• by Wendy Davis  @wendyndavis, July 17, 2023

Privacy regulators in Norway have ordered Meta to either obtain users' consent to online behavioral advertising, or pause serving ads to people based on their online activity or general locations.

The order, issued Friday by Datatilsynet, will take effect August 4 and last for three months. If Meta fails to comply, it will face fines of around $100,000 per day.

The ban applies to ads targeted based on inferences drawn from online behavior and estimated locations -- but not to ads based on information people put in their profiles, such as their cities, gender, age or interests they expressly provided.

Behavioral advertising is “one of the largest risks to privacy,” the regulator stated Monday in a summary of its decision.

“Meta, the company behind Facebook and Instagram, holds vast amounts of data on Norwegians, including sensitive data,” the agency added. “Many Norwegians spend a lot of time on these platforms, and therefore tracking and profiling can be used to paint a detailed picture of these people’s private life, personality and interests. Many people interact with content such as that related to health, politics and sexual orientation, and there is also a danger that this is indirectly used to target marketing to them.”

The Datatilsynet's order will expire in November, but the agency can ask the European Data Protection Board to issue a longer ban.

The new decision adds to Meta's growing privacy challenges in Europe.

Late last year, the Irish Data Protection Commission ruled late last year that Meta lacked a valid basis to process users' data. (Europe's broad General Data Protection Regulation requires companies to have a legal basis to process data.) The Data Protection Commission rejected Meta's argument that its contracts with users provided a legal basis to serve them with targeted ads, and fined the company roughly $414 million.

After that decision came out, Meta vowed to continue serving targeted ads in Europe, but said it would no longer contend that the data processing was justified by its terms of service.

“We are changing the legal basis that we use to process certain first party data in Europe from ‘contractual necessity’ to ‘legitimate interests,'” the company wrote in March, adding that the change wouldn't prevent personalized advertising.

Earlier this month, Europe's highest court signaled in a separate case involving Meta that the company might not prevail with that argument. The court's summary of its decision in that case included a statement that personalized advertising isn't a “legitimate interest” that would justify the processing of people's data without their consent.

Concerns about Europe's laws have also led Meta to delay launching its new social service, Threads, in the EU.

A Meta spokesperson said the new decision out of Norway has “no immediate impact” to the company's services, adding that Meta continues to engage with its lead privacy regulator in Europe -- the Irish Data Protection Commission.

“The debate around legal bases has been ongoing for some time and businesses continue to face a lack of regulatory certainty in this area,” the spokesperson added.