• by Wendy Davis  @wendyndavis, November 1, 2023

Privacy officials in Europe have ordered Meta to stop serving behaviorally targeted ads to residents of the European Union as well as Iceland, Liechtenstein and Norway, without their consent.

The order, issued Friday and made public Tuesday, extends and broadens a short-term order issued earlier this year by the Norwegian Data Protection Authority. That earlier ruling -- which took effect in August and was set to expire this week -- required Meta to either obtain Norwegian users' consent to online behavioral advertising, or pause serving ads to Norway residents based on their online activity or general locations.

The European authorities say in the new ruling Meta can't justify harnessing people's personal data for advertising based on either its terms of service, or a "legitimate interest" in serving targeted ads. Europe's broad General Data Protection Regulation requires companies to have a legal basis to process data.

The order appears to allow Meta to continue using behavioral targeting techniques as long as consumers consent to having their data processed.

Meta takes the position that the new ruling allows the company to move forward with its plan to ask users to either pay for ad-free versions of Facebook and Instagram, or else consent to behavioral targeting.

A company spokesperson stated Wednesday that European regulators have known for weeks that Meta would offer a paid, ad-free option, and that the new decision “unjustifiably ignores that careful and robust regulatory process.” 

It's not yet clear whether Meta's planned subscription option will comply with European privacy standards.

On Wednesday, the Denmark privacy agency stated it “strongly doubts whether Meta's proposed consent solution, which means that those who do not consent to behavior-based marketing must pay a fee, will be legal,” according to a Google translation.

But Meta says its subscription approach meets the requirements set out by Europe's highest court, which recently said companies could charge “an appropriate fee” to consumers who didn't consent to the processing of their data for ad targeting purposes.

On Wednesday, the European privacy board said in a summary of its new ruling that Meta had failed to comply with a separate privacy order issued last year.

“It is high time for Meta to bring its processing into compliance and to stop unlawful processing,” the agency's chair, Anu Talus, stated.

Talus apparently was referring to an order issued in December by the Irish Data Protection Commission, which rejected Meta's argument that its contracts with users provided a legal basis to serve them with targeted ads, and fined the company approximately $414 million.