Meta loses battle in EU, will ask for consent to show personalized ads [Updated]

After five years of fighting legal battles to prevent this undesirable outcome, Meta has finally agreed to ask Instagram and Facebook users in the European Union for consent before targeting them with highly personalized ads, a Wall Street Journal report has revealed.

This means that instead of requiring Meta app users in the EU to agree to invasive data collection used for personalized ads at sign-up, or else fill out a long form to request to opt out, EU users will soon be able to opt in or out by clicking simply yes or no.

The Journal spoke to sources familiar with Meta's dealings who confirmed that Meta sent a proposal to EU privacy regulators agreeing to shift to this consent legal basis for data collection as early as the end of October.

In a blog today, Meta explained that there will be "no immediate impact" on services, but in the future, the changes will impact app users located in the EU, the European Economic Area, and Switzerland.

Previously, Meta had argued that the EU's General Data Protection Regulation (GDPR) did not require a consent basis for data collection. Now, Meta said that "a number of evolving and emerging regulatory requirements in the region"—perhaps most "notably how our lead data protection regulator in the EU, the Irish Data Protection Commission, is now interpreting GDPR in light of recent legal rulings"—partly motivated the social media company to agree to at last take this step.

One of those recent rulings came down last month in Norway, which told Meta to either ask for consent or stop showing behavioral ads in Europe. That decision led to a temporary ban on Meta's behavioral ads in Norway, a move that was applauded by NOYB, an EU consumer rights group that advocates for data privacy and brought several complaints against Meta for allegedly violating the GDPR. After the Norway ruling, NOYB predicted that the temporary ban would be an "important first step" toward requiring Meta to ask for consent to collect data across the EU, and seemingly, that prediction panned out.

Ars could not immediately reach NOYB for comment. [Update: A NOYB spokesperson linked Ars to a blog that said that while it appears that Meta may buckle, NOYB is still waiting to see exactly how Meta implements the changes to start requiring consent for behavioral ads, remaining somewhat dubious that the changes will bring Meta fully into compliance with the GDPR. Because behavioral ads are not a concept defined by the GDPR, Meta could, for example, still attempt to rationalize collecting age or location of a user, the blog said.

NOYB founder Max Schrems pointed out that GDPR covers "all types of personalization, also on things like your age, which is not a 'behavior.'" As EU regulators continue pressuring Meta, "there seems to be no way out" of asking users for consent "anymore," the blog said, but if Meta finds a way to "not apply the law fully," Schrems promised that NOYB "will obviously continue litigation."]

Recently, Meta told EU regulators that making this change represented a "significant hurdle" for Meta and noted that it will "require at least three months to implement," the WSJ reported. That's why it seems like making the update by the end of October might be an ambitious deadline. In its proposal, Meta has also offered to wait to implement the change until early next year.

Analysts have suggested that the key reason Meta resisted using a consent legal basis for data collection in the past is because it makes it too easy for app users to opt out. When Apple started asking iPhone users for consent for apps to collect data in 2021, many users opted out, and Meta's ad revenue took a huge hit as it lost access to a large chunk of third-party data.

Meta only started recovering from those losses this year, and the WSJ noted that Meta's ad revenue rebound was largely due to Meta tweaking its ad-targeting, likely growing more reliant on its own data collection than third parties'. Therefore, it's currently unclear how EU users opting out of sharing data directly with Meta will disrupt that forward momentum. It's possible Meta's ad revenue could take an even bigger hit because of those tweaks if the algorithm is now overly reliant on the company's own data collection, which could soon experience a sudden decrease in volume.

In a blog, Meta made some assurances to advertisers that this change won't hurt its business in the EU.

"Once this change is in place, advertisers will still be able to run personalized advertising campaigns to reach potential customers and grow their businesses," Meta's blog said. "We have factored this change into our business outlook and related public disclosures made to date."

Meta also promised to share more information in the coming months, "because it will take time for us to continue to constructively engage with regulators to ensure that any proposed solution addresses regulatory obligations in the EU."

Privacy experts are likely to claim Meta's decision today as a win. Last December, a nonprofit defending data privacy online, the Electronic Frontier Foundation, said that tech companies like Meta using voluntary opt-in consent "should be the baseline requirement for any data collection, retention, or use."

"And we should take a step further: online behavioral advertising should be banned," EFF suggested.