Facebook users worldwide are being asked to review their privacy settings, including political and religious affiliations, as GDPR goes into effect in Europe
- Facebook is telling all users to review their privacy settings, including information they share on their profiles and facial recognition preferences.
Context & Ripple Effects
This prompt is the consumer-facing end of a rollout Facebook began in April, when it debuted enhanced privacy controls for all users globally ahead of the May 25 GDPR enforcement date flagged by Bloomberg. The company framed it as more choice; TechCrunch's read was an interface designed to push users toward consent that complies with the letter of the law but not its spirit.
The scope question was settled separately: Facebook moved its terms so that 1.5B users outside Europe fall under US rather than Ireland terms, confining GDPR's direct effect to roughly 400M users — which makes a worldwide review prompt notable, since most of the people seeing it are not covered by the regulation prompting it.
First-order effects
- Users worldwide are nudged through settings covering profile information — including political and religious affiliations — ad preferences, and facial recognition, with the EU's 400M users gaining enforceable rights while everyone else gets the same interface without the legal backing.
- Facebook absorbs the compliance cost once and applies the UX globally, converting a European legal obligation into a worldwide product change.
Second-order effects
- By contracting its terms-of-service footprint, Facebook sets a template other US platforms can follow — meeting GDPR where enforcement exists while minimizing its reach elsewhere — pressuring regulators to decide whether extraterritorial application needs teeth.
- Facial recognition shifting to an explicit opt-in choice removes a default data asset from Facebook's ad-targeting and identification pipeline, raising the bar for how much inferred value the remaining consents must deliver.
Third-order effects
- Sensitive identity attributes on profiles are turning from a targeting asset into a liability: four years later Facebook moved to remove religious views, political views, addresses, and sexual-preference fields entirely (the December 2022 profile-field removal), suggesting the review prompts were the first step in a retreat from storing these categories at all.
- If jurisdiction-shopping via terms-of-service becomes standard practice, GDPR's global influence will run through product design copied voluntarily rather than through law applied directly — regulation as reference implementation rather than binding rule for non-EU users.
The trend: GDPR-era privacy changes are pushing platforms to treat sensitive personal attributes as liabilities to be minimized rather than profile data to be collected, with EU law setting design defaults that companies then apply — or limit — worldwide at their own discretion.