The ruling, which comes with a €390 million ($414 million) fine attached, is targeted specifically at Facebook and Instagram, but it’s a huge blow to Big Tech as a whole. It’s also a sign that GDPR, Europe’s landmark privacy law that was introduced in 2018, actually has teeth. More than 1,400 fines have been introduced since it took effect, but this time the bloc’s regulators have shown they are willing to take on the very business model that makes surveillance capitalism, a term coined by American scholar Shoshana Zuboff, tick. “It is the beginning of the end of the data free-for-all,” says Johnny Ryan, a privacy activist and senior fellow at the Irish Council for Civil Liberties. To appreciate why, you need to understand how Meta makes its billions. Right now, Meta users opt in to personalized advertising by agreeing to the company’s terms of service—a lengthy contract users must accept to use its products. In a ruling yesterday, Ireland’s data watchdog, which oversees Meta because the company’s EU headquarters are based in Dublin, said bundling personalized ads with terms of service in this way was a violation of GDPR. The ruling is a response to two complaints, both made on the day GDPR came into force in 2018. Meta says it intends to appeal, but the ruling shows change is inevitable, say privacy activists. “It really asks the whole advertising industry, how do they move forward? And how do they move forward in a way that stops these litigations that require them to change constantly?” says Estelle Masse, global data protection lead at digital rights group Access Now. EU regulators did not tell Meta how to reform its operations, but many believe the company has only one option—to introduce an Apple-style system that asks users explicitly if they want to be tracked. Apple’s 2021 privacy change was a huge blow for companies that rely on user data for advertising revenue—Meta especially. In February 2022, Meta told investors Apple’s move would decrease the company’s 2022 sales by around $10 billion. Research shows that when given the choice, a large chunk of Apple users (between 54 and 96 percent, according to different estimates) declined to be tracked. If Meta was forced to introduce a similar system, it would threaten one of the company’s main revenue streams. However Max Schrems, an Austrian privacy activist whose nonprofit NOYB filed both complaints addressed in the ruling, calls this response “PR bullshit” and argues that Meta is trying to avoid telling investors it has run out of legal arguments to defend its business model. This ruling is part of a wider move away from the unregulated model of online advertising that existed for years, according to Schrems. Five years ago, Europe sparked a legal shift by introducing GDPR—even though the new privacy rules were not effectively enforced, he says. That legal shift was followed by what Schrems calls “technical shifts,” in the form of privacy changes introduced by Google and Apple. “We’re [seeing] the combination of technical and legal shifts moving in the same direction,” he says. As Apple’s changes take a chunk out of Meta, Google is trying to remake advertising cookies. It’s a plan that’s proven controversial, and in July Google delayed the phaseout to the second half of 2024, citing advertisers’ requests for more time. Opposition to the phaseout does not just come from the tech sector. A coalition of Germany’s largest publishers, including the owner of news outlets Bild and Politico, complained last year that without cookies, their revenues would suffer. Despite Google’s planned move away from cookies, the company has claimed that ditching personalized advertising altogether would jeopardize the authority of information online. “That won’t pay for the web everyone wants,” Claire Noburn, Google’s ads privacy lead, argued in a September op-ed, adding that getting rid of personalized advertising would deprive the open web, including publishers, of crucial funds. Some envision an opt-in economy. “If everything becomes opt-in in the future, I think we have gained a lot because then we will actually have to understand what we’re opting into,” says Pernille Tranberg, cofounder of Danish think tank Data Ethics EU. Tranberg is not against personalized advertising, but she wants to choose which sites she gives her data to, depending on their reputation—she probably wouldn’t give her data to Facebook, she says, but she might give it to a newspaper or a bookstore. Others are more hardline about the future. Access Now’s Masse advocates for a shift to tracker-free contextual advertising, which tailors ads dependent on context. An article about cars might feature a Volkswagen advert, for example. But not everyone agrees on the definition of contextual ads. And parts of the ad industry are still trying to figure out how they can include personalization within the contextual ad model, according to Masse. Yesterday’s ruling from the EU might signal we are entering a new era of online advertising and that surveillance capitalism is taking its last gasp. But with personalized ads being proposed as part of an alternative system, what comes next might not look that different.
