DaphneJan 6, 2023

RT @[email protected]

Breaking: In decisions just out, Meta is not only on the hook for privacy fines totaling nearly €400 million, but it must also — quickly — find a new legal basis for its sprawling targeted advertising empire. 🧵

https://pro.politico.eu/news/158293

🐦🔗: https://twitter.com/vmanancourt/status/1610652904188174338

POLITICO Pro

Show threadDaphneJan 6, 2023
Can smart EU lawyers with data protection chops help me understand the basic legal proposition of this case?
I get the Art 6 bases for processing, and how Meta’s latest maneuvers (moving from consent to contractual basis) were legally sketchy and made EDPB mad. 1/
Show threadDaphneJan 6, 2023
But I don’t get at a more fundamental level why “take it or leave it” is not an option. I’m probably out of practice.
2/
Show threadDaphneJan 6, 2023
Why can EDPB say “Meta, you have to offer this service on different and less profitable terms than you do now”? Why was consent not an OK basis, with FB saying “this version, where you consent to targeted ads, is the one we offer”? 3/
Show threadDaphneJan 6, 2023
I’m not trying to push back (yet). I assume there’s a good answer, or else I’d see more coverage. But I haven’t found it so far. @[email protected]? @[email protected]? @[email protected]? 4/
Show threadDaphneJan 6, 2023
I get that the GDPR offers a substantive baseline of privacy protection. So the US’s quasi-contractual, Lochnerian shenanigans won’t cut it. Platforms can’t offer terms below that baseline level of protection and say “the user consented, it’s fine!” 5/
Show threadDaphneJan 6, 2023
But for processing that the GDPR permits with consent, if controllers can’t say “the consent-based service is the only one we offer,” it seems like there’d be endless cases where DPAs can require an alternate version of a commercial service, with different privacy tradeoffs. 6/
Show threadDaphneJan 6, 2023
Like “Airlines can’t offer frequent flyer perks — tracking flight history requires consent. But passengers must also have an option to get those perks even if the airline can’t see their flight history.”
7/
Show threadDaphneJan 6, 2023
It just seems like data protection rules would become deeply enmeshed with, and displace, competition or fair trade rules. 8/
Show threadDaphneJan 6, 2023

Or that the social network is one service, and the ads are another, so the GDPR rules for the social network can presume that ads are not relevant?

That one also seems like a competition policy question.

9/

Show threadDaphneJan 6, 2023
Thanks, it’s late here, I assume I missed something. 10/10
Show threadMatt Linton Jan 6, 2023

@daphnehk This is a great thread and it's something that confuses me too about some of the European rulings I've seen come out.

It seems like the rulings boil down to "Internet companies offering any non-paid service in Europe must offer it free of any obligation whatsoever to the people using the service for free."

Show threadDiogo ConstantinoJan 6, 2023
@amuse @daphnehk this is not about whataoever obligations, it's about: which law regulates data protection (contract law, or data protection law), and about data protection, so the scope is rather narrow, and not extremely broad as you put it.
Show threadMatt Linton Jan 6, 2023

@DiogoConstantino @daphnehk I'm probably speaking much more broadly than Daphne was, sorry for being confusing there.

Beyond this specific law and case, just seems to me that the collection of EU perspectives on tech in general seems to be "You can offer free services, but you can't ask anything in return from their users"

I can totally understand from a privacy perspective why that's desirable, I'm having a harder time seeing how that's a feasible way to run tech businesses.

And I'm personally happy to just pay a small fee for ad-free, pro-privacy things but I doubt I'm in the majority.

Show threadMechanїcalTurkJan 6, 2023

@amuse @DiogoConstantino @daphnehk isn't this a bit like saying:

seems to me that the collection of EU perspectives on tech in general seems to be "you can offer ride sharing services, but you have to treat your full time workers as employees, not independent contractors"

I can totally understand from a labour law and worker rights perspective why that's desirable, I'm having a harder time seeing how that's a feasible way to run a tech business.

