When you watch a video on Instagram, the app’s algorithms are also watching you. As you scroll, they are hoovering up information to figure out what makes you tick—not only to show you content that keeps you coming back, but also to show you ads that are more likely to make you buy something.
Meta calls the information it compiles about how users behave across its apps “activity.” That activity might include what they say in social media posts or comments, the contents of the (unencrypted) messages they send or receive, the hashtags they use, and how long they spend watching certain types of posts or videos.
When compiled, this information can reveal incredibly personal information, potentially ranging from an individual’s musical tastes to their menstrual cycles. “These data are rather potent in the sense that they will tell you everything about a person’s online behavior and therefore also their interests, their personality,” says Tobias Judin, spokesperson for Norway’s privacy watchdog, Datatilsynet. When that information about how a user behaves online is used to inform what type of ads that person sees, it becomes what’s known as behavioral advertising. “Literally everything that you do on these platforms can be recorded and used for behavioral advertising purposes,” he says.
For years, European courts have argued that Meta cannot use this type of data for advertising unless the company asks for users’ explicit—yes or no—consent. But in July, Norway went a step further, branding the way Meta carries out behavioral advertising as illegal. The watchdog threatened to ban Meta’s behavioral ads in Norway and pledged to fine the tech giant $100,000 per day unless the company changed its ways. The ban was due to take effect on August 4; three days before that, on August 1, Meta quietly published an update to a January blog post announcing its intention to comply.
“Today, we are announcing our intention to change the legal basis that we use to process certain data for behavioral advertising for people in the EU, EEA and Switzerland from ‘Legitimate Interests’ to ‘Consent,’” the blog post read, without saying specifically when the change will take place or mentioning Norway. Meta declined WIRED’s request to comment further.
Norway is chalking this up as a victory. “While Meta states that this is a voluntary change on their end, that appears very unconvincing,” says Judin. “Asking users for consent could negatively affect the company’s earnings, and historically speaking, Meta has not been willing to sacrifice profits for privacy unless forced.” Meta said the wider Europe region generated almost a quarter of its advertising revenue in the three months leading up to June 30.
Norway’s threat was a bold move. “We normally don’t ban processing activities like this,” Judin says. But the regulator has become a new thorn in Meta’s side. Last year, the watchdog came under new leadership, with privacy lawyer Line Coll taking the helm as director. Speaking to the Norwegian business magazine Kapital in May, she suggested she was thinking about new ways to use sanctions to better protect privacy. So far, she has delivered.