Top of page

Article European Union: European Data Protection Board Publishes Urgent Binding Decision Banning Meta's Personalized Advertising Practice

On December 7, 2023, the European Data Protection Board (EDPB) published an urgent binding decision to ban Meta’s behavioral advertising, a practice which consists of processing users’ personal data to create personalized advertisements.

The decision followed a request from the Norwegian Data Protection Authority (NO DPA) to order binding measures on Meta.

Two authorities in the European Union (EU) safeguard data protection: the EDPB and the member states’ data protection authorities (DPAs). The EPDB is an independent European body that supervises the correct application of the General Data Protection Regulation (GDPR) and comprises the head of each country’s DPA and the European Data Protection Supervisor (EDPS). (GDPR art. 68.) DPAs are “independent public authorities that supervise, through investigative and corrective powers, the application of the data protection law.”

Timeline of Major Events

Under article 6, paragraph 1 of the GDPR, data processing is allowed if the data controller relies on a legitimate legal basis for the processing. The article outlines six legal grounds for the lawfulness of processing personal data, in particular, consent, contractual necessity, and legitimate interest.

In 2020, the Irish Data Protection Commission (IE DPA), the lead privacy regulator for Meta in the EU, started an inquiry aimed at examining the basis upon which Meta Platforms Ireland Limited (Meta Ireland) transfers personal data from the EU to the United States in connection with the delivery of its Facebook service. In its draft decision, the IE DPA recognized the validity of the argument made by Meta that its legal basis for processing users’ data for personalized advertisements was a contractual necessity. (Decision, at 35, 36.) Various EU DPAs, including the supervisory authorities of Germany, Finland, France, Italy, and Norway, objected to this finding. (Decision, at 36.) Since reaching a consensus between these authorities was impossible, the matter was referred to the EDPB. (At 36.)

In December 2022, in response to the request, the EDPB issued three binding decisions regarding Meta’s three platforms: Facebook, Instagram, and WhatsApp. These decisions clarified that using contractual necessity as a legal basis for processing personal data carried out by Meta for behavioral advertising was not suitable. (Instagram decision, at 38, para. 136.) The finding was based on the argument that providing personalized advertising may be a contractual necessity to fulfil obligations between Meta and the advertisers paying for the ad, but not between Meta and the platform users. (At 33, 34.)

On the basis of these resolutions, the IE DPA adopted final decisions that concluded that Meta IE was not entitled to rely on contractual necessity as the legitimate basis to process personal data for behavioral advertising. It ordered Meta to bring its practice into compliance within three months. (Decision on Instagram Inquiry, at 157.)

On July 14, 2023, the Norwegian DPA (NO DPA) adopted a temporary order imposing a temporary ban on Meta and Facebook for the processing of personal data of Norwegian data subjects for behavioral advertising. (Order, at 23.) This ban was limited in time (three months) and geographic scope, meaning it was applicable only in Norway.

On September 26, 2023, the NO DPA submitted a request to the EDPB for an urgent binding decision to order the adoption of final measures that would have effect throughout the entire European Economic Area.

Key Aspects of the Urgent Binding Decision

On December 7, 2023, the EDPB published its urgent binding decision. It found that Meta’s personalized advertisement practice violated article 6, paragraph 1 of the GDPR. In the opinion of the EDPB, the risks the practice posed to the rights and freedoms of the data subjects raised a pressing need for urgent decisive actions. (At. 41, 42.)

After the EDPB December 2022 resolutions, Meta produced compliance reports, in which it indicated that it had changed its legal basis for most of its processing of personal data for behavioral advertising purposes from contractual necessity to legitimate interest. (At 21.) It still relied on contractual necessity to process limited categories of non-behavioral information. (At 22.) The EDPB considered both legal bases inappropriate. It determined that the distinction between “behavioral” and “non-behavioral” data made by Meta to use the contractual necessity basis was arbitrary and specious. (At 23–26.) Regarding the legitimate interest, the EDPB considered that the interests and fundamental rights of data subjects override the interest put forward by Meta for processing personal data collected on Meta’s products. (At 41, para. 147.) Therefore, Meta’s legitimate interest could not be used as a legal basis to justify the practice.

Lastly, the EDPB determined that there was a pressing need for urgent decisive actions due to the potentially severe and irreparable harm posed to data subjects if definitive measures were not implemented. (At 65.) Consequently, the EDPB ordered the IE DPA to adopt final measures. It considered it appropriate, proportionate, and necessary to instruct the IE DPA to impose a ban on Meta for processing personal data for behavioral advertising purposes based on contractual agreements and legitimate interests. (At 76.)

EPDB’s Authority to Adopt Urgent Binding Measures

Article 66 of the GDPR regulates urgency procedures to protect the processing and use of data that DPAs can initiate. It provides that, under extraordinary circumstances, when a DPA determines an urgent necessity to safeguard the rights and freedoms of data subjects, it may implement interim measures that have effects within its national territory, lasting a maximum of three months. (Art. 66, para. 1.)

If the DPA that has taken such provisional measures considers that final measures need to be adopted urgently, it can request an urgent binding decision from the EDPB, providing the reasons for the urgent need. (Art. 66, para. 2.)

If, instead, the competent supervisory authority has not taken an appropriate measure in a situation where there is an urgent need to act to protect the rights and freedoms of data subjects, any supervisory authority may request an urgent binding decision from the EDPB, giving reasons for requesting it, and specifying the urgent need to act. (Art. 66, para. 3.)

Prepared by Sarah Bandini, Law Library Intern, under the supervision of Jenny Gesley, Foreign Law Specialist

January 24, 2024

Read more Global Legal Monitor articles.

About this Item

Title

  • European Union: European Data Protection Board Publishes Urgent Binding Decision Banning Meta's Personalized Advertising Practice

Online Format

  • web page

Rights & Access

Publications of the Library of Congress are works of the United States Government as defined in the United States Code 17 U.S.C. §105 and therefore are not subject to copyright and are free to use and reuse.  The Library of Congress has no objection to the international use and reuse of Library U.S. Government works on loc.gov. These works are also available for worldwide use and reuse under CC0 1.0 Universal. 

More about Copyright and other Restrictions.

For guidance about compiling full citations consult Citing Primary Sources.

Credit Line: Law Library of Congress

Cite This Item

Citations are generated automatically from bibliographic data as a convenience, and may not be complete or accurate.

Chicago citation style:

Gesley, Jenny. European Union: European Data Protection Board Publishes Urgent Binding Decision Banning Meta's Personalized Advertising Practice. 2024. Web Page. https://www.loc.gov/item/global-legal-monitor/2024-01-23/european-union-european-data-protection-board-publishes-urgent-binding-decision-banning-metas-personalized-advertising-practice/.

APA citation style:

Gesley, J. (2024) European Union: European Data Protection Board Publishes Urgent Binding Decision Banning Meta's Personalized Advertising Practice. [Web Page] Retrieved from the Library of Congress, https://www.loc.gov/item/global-legal-monitor/2024-01-23/european-union-european-data-protection-board-publishes-urgent-binding-decision-banning-metas-personalized-advertising-practice/.

MLA citation style:

Gesley, Jenny. European Union: European Data Protection Board Publishes Urgent Binding Decision Banning Meta's Personalized Advertising Practice. 2024. Web Page. Retrieved from the Library of Congress, <www.loc.gov/item/global-legal-monitor/2024-01-23/european-union-european-data-protection-board-publishes-urgent-binding-decision-banning-metas-personalized-advertising-practice/>.