EDPB imposes EU ban on Meta's targeted advertising
On 27 October 2023, the European Data Protection Board (EDPB) issued an urgent binding decision instructing the Irish Data Protection Authority (IE DPA) to take definitive action against Meta Ireland Limited (Meta) within two weeks and impose a ban on the processing of personal data for behavioural advertising in the European Economic Area (EEA) based on the lawful bases of contract and legitimate interest (the Decision).
This Decision came as a response to a request made in September by the Norwegian Data Protection Authority to extend Norway’s ban on Meta’s processing of personal data to the entire EEA.
EDPB Chair Anu Talus emphasised the need for Meta to comply with these measures and cease unlawful data processing, as previous EDPB decisions had already ruled out the use of a contractual basis for such processing activities. More specifically, she said: “Already in December 2022, the EDPB Binding Decisions clarified that contract is not a suitable legal basis for the processing of personal data carried out by Meta for behavioural advertising. In addition, Meta has been found by the IE SA to not have demonstrated compliance with the orders imposed at the end of last year. It is high time for Meta to bring its processing into compliance and to stop unlawful processing.”
The timeline of the ban
The prohibition on data processing will come into effect one week after the IE DPA notifies Meta of the final measures. On 31 October 2023, the IE DPA informed Meta IE of the EDPB's Decision. Additionally, Meta proposed using consent as the legal basis for their activities by announcing the introduction of a subscription-based model for its Facebook and Instagram services in the EU on 30 October 2023. This move is aimed to address the regulatory scrutiny received by Meta for alleged data protection violations concerning personalised advertising. The IE DPA is currently evaluating Meta’s consent-based approach together with the Concerned Supervisory Authorities.
