4 ms·

Facebook and Instagram's 'pay or consent' ad model violates the DMA, says the EU

49 points by rntn 2y ago

mschuster91 2y ago
That one was clear from the start, same for the dozens news sites who have switched to that model. The problem is that DPAs are notoriously slow and intransparent. IMHO, the system needs to be revamped, at least against commercial actors: all complaints should be logged in a public register, and individuals should have the right to add a complaint of their own to an already existing one, so that there is public knowledge of suspected bad actors.
Rygian 2y ago
The irony is strong, that in order to read this article one has to go through a cookie popup that violates GDPR (lack of a Reject All option).
librish 2y ago
This seems weird. If not having personalized ads is such a fundamental piece of the EU web experience, why is it even allowed in the first place? Payment options: Paid only - allowed Paid OR Personalized Ads - not allowed Paid OR Personalized Ads OR Non-Personalized Ads - allowed
- pjc50 2y ago
  The EU "ban ad tracking entirely" faction isn't quite strong enough to achieve that, so we get this long slow grind of trying to eliminate the business model for ad tracking piece by piece.
- MyFedora 2y ago
  Because it's an extortion fee to get access to rights you're already supposed to have. Every pay or consent prompt asks you to pay a ridiculous sum of money, much more than they earn from tracking you. They force people who don't want to be tracked to involuntarily consent to tracking, which happens to be the overwhelming majority of people, according to pay or consent providers themselves. It's also designed to rob people who pay to not get tracked, even though the entire scheme is illegal anyways. This would be a non-issue if providers would charge how much they earn from tracking you in return for not tracking you. But alas, they want to earn more money.
TekMol 2y ago
Isn't "pay or consent" already illegal under the GDPR? It says Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. https://gdpr-info.eu/recitals/no-42/ https://gdpr-info.eu/recitals/no-42/ Wouldn't having to pay be considered a detriment, and therefore make the consent invalid under the GDPR?
- lupire 2y ago
  GDPR is a different law from DMA. This recent development is harmonization.
AshamedCaptain 2y ago
It obviously violates the DMA in writing, but why does it not violate the GDPR? Almost every other EU newspaper is doing this which obiously defeats the spirit of the law...
- MyFedora 2y ago
  Yes, it probably does violate the GDPR. At least the European Data Protection Board thinks so, see https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion...
Frieren 2y ago
Targeted ads is such a dystopian idea that it should have never been implemented. "We can show more relevant ads, things that you are interested on" has transformed in "we know your most deep insecurities and weakness and we will exploit them". For mega-platforms this is true for their customers and their providers. The amount of information allows them to abuse both sides of the equation. So, removing targeted as altogether would be a better option. And with that "personalized algorithms" that maximize companies profits extracting maximum value form consumers and producers.
jokoon 2y ago
For months I refused it and could not use Instagram so I uninstalled it. I finally accepted the terms two weeks ago, but honestly that feels forced. It's wild that nobody talks about it. Facebook being a paid app was like a joke for a long time until now.
Nevermark 2y ago
Paying for a service that agrees to not use or collect data on me, except to provide the service as I request it to, is the healthy model. No perverse incentives. That would eliminate ads, but also surveillance and feed manipulation. Let me actually control my own feed. Ads are just one way Facebook uses surveillance to manipulate its users. They use follow and like choices as surveillance info to insert unrequested “sticky” posts, instead of just honoring them as user features.
- lupire 2y ago
  Lots of impossible things are hypothetically healthy.
  - Nevermark 2y ago
    Hypothetically healthy doesn’t become in-reality healthy if you don’t talk about it. Open source has evolved in response to solving practical and moral problems of sharing code and being able to validate and adapt code, in ways that benefit many people. Clearly, social media, and the commercial surveillance and ad ecosystems, are areas that desperately need similar attention.
pessimizer 2y ago
I don't understand, I've been told by many random posters over many years that you either pay with your money or you pay with your privacy. Now that's morally wrong? Next you'll be telling me that you shouldn't be able to sell yourself into slavery.
- AshamedCaptain 2y ago
  If privacy is really your goal when e.g. accessing a newspaper, paying for it is still possibly the worst thing one can do.
deleted 2y ago
[deleted]
chrisbrandow 2y ago
I honestly don’t understand the EU’s position. There really are strong “have their cake and eat it too” vibes. It feels like they are effectively saying that targeted ads should be illegal, but without the forthrightness to say that explicitly.
ankit219 2y ago
If this goes through, I don't see how this survives a court challenge. This is not a competition issue, but a data protection issue. Seems like it's brought under competition so that it spares the EU publishers who follow the same model as Meta proposed. From what I read and understand, EU does not have a very good standing here, but only hope is that Meta settles the case instead of fighting it out as it sets a precedent. From what I could see, it's a novel interpretation of Section 5(2). The original section is about "gatekeepers must seek users' consent for combining their personal data between designated core platform services and other services, and if a user refuses such consent, they should have access to a less personalised but equivalent alternative". But this is to do with combination, not access. This part: > users who do not consent should still get access to an equivalent service which uses less of their personal data, in this case for the personalisation of advertising is new and not in the set goals of DMA, but a unique interpretation to stop Meta from offering this. Related: Original complaint: https://ec.europa.eu/commission/presscorner/detail/en/ip_24_3582 https://ec.europa.eu/commission/presscorner/detail/en/ip_24_... Kay Jebelli on why it's under DMA and not GDPR: https://medium.com/chamber-of-progress/the-hidden-reason-why-europe-has-turned-metas-pay-or-okay-into-a-competition-issue-bf6c7f953365 https://medium.com/chamber-of-progress/the-hidden-reason-why...
joncrocks 2y ago
Does this imply that Facebook is required to provide free service to everyone? At what point are private companies allowed to decide how to charge customers for the services they provide?
- jonhohle 2y ago
  I think it means they can’t monetize by tracking and selling targeted ad space (i.e. their business model). I think that’s reasonable, personally. They can sell ads like traditional media or they can charge for their service.
- karl_gluck 2y ago
  If a company provides a service for free to enable selling something else, and that something else becomes illegal to sell, then it’s up to the company whether they want to keep offering the free service. They can’t continue doing things that are now illegal just because that’s how they made money in the past. No decision-making power has been taken away.
jonhohle 2y ago
Outside of advertising, are their legitimate reasons to sell or trade customer information to a vendor that does not directly support the operation of your business (i.e. subcontracting work that may require customer details). In the US HIPAA is the closest thing we have, but it would be nice to have a blanket law that says data between two parties cannot be shared with a third party, full stop, regardless of consent. I think having a straight forward transactional pay or you get nothing model levels the field in a way that back door deals with data brokers could ever match.
aeurielesn 2y ago
I don't use Facebook but I'm so glad this finally happened. SV needs to be shown the door in the EU. The EU isn't for malicious compliance nor "don't get caught" schemes.

