FAQ: Online Ads personal data processing by Meta

In this article we answer some question about EDPB’s decision on processing of personal data for behavioral advertising by Meta, and what this means to the Online Ads component.

What does EDPB’s decision on processing of personal data for behavioral advertising mean?

On 27 October 2023, the European Data Protection Board (“EDPB”) adopted an urgent binding decision to impose a ban for Meta on the processing of personal data for behavioral advertising on the legal bases of contract and legitimate interest across the entire European Economic Area (EEA), see here. This means that Meta will need to collect explicit consent from its users before processing behavioral personal data. Behavioral data includes all actions/signals the users generate when using Meta’s services such as Facebook, Messenger, Instagram and WhatsApp, for example, what articles are read, liked or commented, what Reels are watched, liked or commented, what material is forwarded etc. Meta uses this data to achieve the most effective ad placement. To be able to continue doing this, Meta now needs to explicitly ask user for consent.

Meta has announced that it will comply with this decision by enforcing a ”pay or consent” model where user can either pay a monthly fee to not have their behavioral data processed or be obligated to accept if they want to use the free version.

What does this mean for the Voyado Engage component Online Ads?

Our assessment is that this decision will have no negative effect on Online Ads. This is since Online Ads is not reliant on behavioral data that Meta collects, the only personal data needed from Meta are contact details which are personal data not affected by the decision.

By using Online Ads, our customers can create ”audiences” based on behavior collected by the individual customer (hence, not by Meta). These audiences are then transferred to Meta who matches the hashed customer details that are shared from Voyado Engage. The hashed data points are log-in information such as name, email and phone number. Hence, the shared data is not behavioral data but contact details only used for matching. The level of matching varies according to Meta, but as soon as Meta has matched the individuals to the correct Meta accounts, the customer is able to use an “Audience” for targeted advertising in Meta without the explicit consent otherwise needed.

Consequently, one could argue that Online Ads will become even more relevant and the personal data you as a data controller can collect from your customers will become even more relevant.

Do we need to make any changes in our settings?

No, we have not received any such information from Meta, and we are neither anticipating it. If we do however, we will of course inform our customers.

However, keep in mind that you as a data controller need to make sure that you have a valid legal base under the GDPR for the behavioral data you collect on your customers, and consent for any direct marketing performed. This has always been the case, and nothing has changed regarding this. Make sure that your consent processes are updated and that your privacy policy includes all necessary information.

Was this article helpful?
0 out of 0 found this helpful



Article is closed for comments.