Meta fined $414 million in EU privacy cases
European Union regulators on Wednesday hit Facebook parent Meta with hundreds of millions in fines for privacy violations and banned the company from forcing users in the 27-nation bloc to agree to personalized ads based on their online activity.
Ireland’s Data Protection Commission imposed two fines totaling $414 million in its decision in two cases that could shake up Meta’s business model of targeting users with ads based on what they do online. The company says it will appeal.
A decision in a third case involving Meta’s WhatsApp messaging service is expected this month.
Meta and other Big Tech companies have come under pressure from the European Union’s privacy rules, which are some of the world’s strictest. Irish regulators had slapped Meta with four other fines for data privacy infringements since 2021 that total $955 million and have a slew of other open cases against a number of Silicon Valley companies.
In Brussels, EU antitrust officials also have accused Meta last month of distorting competition in classified ads.
The Irish watchdog — Meta’s lead European data privacy regulator because its regional headquarters are in Dublin — fined the company $223 million for violations of EU data privacy rules involving Facebook and an additional $191 million for breaches involving Instagram.
The decision stems from complaints filed in May 2018 when the bloc’s privacy rules, known as the General Data Protection Regulation took effect.
Previously, Meta relied on getting informed consent from users to process their personal data to serve them with personalized, or behavioral, ads, which are based on what users search for online, the websites they visit or the videos they click on.
Under the GDPR, Meta changed the legal basis under which it processes user data by adding a clause to the terms of service for advertisements, in effect forcing users to agree that their data could be used. That violates EU privacy rules.
The Irish commission initially sided with Meta but changed course after its draft decision was sent to a board of EU data protection regulators, many of whom objected.
In its final decision, the commission said Meta “is not entitled to rely on the ‘contract’ legal basis” to deliver behavioral ads on Facebook and Instagram.
Meta said in a statement that “we strongly believe our approach respects GDPR, and we’re therefore disappointed by these decisions and intend to appeal both the substance of the rulings and the fines.”
Meta has three months to ensure its “processing operations” comply with the EU rules. The company noted that the decision doesn’t prevent it from displaying personalized ads, but it covers the legal basis for handling user data only.
Max Schrems, the Austrian privacy activist who filed the complaints, said the ruling could deal a big blow to the company’s profits in the EU, because “people now need to be asked if they want their data to be used for ads or not” and can change their mind at any time.