Dhara Shah
Associate Editor
Loyola University Chicago School of Law, JD 2020
Ever since the Facebook and Cambridge Analytica scandal, concerns surrounding data privacy and protection have been growing. Both government agencies and individual users have particularly been concerned on how their data is being collected and used on social media websites such as Facebook. Germany has taken action in response to such concerns and recently took a step against Facebook’s collection of data in a decision that outlawed Facebook’s entire advertisement regime.
Facebook’s Advertising Model
For years, Facebook has successfully collected personal information from over one billion users worldwide. Each individual Facebook user has a “user profile” that is made up of their personal data including, for example, the posts they “like” on Instagram and the websites they frequent. Currently, there is nothing stopping Facebook from creating these “user profiles”. They are created by combining data from Facebook and other sites the company owns such as WhatsApp and Instagram, and that data is then sold to advertisers. This then allows for targeted advertising to individual users across all platforms.
The concerns surrounding data collection that has resulted in sites like Facebook presenting advertisements for online activity, such as your most recent purchase, is diminishing. Users have begun to normalize this experience and have even accepted that nothing can be done when it comes to sites such as Facebook collecting their data. The average user is unlikely to even be aware of what exactly is being tracked. Facebook has justified its method of collecting user data stating the data is collected solely for advertisement purposes and that Facebook users actually consent to the collection of their data upon registration of a Facebook account.
Germany’s Outlaw
On February 2nd, 2019, Germany outlawed Facebook’s ability to combine user data from different sources. This was done to comply with data privacy laws and address the concerns of the public surrounding Facebook’s abuse of power. While this does not apply to Facebook-owned WhatsApp and Instagram, compliance with the Facebook application itself is binding. This brings two main points to light. First, that voluntary consent must be strictly given by a Facebook user in order to collect their data. Second, gathering data from other applications, whether it be WhatsApp, Instagram, or a third-party, and attaching it to a “user profile” will only be allowed with voluntary consent from the Facebook user.
Germany’s concern in Facebook’s practice of data collection is rooted in its belief that Facebook is violating European data protection rules – and that too at the detriment of Facebook users. Germany states that Facebook’s practices do not comply with the General Data Protection Regulation as the data processing that occurs is not necessary “to fulfill contractual obligations” and that Facebook did not “obtain any effective consent for its processing of data.”
What does this mean for Facebook? This is an entire shift in how the company has operated their data collection practices and advertising schema for years. If this holds up, Facebook will need to ensure that they are collecting explicit and voluntary consent from each of their users before creating “user profiles.” Likely, there will be tension present, and Facebook will need to determine how to proceed in situations where consent is not given.
What’s Next?
It is important to note that this decision is not yet final and can still be changed upon appeal by Facebook. Facebook has stated that Germany has misrepresented their compliance with the General Data Protection Regulation through these practices. Germany’s arguments are heavily rooted in not only compliance, but they also highlight competition concerns. Part of the argument is that by being a large company, Facebook is engaging in “exploitative abuse” by using their advantage as a large company to collect a “treasure trove” of data.
Large companies including Google and Amazon also rely on generating income from online, targeted advertisements. This case is significant for those companies, as it will likely set a precedent on data law compliance and targeted advertising.
While the United States has a sectoral approach on regulating data and is not directly regulated by these laws, its citizens still feel the effects of data regulation from other parts of the world. The General Data Protection Regulation has impacted user experiences across borders, and this will likely have a similar effect.