Meta is facing a major legal challenge and damages claim in Spain, which claims that the adtech giant’s years of not having a valid legal basis for processing people’s data for advertising under European Union data protection rules also constitutes a breach of competition for which must be compensated financially.
AMI, a newspaper owners association whose more than 80 members include newspaper publishers including El País, alphabet and La Vanguardia, is behind the suit. The litigants are seeking more than €550 million (~$600 million) for what they describe as Meta’s “systematic and massive non-compliance” with the EU’s General Data Protection Regulation (GDPR).
“Meta has repeatedly failed to comply [EU] data protection legislation, ignoring the regulatory requirement that citizens must consent to the use of their data for advertising profiling, as shown by the different resolutions of the European authorities responsible for this matter,” they write in a press release in Spanish . [here translated into English using AI].
“The systematic and massive use of the personal data of the users of the Meta platforms, tracked without their consent during their digital browsing, would allow the American company to offer the sale of advertising space in the market based on an illegally obtained competitive advantage.” they continue, stipulating that their lawsuit alleges that 100% of Meta’s regional revenue was obtained illegally.
Meta, the owner of Facebook and Instagram, was fined 390 million euros in January after EU data protection authorities confirmed that the performance of a contract was not a valid legal basis for tracking and profiling users for ad targeting.
This final GDPR ruling – which took years to wind its way through the regulation’s dispute resolution and decision-making processes, but is now being appealed by Meta in the Irish courts – confirmed that the tech giant is breaking the law, creating favorable conditions for private privacy lawsuits (like this one) to be filed. So expect to see more such suits popping up.
AMI’s challenge targets Meta’s ad processing in the period between the GDPR coming into effect in May 2018 and up to the end of July last year. However, the complainants are not ruling out extending the time frame of their lawsuit to account for what they call “Meta’s persistence in its non-compliance”.
Since the January penalty, Meta has twice changed the legal basis it claims for processing ads on the site. First he switched to asserting a basis called legitimate interests. However, a separate (long-running) competition and privacy challenge against Meta’s hyperprofile, brought by Germany’s competition authority – which had previously been referred to the bloc’s highest court – led to a CJEU ruling in July 2022 that invalidated this base as well.
AMI challenge refers to a “Urgent binding decision” of 27 October by the European Data Protection Board — which was issued at the request of Norway’s data protection authority in view of Meta’s continued processing of personal data without a valid legal basis in the months following the CJEU decision — to explain the possible extension of the time frame.
In November, Meta moved to claim consent as the legal basis for its ad-tracking activities in the EU. However, the option devised for local users requires them to choose between paying a monthly subscription for an ad-free version of its products or “agreeing” to tracked and profiled. This is despite the fact that the GDPR states that consent must be “freely” given in order to be lawfully obtained.
Meta’s latest effort to try to squeeze tracking ads out of EU privacy rules is already under fire — with privacy and consumer groups arguing that the choice it offers users is illegal and unfair.
Although a notable irony here is that the use of a so-called “cookie paywall” to gather consent for monitoring is a feature of many European newspaper websites — which require users to either pay a subscription to access journalism or agree to be monitored as in exchange for access without payment.
Privacy group noybwhich was behind the original May 2018 GDPR complaint against Meta’s legal basis for tracking and is now challenging Meta’s more recent approach to “pay or ok” consent.also challenges newspapers on cookie paywalls from 2021.
Meta has reached out to comment on the AMI lawsuit.
