Facebook and Instagram users in the European Union who object to Meta’s behavioral advertising can simply request that their data not be used for permissionless tracking-and-profiling thanks to a free tool provided by non-profit privacy rights noyb.
According to noyb, an online form that Meta intends to provide to EU users seeking to exercise their legal right to opt-out of processing ads isn’t easy at all – no surprise! — hence the group has created a super easy way to get their rights under the bloc’s General Data Protection Regulation (GDPR).
Users can submit their appeal through noyb’s tool by logging into Facebook (i.e. to verify their account); or simply by giving noyb the email address they use for the service; or object via their own email client.
Once they have confirmed that they want noyb to assist them in opting out of Meta’s processing (i.e. by consenting to the data processing for this limited purpose), the tool generates an email on their behalf that noyb sends to Meta’s Data Protection Officer sends a request to stop processing their data for advertising.
The GDPR states that individuals have an absolute right to object to the processing of their personal data if it is for direct marketing purposes, meaning there are no grounds for refusing the request. There’s also no required format for filing these objections – so if Meta plans to comply with the GDPR, it can’t ignore emails from users asking to stop processing their data.
Here is the link to the tool that noyb has created to unsubscribe.
You can also see a preview of the objection letter she sends to Meta on your behalf.
The letter asks Meta to confirm compliance with the appeal within five business days, insisting that the user does not want to be directed to “links, online forms or other means of exercising my rights” (a common delaying tactic used to frustrate individuals’ data protection rights), emphasizing: “I should treat such a reference as a refusal to comply with my plain request.”
Under the GDPR, data processors must comply with the right to object “without undue delay” – or usually no later than one month after receiving a request. So meta should respond to such opt-out requests it receives stat. Or it risks new complaints and privacy enforcement.
The European rights group backed a successful challenge to the legal basis Meta claimed for tracking and profiling users, which led to the tech giant finally being hit with a $410 million fine early this year — along with an order to find the violations. remedying the GDPR within three months.
Meta will begin applying a new privacy policy in the EU starting tomorrow, following the aforementioned GDPR decision that deemed its claim of contractual necessity a bogus basis for behavioral advertising. And it has suggested that it will employ an alternative form of ad targeting for users who opt out, such as contextual targeting, that does not rely on individual tracking and profiling.
The determination of a breach of the GDPR means that Meta currently has no legal basis for processing under the rules of the block. Hence, it is being forced to change legal bases – and it plans to claim a so-called “legitimate interest” (aka LI) to process people’s data for microtargeting under the inbound regional policy. This is his response to the three-month deadline imposed by EU regulators to bring advertising processing into compliance with the GDPR. So essentially Meta was forced to do something.
Data protection experts suggest that it is (also) extremely unlikely that LI will fly as a valid legal basis for Meta’s surveillance ads. But even for it to claim to rely on this basis, it must provide users with a way to opt-out of ad processing, as the regulation requires it to provide a right to object to LI-based processing. Which means this is already much more than the privacy-hostile tech giant has previously offered. (tl;dr: Privacy enforcement works!)
The thing is, since this is Meta, the company doesn’t seem keen on EU users exercising their legal right to object to ad processing.
noyb has provided a link to what it describes as “the hidden and complex Facebook opt-out form” that Meta seems to want to use to cover up this user privacy choice.
The form uses a classic dark pattern design (aka sludge) to bury the main choice, with a series of nested menus full of irrelevant information, annoying dropdowns, and other hidden options (i.e. that only appear when you select a specific choice) , laced with much more external information designed to steer users away from the salient right that Meta doesn’t want them to exercise.
In the end, after much tedious clicking around to find the legally mandated objection option, TechCrunch came to vague terms: “I still have a question about how to exercise my privacy rights”. Clicking this brought up yet another menu asking for the country of residence – seemingly to finally be able to make a request. However, at the time of writing, the pre-populated list that Facebook presented to us did not include any EU member states.
(We can only hope Meta has fixed that by the time the new privacy policy goes into effect tomorrow. Or, er, it’s yet another shady pattern of trying to circumvent EU rights – literally by preventing users from claiming that they live in the region… 🤦)
Either way, it’s a lot faster and easier to use noyb’s tool to opt out of Meta’s privacy-infringing ads. (Here’s that link again.)
You can also just manually send an email to Meta asking it to stop processing your personal data – “for alleged ‘legitimate interests'” – assuming you can find an email address for Meta’s DPO (Officer for data protection) who is buried somewhere at their address. website.
The standard EU privacy experts suggest that Meta should offer is to ask users for consent before processing ads. And complaints about his attempt to ram a surveillance ad company through an LI base are sure to follow quickly after his latest legal ground switcheroo. But in the meantime, EU users can at least request their opt-out from Meta.
Noyb’s founder and chairman, Max Schrems, said in a statement: “These actions by Facebook are simply laughable and embarrassing. You must find any element in their privacy policy that you disagree with and explain why Meta’s assessment is incorrect in your individual case. However, their review will not be published, it is not far from saying that you can only unsubscribe every second Monday from 8 am to 9 am.
“Our form turns the table: Meta has to argue why they have an overriding interest – not the user,” he added. “Users can now opt out of data processing and Facebook must process this objection without delay. We want to make it as easy as possible for those affected to exercise their fundamental rights.”
Any Facebook users in the US who want them to have such a choice should call their representatives in Congress and tell them to pass the expanded federal privacy law as soon as possible.