Norwegian Data Protection Authority orders Meta to stop tracking Facebook and Instagram users for targeted advertising

07/19/2023 / By Laura Harris

The Norwegian Data Protection Authority (DPA) ordered Meta, the parent company of social media giants Facebook and Instagram, to stop invading Norwegian users’ privacy through personalized advertising based on their online activities and estimated locations.

According to the DPA order sent to Meta on July 14, the temporary ban that will take effect in August and last for three months aims to protect the privacy and data rights of Norwegian users. (Related: EU authorities slap Meta with record $1.3B fine for data privacy law violations.)

Facebook and Instagram can still display customized ads to users but only based on the “about” section of their profiles. And if Meta fails to do so, the company would face daily fines of 1 million Norwegian krone ($99,480).

Furthermore, the DPA plans to request an urgent binding decision from the European Data Protection Board (EDPB) to finalize measures against Meta. But the DPA stated that the organization is open to reconsideration if Meta implements privacy measures that align with the user consent and data protection regulations of Norway and the European Union (EU).

Matt Pollard, a spokesperson for Meta, acknowledged the ongoing debate around legal bases and the lack of regulatory certainty in this area.

“We continue to constructively engage with the Irish DPC, our lead regulator in the EU, regarding our compliance with its decision. We will review the Norway DPA’s decision, and there is no immediate impact to our services,” Pollard said.

EU files multiple data privacy violation charges against Meta

Before the Norwegian ban, the EU has already taken significant action against Meta for violating their data privacy laws.

On May 22, the EDPB penalized Meta with €1.2 billion ($1.3 billion) over violations of data privacy laws, following an extensive investigation into the operations of Facebook in the continent.

The Irish Data Protection Commission (DPC), responsible for regulating all of Meta’s activities within the EU, alleged that the company violated Article 46(1) of the General Data Protection Regulation (GDPR). This chapter from the GDPR outlines the conditions for transferring personal data to countries and organizations outside the EU.

According to the DPC, Meta continued to transfer personal data from the EU to the United States, even after the European Court of Justice invalidated the EU-US Privacy Shield agreement in 2020. (Related: Google, Facebook are hijacking your personal data and using it against you.)

In January, the DPC fined Meta a total of €390 million ($437 million) for privacy infringements and ordered the company to find a new legal basis for its business model. Meta has appealed this decision, and the Irish regulator is expected to reach a decision on the matter by mid-August.

Max Schrems, an Austrian privacy campaigner, filed complaints against Meta for the lack of proper legal grounds to process millions of European data. However, Meta disputed the claim and stated that it could use users’ data as a part of a contract to provide them with personalized ads.

Visit BigTech.news for more stories about Meta, the parent company of Facebook and Instagram.

Watch this video to learn how the EARN IT Act, which has been introduced three times in Congress, wants to end privacy.

This video is on the What is Happening channel on Brighteon.com.