Meta Moves Toward Consent for European Behavioral Ads After GDPR Rulings

Meta announced plans to move certain behavioral-advertising data processing to consent in the EU, EEA and Switzerland after European regulators and courts challenged its previous GDPR legal bases. Following complaints filed by privacy group noyb in 2018, the European Data Protection Board rejected Meta’s reliance on contractual necessity for personalized advertising on Facebook and Instagram. Ireland’s Data Protection Commission subsequently imposed combined fines of €390 million and a three-month compliance deadline. Meta switched certain first-party advertising data processing to legitimate interests on April 5, 2023, while appealing the decisions and fines. After a July 2023 Court of Justice of the European Union judgment further constrained its legal options, Meta announced its intended transition to consent on August 1, citing evolving regulatory requirements and the forthcoming Digital Markets Act.

The proposed transition did not resolve disputes over the scope of Meta’s processing or whether users would receive a genuinely free choice. noyb argued that legitimate interests could not justify the contested tracking and advertising practices and warned that the planned consent approach might exclude data such as age and location. It also challenged whether the Irish decisions fully addressed processing for platform improvements and personalized content; the EDPB sought further investigations amid disagreements with the Irish regulator. According to noyb, contextual advertising remained possible without the disputed personal-data processing. The references establish an announced consent transition, not verified completion or comprehensive compliance. For organizations using behavioral advertising, the proceedings underscore the need to validate legal bases, consent coverage and user choice; they concern privacy enforcement, not a reported security breach.