\n<\/p>\n
Adtech giant Meta\u2019s bid to keep tracking and profiling users of Facebook and Instagram in Europe in spite of the bloc\u2019s comprehensive data protection laws is facing a second challenge from privacy rights advocacy group noyb<\/a>. It\u2019s supporting a new complaint, which is being filed with the Austrian data protection authority, that alleges the company is breaching EU law by framing a choice that makes it far harder for users to withdraw consent to its tracking ads than to agree.<\/p>\n Wind your mind back to last year and you\u2019ll recall a couple of major privacy decisions against Meta (in January<\/a>; and July<\/a>) invalidated the legal bases it had previously claimed for processing Europeans\u2019 data for ad targeting \u2014 after literally years of privacy campaigner complaints.<\/p>\n What then followed, last fall<\/a>, was a claim from Meta that it would be switching to a consent basis for tracking. However the choice it framed requires users who don\u2019t want to be tracked and profiled to pay it for monthly subscriptions to access ad-free versions of its products. Facebook and Instagram users who wish to continue to get free access to the services have to \u201cconsent\u201d to its tracking \u2014 which Meta claims is valid consent under the bloc\u2019s General Data Protection Regulation (GDPR). But of course noyb, and the complainants its supporting, disagrees.<\/p>\n Where noyb\u2019s earlier complaint against Meta\u2019s version of consent, filed with the Austrian DPA last November<\/a>, focused on how much Meta is charging users not to be tracked \u2014 an initial cost of \u20ac9.99\/month on web or \u20ac12.99\/month on mobile per linked account \u2014 which it argues is \u201cway out of proportion\u201d to how much value the company derives per user, this second complaint addresses how easy (or rather not easy) Meta makes it is for users to withdraw their consent to tracking under the arrangement.<\/p>\n Withdrawing consent in the scenario Meta has devised requires users to sign up for a monthly subscription. Whereas agreeing to its tracking is a breeze: Users just need click \u2018okay\u2019. The legal issue here is that the GDPR requires consent to be as easy to withdraw as it is to grant. So noyb\u2019s follow-up complaint targets the inherent friction in Meta charging users money to protect their privacy.<\/p>\n \u201cOnce users have consented to being tracked, there\u2019s no easy way to withdraw it at a later date,\u201d it writes in a press release. \u201cThis is illegal. Despite Article 7 of the GDPR clearly stating that \u2018it shall be as easy to withdraw as to give consent\u2019, the only option to \u2018withdraw\u2019 the (one-click) consent, is to buy a \u20ac251.88 subscription. In addition, the complainant had to navigate through several windows and banners to find the page where he could actually revoke consent.\u201d<\/p>\n Commenting in a statement, Massimiliano Gelmi, a data protection lawyer at noyb, added<\/span>: \u201cThe law is clear, withdrawing consent must be as easy as giving it in the first place. It is painfully obvious that paying \u20ac251,88 per year to withdraw consent is not as easy as clicking an \u2018Okay\u2019 button to accept the tracking.\u201d<\/p>\n Penalties for confirmed breaches of the GDPR can scale up to 4% of global annual turnover \u2014 but Meta, which raked in $116.61BN in 2022 by tracking and profiling its billions of users to sell targeted ads, is more likely to be concerned EU regulators could end up forcing it to actually offer users a genuinely free choice to deny its tracking, which could kneecap its regional tracking-ads business. Last year<\/a> the company suggested around 10% of its global ad revenue comes from users in the EU.<\/p>\n An FAQ published last month by the Austrian DPA<\/a>, on the topic of cookies and data protection, discusses the contentious issue of \u201cpay or okay\u201d, as charging for consent is sometimes called. In it the DPA writes [in German; English translations here are generated with AI] that paying for access to a website \u201ccan<\/strong> represent an alternative to consent\u201d \u2014 emphasis its \u2014 however it says this is provided the GDPR is fully complied with, including consent being specific (i.e. non-bundled); that the company does not have a monopoly or \u201cquasi-monopoly\u201d position on the market; and the price for the payment alternative is \u201cappropriate and fair\u201d and not offered \u201cpro forma at a completely unrealistically high price\u201c,<\/em> as it puts it.<\/p>\n However the DPA also notes there is no case law from the European Union\u2019s top court on \u201cpay or okay\u201d yet \u2014 hence it caveats the FAQ as representing its \u201ccurrent view\u201d. And many privacy experts expect that the issue will, finally, have to be settled via a referral to the CJEU.