Random Image Display on Page Reload

Norway Took On Meta’s Surveillance Ads and Won

Aug 3, 2023 2:00 AM

Norway Took On Meta’s Surveillance Ads and Won

Meta has long fought Europe's demands that it get people's consent before using their data for targeted ads. Then a Norwegian regulator threatened fines of $100,000 per day.

Blue paper with circular cutouts forming an abstract eye or bullseye pattern

Illustration: Rost-9D/Getty Images

When you watch a video on Instagram, the app's algorithms are also watching you. As you scroll, they are hoovering up information to figure out what makes you tick—not only to show you content that keeps you coming back, but also to show you ads that are more likely to make you buy something.

Meta calls the information it compiles about how users behave across its apps “activity.” That activity might include what they say in social media posts or comments, the contents of the (unencrypted) messages they send or receive, the hashtags they use, and how long they spend watching certain types of posts or videos.

When compiled, this information can reveal incredibly personal information, potentially ranging from an individual’s musical tastes to their menstrual cycles. “These data are rather potent in the sense that they will tell you everything about a person's online behavior and therefore also their interests, their personality,” says Tobias Judin, spokesperson for Norway’s privacy watchdog, Datatilsynet. When that information about how a user behaves online is used to inform what type of ads that person sees, it becomes what’s known as behavioral advertising. “Literally everything that you do on these platforms can be recorded and used for behavioral advertising purposes,” he says.

For years, European courts have argued that Meta cannot use this type of data for advertising unless the company asks for users’ explicit—yes or no—consent. But in July, Norway went a step further, branding the way Meta carries out behavioral advertising as illegal. The watchdog threatened to ban Meta’s behavioral ads in Norway and pledged to fine the tech giant $100,000 per day unless the company changed its ways. The ban was due to take effect on August 4; three days before that, on August 1, Meta quietly published an update to a January blog post announcing its intention to comply.

“Today, we are announcing our intention to change the legal basis that we use to process certain data for behavioral advertising for people in the EU, EEA and Switzerland from ‘Legitimate Interests’ to ‘Consent,’” the blog post read, without saying specifically when the change will take place or mentioning Norway. Meta declined WIRED’s request to comment further.

Norway is chalking this up as a victory. “While Meta states that this is a voluntary change on their end, that appears very unconvincing,” says Judin. “Asking users for consent could negatively affect the company’s earnings, and historically speaking, Meta has not been willing to sacrifice profits for privacy unless forced.” Meta said the wider Europe region generated almost a quarter of its advertising revenue in the three months leading up to June 30.

Most Popular

Norway’s threat was a bold move. “We normally don't ban processing activities like this,” Judin says. But the regulator has become a new thorn in Meta’s side. Last year, the watchdog came under new leadership, with privacy lawyer Line Coll taking the helm as director. Speaking to the Norwegian business magazine Kapital in May, she suggested she was thinking about new ways to use sanctions to better protect privacy. So far, she has delivered.

However, the Norwegian order formed only the top of a very large pile of legal challenges to the way Meta deployed personalized advertising in Europe.

In response, the company has adopted different legal justifications for doing this type of advertising that did not require users’ consent. Initially it argued that behavioral ads were an essential part of its business. After that was questioned in the courts, Meta claimed a “legitimate interest” to use that information. Then, in July, the EU’s Court of Justice decided that didn’t fly unless users were asked for consent. After that, Norway’s complaint was simply the straw that broke the camel’s back.

The real root of Meta’s decision was a ruling by the European Data Protection Board in January and the EU Court of Justice case in July, says Max Schrems, who runs the influential Vienna-based privacy campaign group NOYB. However he notes that the regulator in Norway—which is part of the European Economic Area, not the EU—has become a forceful voice in trying to get Meta to comply with European tech rules. “The Norwegians are really applying the law as it is, which a lot of other DPAs [data protection regulators] don’t really do,” he says.

The fact that Meta is indicating it will now ask for European users' consent is not significant in itself, says Schrems. “We knew this is the law since the GDPR came into force,” he says. “It’s more significant that Meta has simply ignored the law for the last five years.”

Back in Norway, Judin says the regulator feels positive about Meta offering users more choice about how their information informs the advertising they see. However he wants to make sure they are not nudged in any way into giving that consent. “We will follow closely how Meta implements the change,” he says.

Get More From WIRED

Morgan Meaker is a senior writer at WIRED covering European business. Before that, she was a technology reporter at The Telegraph and also worked for Dutch magazine De Correspondent. In 2019 she won Technology Journalist of the Year at the Words by Women Awards. She was born in Scotland, lives… Read more
Senior Writer

More from WIRED

Uber and Lyft Drivers Have Some Advice for Autonomous Vehicles Set to Swarm the Streets

San Francisco ride-hail drivers are about to share the roads with robot competitors. They say that the self-driving cabs need to work on their traffic skills—and watch out for bodily fluids.

Aarian Marshall

The ‘Godfather of AI’ Has a Hopeful Plan for Keeping Future AI Friendly

Geoffrey Hinton left Google so he could speak more freely about AI’s dangers. He argues that building analog computers instead of digital ones might keep the technology more loyal.

Steven Levy

To Navigate the Age of AI, the World Needs a New Turing Test

The father of modern computing would have opened his arms to ChatGPT. You should too.

Ben Ash Blum

Generative AI Is Making Companies Even More Thirsty for Your Data

The outcry over Zoom's tweak to its data policy shows how the race to build more powerful AI models creates new pressure to source training data—including by juicing it from users.

Will Knight

By Seizing @Music, Elon Musk Shows He Doesn’t Know What Made Twitter Good

Since taking over Twitter, Musk has made mistake after mistake. His latest decision proves that he has never understood the average Twitter user—or doesn’t care to build a platform for them.

Vittoria Elliott

A New Attack Impacts Major AI Chatbots—and No One Knows How to Stop It

Researchers found a simple way to make ChatGPT, Bard, and other chatbots misbehave, proving that AI is hard to tame.

Will Knight

Microsoft’s AI Red Team Has Already Made the Case for Itself

Since 2018, a dedicated team within Microsoft has attacked machine learning systems to make them safer. But with the public release of new generative AI tools, the field is already evolving.

Lily Hay Newman

The Cloud Is a Prison. Can the Local-First Software Movement Set Us Free?

Tired of relying on Big Tech to enable collaboration, peer-to-peer enthusiasts are creating a new model that cuts out the middleman. (That’s you, Google.)

Gregory Barber

Credit belongs to : www.wired.com

Check Also

B.C. firm wins NASA challenge with space-friendly menu

Space food isn't just Tang and puréed meat in a tube anymore — it's mushroom …