49 points by rntn 2y ago

That one was clear from the start, same for the dozens news sites who have switched to that model. The problem is that DPAs are notoriously slow and intransparent. IMHO, the system needs to be revamped, at least against commercial actors: all complaints should be logged in a public register, and individuals should have the right to add a complaint of their own to an already existing one, so that there is public knowledge of suspected bad actors.

Rygian 2y ago

The irony is strong, that in order to read this article one has to go through a cookie popup that violates GDPR (lack of a Reject All option).

librish 2y ago

This seems weird. If not having personalized ads is such a fundamental piece of the EU web experience, why is it even allowed in the first place? Payment options: Paid only - allowed Paid OR Personalized Ads - not allowed Paid OR Personalized Ads OR Non-Personalized Ads - allowed

pjc50 2y ago
The EU "ban ad tracking entirely" faction isn't quite strong enough to achieve that, so we get this long slow grind of trying to eliminate the business model for ad tracking piece by piece.
MyFedora 2y ago
Because it's an extortion fee to get access to rights you're already supposed to have. Every pay or consent prompt asks you to pay a ridiculous sum of money, much more than they earn from tracking you. They force people who don't want to be tracked to involuntarily consent to tracking, which happens to be the overwhelming majority of people, according to pay or consent providers themselves. It's also designed to rob people who pay to not get tracked, even though the entire scheme is illegal anyways. This would be a non-issue if providers would charge how much they earn from tracking you in return for not tracking you. But alas, they want to earn more money.

TekMol 2y ago

Isn't "pay or consent" already illegal under the GDPR? It says Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. https://gdpr-info.eu/recitals/no-42/ https://gdpr-info.eu/recitals/no-42/ Wouldn't having to pay be considered a detriment, and therefore make the consent invalid under the GDPR?

lupire 2y ago
GDPR is a different law from DMA. This recent development is harmonization.

AshamedCaptain 2y ago

It obviously violates the DMA in writing, but why does it not violate the GDPR? Almost every other EU newspaper is doing this which obiously defeats the spirit of the law...

MyFedora 2y ago
Yes, it probably does violate the GDPR. At least the European Data Protection Board thinks so, see https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion...

