The EDPB instructs the Irish DPC to ban Meta's use of Facebook and Instagram users' personal data for behavioral ads in EU and EEA countries within two weeks
An unprecedented shakeup in the advertising technology space has arrived in Europe. Changes are coming to adtech's approach …
IAPPJoe Duball
Context & Ripple Effects
This is an escalation of Meta’s existing European privacy dispute: the Irish DPC had already imposed a €390M penalty over its ad-data practices and given the company time to comply in January. The EDPB’s role had already been visible in that earlier DPC enforcement at the EDPB’s behest.
The new instruction shifts the matter from a financial penalty and remediation timetable toward a narrowly defined operational constraint on how Facebook and Instagram advertising can be targeted across the EU and EEA.
First-order effects
Meta and the Irish DPC face a two-week implementation window to stop the specified use of Facebook and Instagram users’ personal data for behavioral advertising in EU and EEA markets.
Advertisers buying Meta inventory in those markets may immediately lose access to targeting based on the affected personal-data processing, changing the utility of campaigns already planned around it.
Second-order effects
Meta will need to prioritize ad-delivery approaches that do not depend on the prohibited processing, while explaining any resulting targeting or measurement changes to advertisers.
The order raises the stakes of Meta’s response to its earlier behavioral-ad data enforcement, giving rival ad platforms and brands a concrete European compliance benchmark to assess against their own targeting practices.
Third-order effects
If sustained, the intervention strengthens the EDPB’s practical ability to turn GDPR disputes into product-level limits through national regulators, rather than leaving enforcement primarily to fines and extended remediation.
The broader adtech market could move toward a clearer separation between audience reach and permission to use personal data for behavioral targeting; the eventual scope will depend on implementation and any challenge by Meta.
The trend: European privacy enforcement is increasingly testing whether large platforms can preserve behaviorally targeted advertising when regulators contest the legal basis for using user data.
The EDPB has apparently ruled that Norway's temporary ban on Meta's behavioral advertising can be extended on a permanent basis, & across the EU. Reporting on this outcome has been misleading: @MBarczentewicz provides helpful context in this blog post: https://barczentewicz.subs…
Bravo to @Datatilsynet. EDPB has voted to extend the Norwegian ban on Metas behavioural advertising without proper consent to the whole EU, and directed Ireland to implement the ban. Norwegian authority says it's doubts Meta's new consent or pay is legal. https://www-datatilsynet…
Massive (repeat: massive) enforcement decision by the @EDPB. Many will dismiss it as only applicable to Meta but regulatory rules of the road for legal bases are ubiquitous for all organisations. 🧵https://edpb.europa.eu/ ...
Make sure to let Facebook's lobbyists and public advocacy arms know this. They seem to be full speed ahead with Facebook's warped interpretation of the fundamental right to privacy under GDPR.
@RobertJBateman The IAPP article also states: “Judin indicated Norway does not recognize Meta's subscription initiative as GDPR compliant or sufficient to lift the ban.” But if you're right (you probably are) and the scope of the ban and the procedure is narrow, there is no groun…
Amazing: Norwegian DPA's ban on behavioural targeting extended to the rest of the EU, and FB's subscription scheme called into question. Curious to see what comes next!
@NickBotton Well, its not a ban on behavioural targeting, but a ban on the processing of personal data for behavioural advertising on the legal bases of contract and legitimate interest. but i am curious too as to what comes next https://edpb.europa.eu/...
@NickBotton @epc_angela Not only that, but to what they actually *can* ask consent for? In the Bundeskartellamt judgement, getting consent for all the massive amounts of third-party personal data didn't seem feasible.
The irony is that the decision is likely not so massive for Meta, which had announced its move to consent as its legal basis for personalised ads: https://about.fb.com/...
@RobertJBateman if the consent that will be obtained by Meta will be valid (in ban-lifting procedures). And I have no idea where they got the idea that the DPC has to implement all this in two weeks instead of a month, which is what I think/thought? GDPR says.
“In addition, Meta has been found by the IE SA to not have demonstrated compliance with the orders imposed at the end of last year.” Wait, what? They did switch away from contract though, no? https://edpb.europa.eu/...
@epc_angela An important nuance! In the end it'll come down to what it should always have been about: the modalities of gdpr-compliant consent. If Meta had spent time building up user trust rather than lawyer fees, it might not be so reticent to rely on it as a legal basis
My latest reporting on the EDPB's urgent binding decision to ban Meta's targeted ad practices. While Meta stands up its EU subscription solution, it's unclear to onlookers and regulators alike whether the plan is GDPR-compliant. Adtech is about to change. https://iapp.org/...
Huge, but what will the DPC Ireland do? The Norwegian DPA reports the @eu_edpb has decided the Norwegian ban on behavior-based advertising on Facebook & Instagram will become permanent & be extended to apply to the entire EU/EEA. https://www.datatilsynet.no/ ... HT @gateklons @no…
@PrivacyMatters ... I had the same thought on LI — I honestly have no idea how this doesn't completely destroy the whole concept of OSS and LSAs as a concept. I really need to go read the EDPB decision.
@MBarczentewicz Not sure CJEU limited itself to analysis of 3rd party data in Meta v. BKA though. I also don't recall Meta disputing this in the initial NO DPA ban or mentioning that they already use consent for that data (though some of the decision is redacted).
@MBarczentewicz Re: deadline. In the Bloomberg article, an EDPB spokesperson also confirms the two weeks deadline given to the DPC. Agreed that it's weird. Maybe it's current time elapsed + two weeks to adopt + one week implementation period = one month somehow or maybe EDPB foun…
4/ Yesterday, Meta officially announced that it will introduce a subscription tier in the EU, EEA, and in CH in a “pay or okay” scheme. This had been rumored for some time. Meta had already announced that it would transition its data processing basis to consent.
Bloomberg reports that Meta is “set to be hit by a Europe-wide ban” on personalised advertising. I respond with an emergency newsletter to help explain how this “ban” is unlikely to actually be a ban. [image]
EDPB spokeswoman echos the Danish DPA and confirms that DPC has two weeks to implement the decision. Also does the EDPB really have someone on standby for media inquires at 9:30 PM??? https://www.bloomberg.com/... [image]