European regulators fine Meta over $400 million for targeted ad program

The tech giant says it plans to appeal the decision, potentially resulting in a drawn-out legal battle over its practices in Europe.

Irish regulators fined Meta 390 million euros, or roughly $414 million, Wednesday for allegedly forcing users into its targeted advertising program in violation of Europe’s landmark privacy law.

The decision is just the most recent in a string of rulings in Europe against Facebook’s parent company over its advertising, privacy and data tracking practices that have totaled well over $1 billion in fines.

The latest fines resulted from an investigation into two 2018 complaints alleging that Meta essentially forced users to consent to behavioral advertising by including a clause allowing the practice within an updated terms of service agreement, which is required for use of the platform. European investigators determined that the behavior violated the General Data Protection Regulation, which guides how companies handle the data of EU citizens.

Regulators ultimately fined Meta Ireland for 210 million euros for a complaint about Facebook and 180 million euros for a complaint about Instagram.

Meta now has three months to bring its practices into compliance with GDPR. The tech giant says it plans to appeal the decision, potentially resulting in a drawn-out legal battle.

“These decisions do not prevent personalized advertising on our platform. Advertisers can continue to use our platforms to reach potential customers, grow their business and create new markets,” the company said in a statement.

Meta has already suffered a slump in ad revenue over the past year, due in part to a new privacy rule from Apple last year that requires apps to ask for permission before tracking user data.

European Center for Digital Rights, a nonprofit founded by data privacy activist Max Schrems, filed the complaints on behalf of an Austrian and Belgian user.

“Instead of having a ‘yes/no’ option for personalized ads, they just moved the consent clause in the terms and conditions,” Schrems said in a statement. “This is not just unfair but clearly illegal. We are not aware of any other company that has tried to ignore the GDPR in such an arrogant way.”

The European Center for Digital Rights also filed a third complaint about WhatsApp that is still being decided by investigators.

Meta paid a hefty sum in GDPR fines in 2022, including roughly $400 million in September over the processing of children’s data on Instagram and roughly $275 million in November over the scraping and exposure of data of 500 million users.

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure