As per confidential EU privacy watchdog decision, Meta will be able to run advertising based on personal data with users' consent, a source familiar with the development said.
As the European headquarters is located in Dublin the Irish data protection agency that oversees Meta has been provided with a month to issue a ruling based on the European Data Protection Board's (EDPB) binding decision.
The EDPB will likely require the Irish body to hand out fines, the person said, asking not to be named because of the sensitivity of the issue.
The big technology company’s targeted ad model and the process of collecting data and its usage has drawn scrutiny around the world.
The Irish case against Meta was triggered by a complaint by Austrian privacy activist Max Schrems in 2018.
"Instead of having a yes/no option for personalised ads, they just moved the consent clause in the terms and conditions. This is not just unfair but clearly illegal. We are not aware of any other company that has tried to ignore the GDPR in such an arrogant way," Schrems said in a statement.
According to him, the ruling of EDPB’s ruling means Meta must allow users to have a version of all apps that do not use personal data for ads while the company would still be allowed to use non-personal data to personalise ads or simply ask users for consent.
The 27-country bloc's landmark privacy rules known as the General Data Protection Regulation went into effect in 2018.
As per a Meta spokesperson, the company is engaging with the Irish body.
"GDPR allows for a range of legal bases under which data can be processed, beyond consent or performance of a contract. Under the GDPR there is no hierarchy between these legal bases, and none should be considered better than any other," the spokesperson said.
Apple's (AAPL.O) new privacy rules, which limit digital advertisers from tracking iPhone users, have also been a blow to the Facebook parent.
A spokesperson of EDPB declined to provide details of the decisions made. The agency said it stepped in after other national watchdogs disagreed with the Irish agency's draft decision.
Its draft decisions on Meta's parent Facebook and Instagram focus on the lawfulness and transparency of processing for behavioural advertising, while its decision on WhatsApp concerns the lawfulness of processing for the purpose of the improvement of services.
"The DPC cannot comment on the contents of the decisions at this point. We have one month to adopt the EDPB's binding decisions and will publish details then," the Irish Data Protection Commission said.
