Meta needs explicit user consent to run personalized ads, EU watchdog rules

Meta has already been coping with a slump in ad revenue this year, and now a decision from European Union privacy regulators threatens to reduce Meta’s ad revenue even more next year. According to Reuters, a person familiar with the matter said that the European Data Protection Board ruled Monday that Meta cannot continue targeting ads based on its own users’ online activity—like the Instagram reels they've viewed or Facebook profiles they've clicked.

If the EU data privacy watchdog gets its way, Meta could face “hefty fines,” Reuters reported, for continuing to rely on its terms of service to gain user consent for running personalized ads.

But this decision has not yet been publicly disclosed, The Wall Street Journal reported, and it won’t be finalized until Ireland’s Data Protection Commission (DPC) issues public orders. That could take a month, and at any point, Meta could appeal either decision.

Reportedly, neither board can comment yet on their decisions. Meta told Ars that it cannot comment on any plans to appeal until after the DPC announces its decision.

Meta’s ad business was hit hard when Apple updated its privacy settings to easily allow users to opt out of third-party data tracking. On Meta platforms like Facebook and Instagram, users could already opt out of such tracking on the websites they visited, but by joining the platforms, they agreed that Meta could track their clicks and taps within Meta platforms. That would change if the DPC agrees with the EU board, threatening to further reduce Meta access to behavioral data, and according to AdAge, Meta was already struggling with advertisers losing trust in the company’s abilities to effectively target ads. It already reimagined its ad platform once and would likely have to go back to the drawing board if the DPC upholds the EU watchdog group's ruling.

A Meta spokesperson told Ars that the EU watchdog group's ruling "is not the final decision, and it is too early to speculate." Because the EU's General Data Protection Regulation "allows for a range of legal bases under which data can be processed, beyond consent or performance of a contract" and provides "no hierarchy between these legal bases," Meta's spokesperson said that as Meta sees it now, no legal basis for data processing "should be considered better than any other." However, Meta has "engaged fully with the DPC on their inquiries and will continue to engage with them as they finalize their decision.”