<\/p>\n In the meanwhile, GDPR complaints filed against Meta with EU DPAs are typically referred back to the Irish Data Protection Commission (DPC), which is the company\u2019s lead data supervisor under the regulation\u2019s one-stop-shop (OSS) mechanism. That means noyb\u2019s complaints against Meta\u2019s \u2018pay or okay\u2019 tactic will probably end up on a desk in Dublin sooner or later. Indeed, the Irish regulator has claimed to be reviewing Meta\u2019s approach since the company floated the idea last summer.<\/p>\n If the DPC shifts its review of Meta\u2019s approach to consent onto a formal inquiry footing it could still take years, plural, of investigation before a final regulatory decision on the tactic \u2014 as was the case with another noyb complaint against Meta\u2019s legal basis for ads; filed all the way back in May 2018<\/a> but not decided until January 2023<\/a> (a decision that\u2019s now under legal appeal by Meta in Ireland).<\/p>\n In that case, the decision which finally emerged out of Ireland was actually\u00a0the DPC acting on instruction from the European Data Protection Board<\/a> (EDPB), which had to step in to settle disagreements between EU regulators. So a speedy privacy clamp down on Meta\u2019s gaming of consent seems unlikely \u2014 unless other DPAs decide to take matters into their own hands.<\/p>\n On paper, they can do this. Despite the existence in the GDPR of the OSS mechanism, which can lead to a lead authority being appointed to deal with complaints involving cross-border processing, the regulation includes emergency powers that allow other DPAs to take action to mitigate data risks in their own markets to protect local users. They can also follow up any interim measures they impose locally by asking the EDPB to make their temporary action permanent and EU-wide \u2014 as happened last year<\/a> when Norway\u2019s DPA petitioned the EDPB over Meta\u2019s legal basis for ads. However, by then, Meta had already shifted its claimed basis to consent, meaning it could just sidestep the regulatory intervention. (Which just goes to show that enforcement delayed is enforcement denied.)<\/p>\n \u201cThe [Austrian] authority should order Meta to bring its processing operations in compliance with European data protection law and to provide users with an easy way to withdraw their consent \u2014 without having to pay a fee,\u201d writes noyb, urging the imposition of a fine \u201cto prevent further violations of the GDPR\u201d.<\/p>\n noyb is also petitioning the Austrian DPA to instigate an urgency procedure \u2014 citing recent CJEU case law<\/a> which it argues indicates that the discretion of DPAs to decide whether or not to instigate an urgency procedure is limited by \u201ctheir duty to provide effective protection of data protection rights\u201d. \u201cThus, in specific situations (like ours) the data subject has a right to an urgency procedure,\u201d a noyb spokesperson suggested.<\/p>\n However, so far, they said the Austrian authority has resisted the call to take emergency measures. \u201cThe Austrian DPA has just told us that they received the complaint, that there is no right to an urgency procedure and that another DPA might be the leading supervisory authority. But the complaint wasn\u2019t yet officially referred to the DPC as far as I know,\u201d noyb\u2019s spokesperson added.<\/p>\n While all these tortuous regulatory twists and turns have played out, the upshot for Facebook and Instagram users in Europe is that their privacy remains at Mark Zuckerberg\u2019s mercy \u2014 unless or until they abandon using his dominant social networks entirely \u2014 since, in parallel with all these years of privacy scrutiny and sanction, the adtech giant has been able to keep cashing in on Europeans\u2019 personal data the whole time; processing it for ad targeting despite its legal bases being under challenge or even, for several months-long stretches, invalidated (as happened in the months between its claim of (first) contractual necessity (and then legitimate interests) being ruled out and Meta switching to alternatives (earlier last year legitimate interests; now consent)).<\/p>\n That said, we are seeing more moves to litigate against Meta on privacy<\/a> \u2014 such as the $600M competition damages claim being brought by publishers in Spain<\/a> last year who argue its lack of legal basis for microtargeting users sums to unfair competition they should be compensated for \u2014 so the adtech giant could face a reckoning in the form of rising costs coming down the pipe over legacy data protection violations, as well as the prospect of future sanctions flowing from fresh privacy complaints if they lead to breach findings.<\/p>\n It\u2019s worth noting the GDPR only has a limited number of legal bases (six) for processing personal data. Several are simply irrelevant for an adtech giant like Meta, while others have been ruled out by regulators and the CJEU. So its options for tracking and profiling users for ads have narrowed \u2014 to a single possibility: Consent. How Meta frames this choice is where the privacy action is now.<\/p>\n<\/p><\/div>\n