FILE PHOTO: Woman holds smartphone with Meta logo in front of a displayed Facebook's new rebrand logo Meta in this illustration picture taken October 28, 2021. REUTERS/Dado Ruvic/Illustration/File Photo
BRUSSELS/BANGALORE (Reuters) -Meta will only be able to run advertising based on personal data with users' consent, according to a confidential EU privacy watchdog decision, a person familiar with the matter said on Tuesday, in a blow to the U.S. social network.
The Irish data protection agency, which oversees Meta because its European headquarters is located in Dublin, has been given a month to issue a ruling based on the European Data Protection Board's (EDPB) binding decision.
The EDPB will likely require the Irish body to hand out fines, the person said, asking not to be named because of the senstivity of the issue.
Big Tech's targeted ad model and how data is collected and used has drawn regulatory scrutiny around the world.
Shares of the company were down 6.2% in mid-session trade. Google, Snap and Pinterest which are reliant on digital advertising, fell 2.2%, 8% and 4% respectively.
The Irish case against Meta was triggered by a complaint by Austrian privacy activist Max Schrems in 2018.
"Instead of having a yes/no option for personalised ads, they just moved the consent clause in the terms and conditions. This is not just unfair but clearly illegal. We are not aware of any other company that has tried to ignore the GDPR in such an arrogant way," Schrems said in a statement.
He said the EDPB's ruling means that Meta must allow users to have a version of all apps that do not use personal data for ads while the company would still be allowed to use non-personal data to personalise ads or simply ask users for consent.
The 27-country bloc's landmark privacy rules known as the General Data Protection Regulation went into effect in 2018.
Meta is engaging with the Irish body, a Meta spokesperson said.
"GDPR allows for a range of legal bases under which data can be processed, beyond consent or performance of a contract. Under the GDPR there is no hierarchy between these legal bases, and none should be considered better than any other," the spokesperson said.
Apple's new privacy rules, which limit digital advertisers from tracking iPhone users, have also been a blow to the Facebook parent.
An EDPB spokeswoman declined to provide details of the decisions made. The agency said it stepped in after other national watchdogs disagreed with the Irish agency's draft decision.
Its draft decisions on Meta's parent Facebook and Instagram focus on the lawfulness and transparency of processing for behavioural advertising, while its decision on WhatsApp concerns the lawfulness of processing for the purpose of the improvement of services.
"The DPC cannot comment on the contents of the decisions at this point. We have one month to adopt the EDPB's binding decisions and will publish details then," the Irish Data Protection Commission said.
Meta may have to change its business model, said Helena Brown, head of data & privacy at London-based law firm Addleshaw Goddard.
"The direction of travel seems to be that the European regulators will not allow Meta to hide behind "provision of services" as its basis for using personal data for behavioural advertising," she said.
"Instead, Meta may need to change its approach to seeking clear, explicit consent instead. It will be a challenge for Meta to be able to explain its practices in a way that such consent can be lawful and well-informed," Brown said.
The WSJ first reported on the EDPB ruling.
(Reporting by Foo Yun Chee in Brussels and Chavi Mehta in Bengaluru;Editing by Vinay Dwivedi, Krishna Chandra Eluri and Barbara Lewis)
