Norway’s data protection authority has taken a significant step in attempting to extend the ban on Meta’s consentless tracking ads across the European Union. The country has requested the European Data Protection Board (EDPB) to make a binding decision on whether the emergency sanction placed on Facebook and Instagram should become permanent and be applied throughout the EU single market, rather than just locally.
Key Takeaway
Norway’s data protection authority has urged the European Data Protection Board to decide whether the ban on Meta’s tracking ads without user consent should be made permanent and applied across the EU single market.
A Local Ban Becomes a Potential EU-wide Prohibition
In July, Norway’s Datatilsynet issued a local ban on Meta’s tracking and profiling of users without their consent. To ensure urgent action to protect citizens’ data, the country utilized the powers granted by the General Data Protection Regulation (GDPR) to impose temporary measures for three months. Although the Irish Data Protection Commission (DPC) is the lead regulator for GDPR, the circumvention of the “one-stop-shop” mechanism allows the Norwegian authority to refer concerns to the EDPB.
Despite the ban, Meta has continued to defiantly disregard the order. The company even sought a court injunction, which was ultimately rejected by an Oslo court, upholding the rights of the Data Protection Authority to take action. In response to Meta’s non-compliance, the Norwegian DPA has now referred the matter to the EDPB.
Meta’s Attempt to Legalize Tracking Ads
Meta has claimed its intention to shift to asking users for their permission to run “personalized ads” in the European Economic Area (EEA) as a means to resolve the ongoing issues. However, the company has yet to implement this change and continues to run unlawful ads. The Norwegian DPA emphasized that the infringement of EU citizens’ rights remains a pressing concern.
The EDPB has confirmed receipt of the request and will assess its completeness. Upon completion of the assessment, the Board will have two weeks to adopt an urgent binding decision. The previous binding decision by the EDPB, settling a dispute on the legal basis for running ads, further emphasizes the role of the Board in addressing Meta’s practices.
The Future of Consent and Privacy
The referral to the EDPB may push Meta to fulfill its commitment to seek user consent sooner rather than later. As the company continues to face pressure from EU regulators regarding its privacy-hostile business model, it will eventually need to put an end to consentless tracking and profiling.
For now, individuals in the EU’s single market must rely on the Irish DPC to enforce their privacy rights. However, if the Irish authority fails to rectify Meta’s lack of consent, the Board serves as a backstop option to intervene once again and take necessary action.
Meta has highlighted its intention to offer Europeans the choice to deny tracking, but concrete actions and timelines remain uncertain. The days of surveillance capitalism and the exploitation of web users’ privacy through consentless tracking may finally be numbered for Meta within a major international region.
