Starting today Norway has issued a daily fine of ~$100,000 (NOK 1,000,000) to Meta as declared last month According to Norway, personalized advertising on Facebook and Instagram are illegal. If the U.S. company continues violating this ban on targeted advertising, the fine will be issued each day.
While the amount seems rather small for a tech giant like Meta, these two facts could put an end to the company's business model regardless:
$100,000 per day for a country with ~5.4 million people is a lot. If even 20 percent used Facebook regularly, then that would still be 10 cents per user per day. It's unlikely that Meta is generating so much profit per user - every day.
The fine by Norway is only the start. The Norwegian Data Protection Authority is calling on European authorities to also take measures against Facebook's and Instagram's targeted and personalized advertisement practice.
With its fine the Norwegian Data Protection Authority is directly attacking the core of Facebook's and Instagram's business model: targeted advertisement.
Norway is known for fighting against targeted ads. For instance, the Norwegian Consumer Council published a report calling for a ban on surveillance-based ads in 2021, which was followed by a call from privacy-first companies like Tutanota to ban targeted ads.
The criticism of Facebook and Instagram by the Norwegian authority goes as follows:
"Meta tracks in detail the activity of users of its Facebook and Instagram platforms. Users are profiled based on where they are, what type of content they show interest in and what they publish, amongst others. These personal profiles are used for marketing purposes – so called behavioural advertising. The Norwegian Data Protection Authority considers that the practice of Meta is illegal and is therefore imposing a temporary ban of behavioural advertising on Facebook and Instagram."
The decision to declare Facebook's and Instagram's profiling and targeted advertisements as illegal comes shortly after the European Court of Justice (ECJ) ruling that prohibits Meta from collecting personal data from users such as location, behavior, etc. for advertising purposes.
Prior to that, in December 2022, the Irish Data Protection Commission issued a decision on behalf of all data protection authorities across the European single market (EEA) which established that Meta has conducted illegal behavioural advertising. While Meta has made certain changes, these were not deemed sufficient as Meta’s behavioural advertising still does not comply with the law. That's why the ECJ issued its new ruling.
The Norwegian authority Datatilsynet has referred its complaints to the European Data Protection Board, which could extend the penalty across Europe.
"It is so clear that this is illegal that we need to intervene now and immediately. We cannot wait any longer," Tobias Judin, head of Datatilsynet's international section, told Reuters. The goal is to put "additional pressure" on Meta.
Norway can take its own actions against Meta as it is a member of the European single market, but not a member of the EU.
The Norwegian Data and Protection Authority points out that it "does not ban Facebook or Instagram in Norway. The purpose is rather to ensure that people in Norway can use these services in a secure way and that their rights are safeguarded."
The Norwegian Data Protection Authority does not ban personalised advertising on Facebook or Instagram as such. The decision does not for example stop Meta from targeting advertising based on information a user put in their bio, such as place of residence, gender and age, or based on interests a user has provided themselves. Nor does the decision stop Meta from showing behavioural advertising to users who have given valid consent to it.
But: "All business models must respect privacy as a human right. Users must have sufficient control over their own data, and any tracking must be limited," said Judin. And: "Invasive commercial surveillance for marketing purposes is one of the biggest risks to data protection on the internet today."
The Norwegian Data and Protection Authority argues that Meta has immense power to influence people by posting targeted advertisements - and also by not posting other ads that do not seem to match the person's profile. This affects freedom of expression and freedom of information, particularly when it comes to political advertisements. In addition, there is a risk that behavioural advertising strengthens existing stereotypes or could lead to unfair discrimination of various groups.
With its headquarters in Dublin, Ireland, the Irish Data Protection Commission (DPC) is responsible for supervising Meta and, thus, also Facebook and Instagram. However, the Irish DPC in the past has been criticized for not doing its job properly. It only issued the largest fine against Facebook ever - 1.2 billion euros - after pressure from European courts and institutions.
The Norwegian Data Protection Authority has now intervened directly against Meta because there was an urgent need to act, in particular because Meta has recently received both a decision and an EU judgment on its illegal tracking practices to which the tech giant has not aligned with adequately enough. "If we don’t intervene now, the data protection rights of the majority of Norwegians would be violated indefinitely," the Norwegian authority said.
"Moving forward, we may take the matter to the European Data Protection Board (EDPB), of which we are a member, after the summer. The EDPB will decide whether the decision may be extended beyond its initial three month validity period."
In is also noteworthy that the new Meta platform Threads, dubbed as the new Twitter alternative, has still not launched in the EU, though it's already available in the USA and in the UK.
This is another sign that Meta is seeing serious headwind from the EU against its business model of personalized advertisements.
The next few months are going to be very interesting: Will the EU finally defend the privacy rights of 450 million people?