Despite passing in 2016, some parts of the GDPR remain open to debate. One of the most hotly-contested GDPR issues in 2023 was whether the law allows for so-called “consent or pay” policies.
In January 2023, the European Data Protection Board (EDPB) forced the Irish Data Protection Commission (DPC) to order Meta not to rely on “contract” for behavioural advertising.
Meta’s terms of service included a clause requiring the user to accept behavioural ads as a condition for using the platform. According to the EDPB, ad-targeting was not “necessary” for Meta to deliver its services, so the company had to find a new legal basis.
A few weeks later, Meta switched to “legitimate interests”, allowing Facebook and Instagram users across the EEA to opt out of behavioural ads if they filled out a (long) form explaining why their rights were more important than Meta’s business model.
Was “legitimate interests” the right choice of legal basis for Meta’s ad-targeting? Decide for yourself by reading What is Legitimate Interests Under the GDPR?