Meta is facing a major legal challenge and damages claim in Spain that argues that years of lack of a valid legal basis for processing people's data for ads under European Union data protection rules by part of the ad tech giant also constitutes a competition violation for which they should be financially compensated. .
AMI, an association of newspaper owners whose more than 80 members include newspaper editors, including El País, ABC y La Vanguardia, is behind said lawsuit. The litigants are demanding more than 550 million euros (about 600 million dollars) for what they describe as Meta's “systematic and massive non-compliance” with the EU's General Data Protection Regulation (GDPR).
“Meta has repeatedly failed to comply with [EU] data protection legislation, ignoring the regulatory requirement that citizens must give their consent to the use of their data for the creation of advertising profiles, as can be seen from the different resolutions of the authorities. competent European bodies in this matter,” they indicate in a press release.
“The systematic and massive use of personal data of users of the Metaplatforms, tracked without their consent throughout their digital browsing, would have allowed the American company to offer the sale of advertising space in the market based on a competitive advantage obtained illegitimately. ", they say. He continues the note by arguing that 100% of Meta's regional revenues were obtained illegally.
Meta, the owner of Facebook and Instagram, was fined €390 million in January after EU data protection authorities confirmed that the performance of a contract was not a valid legal basis for tracking and profiling users. users to target ads to them.
That final decision on the GDPR, which took years to make its way through the regulation's dispute resolution and decision-making processes but which Meta is now appealing in the Irish courts, confirmed that the tech giant was breaking the law. , creating enabling conditions for the private sector with privacy litigation, like this one, to be filed. So you can expect to see more situations of this type appear.
The AMI challenge targets the processing of Meta ads during the period since the GDPR came into force, in May 2018, and until the end of July last year. However, the complainants do not rule out the possibility of extending the deadline for their claim to take into account what they call “Meta's persistence in non-compliance.”
Since the January sanction, Meta has twice changed its alleged legal basis for processing ads in the region. Initially he went on to claim a basis called legitimate interests. However, a separate (long-running) competition and privacy challenge against Meta's super-profiling, brought by Germany's competition authority, which had previously been referred to the bloc's top court, led to a CJEU decision in July 2022 which also invalidated that basis.
The AMI challenge refers to a “urgent binding decision” of October 27 by the European Data Protection Board, which was issued following a request from the Norwegian data protection authority in light of the continued processing of personal data by Meta without a valid legal basis in the months following the decision of the CJEU, to explain the possible extension of the deadline.
In November, Meta moved to claim consent as a legal basis for its tracking ad business in the EU. However, the choice you have designed for regional users requires them to choose between paying you a monthly subscription for an ad-free version of your products or "opting in" to be tracked and profiled. This is despite the GDPR stipulating that consent must be “freely given” in order to be legally obtained.
Meta's latest attempt to try to exclude its ad tracking business from EU privacy rules is already under the microscope, with privacy and consumer rights groups arguing that the option it offers users is illegal and unfair .
Although a notable irony is that the use of the so-called "payment cookie wall" to obtain consent for tracking is a feature of several European newspaper websites, which require users to pay a subscription to access journalism or agree to be tracked to non-paid access change.
The privacy group noyb which was behind the original May 2018 GDPR complaint against Meta's legal basis for tracking and is now challenging Meta's latest approach to “pay or accept” consent has also been alerting newspapers about cookie payment criteria since 2021.
