The European Data Protection Board (EDPB) has extended a ban that was originally imposed by Norway, a non-EU member, on behavioural advertising on Facebook and Instagram by US tech giant, Meta Platforms. This ban will cover all 30 countries in the European Union (EU) and European Economic Area (EEA). Since 7 August 2023, Meta has been subject to daily fines by the Norwegian data protection authority, Datatilsynet which are in excess of US$90,000.

On 27 October 2023, the EDPB adopted an urgent binding decision to impose a ban on the processing of personal data for behavioural advertising practices on the legal bases of contract and legitimate interest on the entire EEA. The EDPB’s ruling will have an unprecedented effect on Europe’s ecosystem of 5,000+ “AdTech” businesses which use Meta’s plug’ins as well as Europe’s 250+ million Facebook and Instagram users.

Meta, who disagrees with the Norwegian ruling, relies on its service agreements as a way of gathering user consent to process data. It said that it will be asking users for consent before using their personal data for behavioural advertising in the imminent future by providing users with the choice of having targeted advertising in exchange for a free service, or an ad-free subscription costing EUR 9.99 (web) or EUR 12.99 (Android and iOS).

“Whether 'pay or okay' is acceptable needs to be assessed on a case-by-case basis, and in this case we think that it is not," stated Tobias Judin, Head of International at Datatilsynet's. "Considering the power imbalance between Meta and its users, which is the primary concern of the CJEU in the Bundeskartellamt judgment, we doubt that the purported consents will be 'freely given' as required by the GDPR."

Paying for privacy raises important questions as to whether subscription-based consent is valid.