Meta faces GDPR complaint over processing personal data without ‘free consent’

creativeneko – stock.adobe.com

Paid-for service means data protection is only available to those who can afford it, privacy group argues in data protection complaint

Bill Goodwin,
Computer Weekly

Published: 28 Nov 2023 17:30

The social media company Meta is facing a complaint for breaching European data protection law after offering customers the choice of accepting targeted advertisements based on their likes, interests and other personal information, or paying for an ad-free alternative.

The privacy group, Noyb, filed a complaint with the Austrian Data Protection Authority, claiming that Meta is in breach of the EU General Data Protection Regulation (GDPR) by giving users the choice to either consent to be tracked for personalised advertising or paying up to €250 a year to “preserve their data protection rights”.

The group, led by activist lawyer Max Schrems, is calling for the Austrian regulator to begin an urgent investigation into Meta, to halt Meta’s illegal processing of data, and impose a fine to deter other companies from following Meta’s approach.

Claim likely to have wide impact

The case centres on whether Meta can legitimately claim to have obtained free consent from its customers to process their data, as required under GDPR, when the only alternative is for customers to pay a substantial fee to opt out of ad-tracking.

The complaint will be watched closely by social media companies such as TikTok, which are reported to be considering offering ad-free services to customers outside the US to meet the requirements of European data protection law.

Meta denied that it was in breach of European data protection law, citing a European Court of Justice ruling in July 2023 which it said expressly recognised that a subscription model was a valid form of consent for an ad-funded service.

Spokesman Matt Pollard referred to a blog post announcing Meta’s subscription model, which stated, “The option for people to purchase a subscription for no ads balances the requirements of European regulators while giving users choice and allowing Meta to continue serving all people in the EU, EEA and Switzerland”.

Meta has been seeking to establish a legal basis of collecting customers’ data under GDPR since the European Court of Justice imposed a €1.2bn fine on Meta in January 2023 and ordered it to suspend data transfers between the EU and the US within six months.

The company began offering people in the EU, EEA and Switzerland the choice to pay a monthly subscription to use Facebook and Instagram without any ads in November 2023.

Fundamental rights

Noyb has brought the case on behalf of an anonymous complainant, who is unemployed and receives benefits, and lacks financial means to pay Meta’s subscription fee to access Facebook and Instagram.

The privacy group argues that the complainant is one of millions of people in the EU that “simply do not have the financial means to prevent their personal data from being processed for advertising purposes by taking out a subscription”.

Schrems said, “Fundamental rights are usually available to everyone. How many people would still exercise their right to vote if they had to pay €250 to do so?”

Noyb says that if Meta is successful in defending its new approach, other online services could follow by offering subscriptions for versions of their services that do not offer targeted advertising.

High cost of privacy

According to the complaint, the average person has 35 apps installed on their smartphone. If all of these apps followed Meta’s lead and charged a similar fee, people would have to pay an annual fee of more than €8,000 to ensure their “fundamental rights” of privacy.

Noyb argues that data protection is an “inalienable right” that should be available equally to all citizens. However, setting the requirement to obtain consent from users to process data against a payment for an ad-free service would mean that data protection would only be available to those who can afford it. “GDPR does not provide for a payment burden for the refusal of consent,” it said.

The complaint quotes surveys that have found only 3% to 10% of people want their data to be processed for personalised advertising on Facebook. This is in contrast to research that shows 99% of users opt for free services rather than pay to preserve their privacy rights when they have a choice. The results show that the “free will” of consumers is “structurally undermined” by requiring payments to opt out of targeted advertisements, Noyb argues.

The complaint claims that Facebook’s fees are “clearly overpriced” and amount to a “privacy fee”. Facebook will charge users up to €12.99 and each linked account will cost another €8, equivalent to up to €250 a year for one person using Instagram and Facebook. This compares to an average annual revenue of €63 that Meta receives from each user in Europe per year, according to estimates taken from Meta’s own figures.

Meta said that its subscription prices were comparable to other online services, such as the video service YouTube Premium, music streaming service Spotify and film streaming service Netflix.

Felix Mikolasch, data protection lawyer at Noyb said, “EU law requires that consent is the genuine free will of the user. Contrary to this law, Meta charges a ‘privacy fee’ of up to €250 per year if anyone dares to exercise their fundamental right to data protection.”

Read more on Privacy and data protection

Meta results show impact of data fines and datacentre upgrade strategy