Meta fined €390M by Irish Data Protection Commission for forcing users to accept targeted ads

Facebook’s parent company Meta on Wednesday, January 4, was slapped with fines totaling more than $400M (€390M) by the Irish Data Protection Commission (DPC) as it concluded the inquiries into the data processing operations of Meta Ireland in connection with the delivery of its Facebook and Instagram services. 

According to DPC, Meta Ireland has been fined €210M for breaches of GDPR relating to its Facebook service and €180M for violations concerning its Instagram service. 

Further, Meta Ireland has been directed to bring its data processing operations into compliance within three months. The regulator also said that Facebook and Instagram could not “force consent” by saying consumers have to accept how their data is used or leave the platform.

The investigation dates back to May 25, 2018, when privacy campaigner Max Schrems complained on behalf of two users in Belgium and Austria. The complaint was made when the EU’s GDPR came into effect.

To comply with GDPR, Facebook and Instagram asked users to click “I accept” to indicate their acceptance of the updated Terms of Service. If users did not accept, they could not use Facebook or Instagram. 

The complainants argued that Meta was ‘forcing’ them to consent to their data being used for behavioural advertising and other personalised services, which breached the GDPR.

Meta’s reply

In an official blog post, Meta said it is disappointed by the decisions and intends to appeal both the substance of the rulings and the fines.

“The suggestion that personalised ads can no longer be offered by Meta across Europe unless each user’s agreement has first been sought is incorrect,” says Meta in a blog post. 

“There has been a lack of regulatory clarity on this issue, and the debate among regulators and policymakers around which legal bases are most appropriate in a given situation has been ongoing for some time,” adds Meta.  

“That’s why we strongly disagree with the DPC’s final decision and believe we fully comply with GDPR by relying on Contractual Necessity for behavioural ads given the nature of our services. As a result, we will appeal the substance of the decision,” says Meta.