Show threadMatt Linton Jan 6, 2023

@MechanicalTurk @DiogoConstantino @daphnehk I think it's actually a lot more like the government saying "You can offer ride sharing services, but you can't require the user to enable location sharing to summon the vehicle".

That's technically do-able, but completely changes a major pillar of what the business actually does to operate.

Show threadMechanїcalTurkJan 6, 2023
@amuse @DiogoConstantino @daphnehk it feels like you're conflating the business model and the service provided to the user here.
The ride sharing business needs to know where you are to provide the service the user is getting. A Facebook user doesn't come to Facebook for the great personalised ads, they come there for the social network.
That's why location sharing in your example is explicitly legal under EU law.
Show threadMatt Linton Jan 6, 2023
@MechanicalTurk @DiogoConstantino @daphnehk Facebook does need advertising to provide the service though - nobody pays for their Facebook account.
Show threadDiogo ConstantinoJan 6, 2023

@amuse they made their choice. Also personalized advertisng is far from being the only form of avdvertising, it's not even the only form of doing advertising for specific audiences.

@MechanicalTurk @daphnehk

Show threadMechanїcalTurkJan 6, 2023
@DiogoConstantino @amuse @daphnehk exactly, they can even just ask for consent and fall back to context based ads for the people that don't give it.
Show threadDaphneJan 8, 2023
@MechanicalTurk @DiogoConstantino @amuse Just catching up here, useful thread. Thanks. I think the Uber and employment law analogy (and my similar one about emissions from cars) would be apt if the rule were “FB can never offer users this harmful deal.” But isn’t it more like “Users can consent to this deal, but not on a take it or leave it basis. FB must offer an alternative.” @joris since he also mentioned employment.
Show threadMechanїcalTurk
@daphnehk
You can definitely argue that the law should have been based on the promise that personalised ads are so wrong that they should simply be completely illegal. You could also argue that there is no problem with tracking and that it should be completely legal (as I'm sure Facebook would argue), but the middle ground they picked is not unprecedented though.
@DiogoConstantino @amuse @joris
Jan 8, 2023 at 10:56amWeb
Show threadMechanїcalTurkJan 8, 2023
@daphnehk
I think the sex analogy is useful: you could argue that sex is so amoral/dangerous/traumatic that outside of procreation, it should be illegal. You could also argue that it's no big deal, and that e.g. requiring sex in return for casting opportunities is fine, and actresses can decide themselves what they want to offer up. We ended up with a middle ground where you can have sex for fun, but consent has to be given *freely*, not as a quid pro quo.
@DiogoConstantino @amuse @joris
Show threadMechanїcalTurkJan 8, 2023
@daphnehk
You could have argued that cracking down on the casting-opportunities-for-sexual-favours industry could have led to the collapse of movie roles for young attractive women, in the same way that some are arguing that social networks will go away without personalised ads. In the casting example, we dodged a bullet, and entertainment execs found other reasons to cast women. The economy is different, but I think we'll be lucky when it comes to Facebook also. @DiogoConstantino @amuse @joris
Show threadMechanїcalTurkJan 8, 2023
@daphnehk @DiogoConstantino @amuse @joris and, apologies for being a little facetious. Sex is genuinely the best example I can think of where consent has to be given without coercion, but the analogy takes things to a bit of an extreme.
Show threadDaphneJan 8, 2023

@MechanicalTurk @DiogoConstantino @amuse
@joris

The sex example makes sense as a thing you can’t transact for in most places. (Along with votes, organs, babies, indentured servitude, etc.) But the contract basis means you *can* transact for a data use as long as it’s necessary for the performing of the service. So doesn’t that put you back into needing regulators to make a bunch of weird decisions about these deals?

Show threadMechanїcalTurkJan 8, 2023
@daphnehk @DiogoConstantino @amuse @joris because its more fuzzy whether or not the personalised ads are a part of the value proposition of your product?