EU data protection board imposes ban on Meta using personal data for advertising 

The European Data Protection Board ruled that contract is "not a suitable" legal basis for the processing of personal data by Meta. 

The European Data Protection Board (EDPB) has issued an urgent binding decision banning Facebook and Instagram parent company Meta from processing users personal data for the purposes of behavioural advertising.

The EDPB has instructed the Irish Data Protection Commissioner (DPC) - as Meta’s lead supervisory authority - to take final measures to enforce this ban on Meta within two weeks. The decision came following a request from the Norwegian Data Protection Authority.

In a statement issued, the EDPB said the DPC must “impose a ban on the processing of personal data for behavioural advertising on the legal bases of contract and legitimate interest across the entire European Economic Area (EEA)”.

“The ban on processing will become effective one week after the notification of the final measures by the Irish DPC to the controller,” the EDPB said.

Anu Talus, chair of the EDPB, said that in December 2022 the EDPB's binding decisions clarified that contract is “not a suitable legal basis for the processing of personal data carried out by Meta for behavioural advertising”.

“In addition, Meta has been found by the Irish DPC to not have demonstrated compliance with the orders imposed at the end of last year. It is high time for Meta to bring its processing into compliance and to stop unlawful processing,” Mr Talus said.

The DPC notified Meta on Tuesday about the decision.

Graham Doyle, deputy Data Protection Commissioner, said the DPC, along with fellow EU data protection authorities, is focused on concluding its “detailed assessment of the consent-model that Meta announced in August and confirmed details of in a statement on Monday”.

Earlier this week, Meta announced that it would be introducing a new subscription option for the EU, EEA, and Switzerland.

The subscription will cost €9.99 per month if paid for on their website or €12.99 a month if paid through an iPhone or Android phone.

Meta said that it will be offering users in the region the option to continue using these personalised services for free with ads, or subscribe to stop seeing ads.

While people are subscribed, their information will not be used for ads.

The EDPB said it has noted Meta's proposal to rely on a consent based approach as legal basis. The DPC is currently evaluating this together with the Concerned Supervisory Authorities (CSAs).

A spokesman for the social media giant said that this subscription model will enable the company to comply with regulatory requirements while offering users the opportunity to consent for their data to be used in targeted ads.

“EDPB members have been aware of this plan for weeks and we were already fully engaged with them to arrive at a satisfactory outcome for all parties. This development unjustifiably ignores that careful and robust regulatory process,” the Meta spokesman said.