows politicians to claim that they\u2019re \u201cprotecting your privacy.\u201d<\/p>\n

\nFiled Under: browserwrap<\/a>, clickwrap<\/a>, eu<\/a>, fines<\/a>, gdpr<\/a>, ireland<\/a>, irish dpc<\/a>, privacy<\/a>
\n
Companies: facebook<\/a>, instagram<\/a>, meta<\/a>\n<\/p>\n<\/div>\n