Frieren 2y ago

Targeted ads is such a dystopian idea that it should have never been implemented. "We can show more relevant ads, things that you are interested on" has transformed in "we know your most deep insecurities and weakness and we will exploit them". For mega-platforms this is true for their customers and their providers. The amount of information allows them to abuse both sides of the equation. So, removing targeted as altogether would be a better option. And with that "personalized algorithms" that maximize companies profits extracting maximum value form consumers and producers.

jokoon 2y ago

For months I refused it and could not use Instagram so I uninstalled it. I finally accepted the terms two weeks ago, but honestly that feels forced. It's wild that nobody talks about it. Facebook being a paid app was like a joke for a long time until now.

Nevermark 2y ago

Paying for a service that agrees to not use or collect data on me, except to provide the service as I request it to, is the healthy model. No perverse incentives. That would eliminate ads, but also surveillance and feed manipulation. Let me actually control my own feed. Ads are just one way Facebook uses surveillance to manipulate its users. They use follow and like choices as surveillance info to insert unrequested “sticky” posts, instead of just honoring them as user features.

lupire 2y ago
Lots of impossible things are hypothetically healthy.
- Nevermark 2y ago
  Hypothetically healthy doesn’t become in-reality healthy if you don’t talk about it. Open source has evolved in response to solving practical and moral problems of sharing code and being able to validate and adapt code, in ways that benefit many people. Clearly, social media, and the commercial surveillance and ad ecosystems, are areas that desperately need similar attention.

pessimizer 2y ago

I don't understand, I've been told by many random posters over many years that you either pay with your money or you pay with your privacy. Now that's morally wrong? Next you'll be telling me that you shouldn't be able to sell yourself into slavery.

AshamedCaptain 2y ago
If privacy is really your goal when e.g. accessing a newspaper, paying for it is still possibly the worst thing one can do.

deleted 2y ago

[deleted]

chrisbrandow 2y ago

I honestly don’t understand the EU’s position. There really are strong “have their cake and eat it too” vibes. It feels like they are effectively saying that targeted ads should be illegal, but without the forthrightness to say that explicitly.

ankit219 2y ago

If this goes through, I don't see how this survives a court challenge. This is not a competition issue, but a data protection issue. Seems like it's brought under competition so that it spares the EU publishers who follow the same model as Meta proposed. From what I read and understand, EU does not have a very good standing here, but only hope is that Meta settles the case instead of fighting it out as it sets a precedent. From what I could see, it's a novel interpretation of Section 5(2). The original section is about "gatekeepers must seek users' consent for combining their personal data between designated core platform services and other services, and if a user refuses such consent, they should have access to a less personalised but equivalent alternative". But this is to do with combination, not access. This part: > users who do not consent should still get access to an equivalent service which uses less of their personal data, in this case for the personalisation of advertising is new and not in the set goals of DMA, but a unique interpretation to stop Meta from offering this. Related: Original complaint: https://ec.europa.eu/commission/presscorner/detail/en/ip_24_3582 https://ec.europa.eu/commission/presscorner/detail/en/ip_24_... Kay Jebelli on why it's under DMA and not GDPR: https://medium.com/chamber-of-progress/the-hidden-reason-why-europe-has-turned-metas-pay-or-okay-into-a-competition-issue-bf6c7f953365 https://medium.com/chamber-of-progress/the-hidden-reason-why...

joncrocks 2y ago

Does this imply that Facebook is required to provide free service to everyone? At what point are private companies allowed to decide how to charge customers for the services they provide?

jonhohle 2y ago
I think it means they can’t monetize by tracking and selling targeted ad space (i.e. their business model). I think that’s reasonable, personally. They can sell ads like traditional media or they can charge for their service.
karl_gluck 2y ago
If a company provides a service for free to enable selling something else, and that something else becomes illegal to sell, then it’s up to the company whether they want to keep offering the free service. They can’t continue doing things that are now illegal just because that’s how they made money in the past. No decision-making power has been taken away.

jonhohle 2y ago

Outside of advertising, are their legitimate reasons to sell or trade customer information to a vendor that does not directly support the operation of your business (i.e. subcontracting work that may require customer details). In the US HIPAA is the closest thing we have, but it would be nice to have a blanket law that says data between two parties cannot be shared with a third party, full stop, regardless of consent. I think having a straight forward transactional pay or you get nothing model levels the field in a way that back door deals with data brokers could ever match.

aeurielesn 2y ago

I don't use Facebook but I'm so glad this finally happened. SV needs to be shown the door in the EU. The EU isn't for malicious compliance nor "don't get caught" schemes.