A person familiar with the matter said on Tuesday that BRUSSELS BANGALORE Meta will only be able to run ads based on personal data with users consent, according to a confidential EU privacy watchdog decision.
The Irish data protection agency, which oversees Meta, has been given a month to make a decision on the European Data Protection Board's EDPB binding decision.
The person said that the EDPB will probably require the Irish body to hand out fines, and they asked not to be named because of the senstivity of the issue.
Big Tech's targeted ad model and how data is collected and used has drawn regulatory scrutiny around the world.
In mid-session trade, the company's shares were down 6.2 per cent. Google, Snap and Pinterest, which are reliant on digital advertising, fell 2.2 per cent, 8 per cent and 4 per cent respectively.
The Irish case against Meta was triggered by a complaint by Austrian privacy activist Max Schrems in 2018.
Instead of having a yes no option for personalised ads, they just moved the consent clause in the terms and conditions. This is not just unfair but clearly illegal. Schrems said in a statement that they were not aware of any other company that has tried to ignore the GDPR in such an arrogant way.
He said that the EDPB's ruling means that Meta must allow users to have a version of all apps that don't use personal data for ads, while the company would still be allowed to use non-personal data to personalise ads or simply ask users for consent.
The landmark privacy rules known as the General Data Protection Regulation, which was introduced in the 27 country bloc in 2018, went into effect in 2018.
Meta is engaged with the Irish body, a Meta spokesperson said.
GDPR allows for a wide range of legal bases under which data can be processed beyond consent or performance of a contract. The spokesperson said that there was no hierarchy between these legal bases and none should be considered better than any other under the GDPR.
An EDPB spokeswoman wouldn't say anything about the decisions made. The agency said it was stepping in after other national watchdogs disagreed with the Irish agency's draft decision.
The DPC can't comment on the contents of the decisions at this point. The Irish Data Protection Commission said that they have a month to adopt the EDPB's binding decisions and will publish details there.
Helena Brown, head of data privacy at London-based law firm Addleshaw Goddard, said Meta may have to change its business model.
The direction of travel seems to be that the European regulators won't allow Meta to hide behind the provision of services as its basis for using personal data for behavioural advertising, she said.
Meta may need to change its approach to seeking clear, explicit consent instead. It will be a challenge for Meta to be able to explain its practices in a way that can be lawful and well-informed, Brown said.
The WSJ first reported on the EDPB ruling.