Months after Ireland fined Meta $1.3 billion for violating the EU’s General Data Protection Regulation (GDPR), the company will soon be slapped with a daily $100,000 daily fine for breaching advertising rules in Norway.
The Norwegian Data Protection Authority has already imposed a temporary ban on Meta for carrying out “illegal behavioral advertising” based on data gleaned from its surveillance of Facebook and Instagram users without their consent or knowledge.
“The ban will apply from Aug. 4 and last for three months, or until Meta can show that it complies with the law,” the authority said in a statement published by the Norwegian watchdog Datatilsynet. “Should Meta not comply with the decision, the company risks a coercive fine of up to one million NOK ($100,000) per day.” The fine will initially apply until the end of October, racking up $9 million over 90 days.
Tobias Judin, an official at the Norwegian Data Protection Authority, said in the statement that the ban is not to keep platforms from operating altogether but rather to “ensure that people in Norway can use these services in a secure way and that their rights are safeguarded.” But “all business models must respect privacy as a human right,” Judin added. “Users must have sufficient control over their own data, and any tracking must be limited.”
The Norwegian data regulator wants Meta to stop showing users personalized ads based on their private online activity and location. Such invasive commercial surveillance for marketing purposes, Judin said, is “one of the biggest risks to data protection,” and needs to stop.
The regulator has argued that when Meta tracks users without their knowledge, it can decide “what adverts someone is shown” and “what not to show.” This kind of behavioral advertising strengthens existing stereotypes and could lead to intrusive profiling and unfair discrimination of users.
Norway wants Meta to only show Facebook and Instagram users ads that are based on information they disclose in the “About” section of their profiles. About 82% (pdf) of the adult Norwegian population is on Facebook, while 65% is on Instagram.
Norway is the first European country to severely limit Meta’s ad-driven business following the top EU court’s ruling, even as the Irish Data Protection Commission keeps a close eye on Meta to ensure its GDPR compliance.
Responding to the developments in Norway, Matt Pollard, a Meta spokesperson, said in a statement that Meta is grappling with a lack of regulatory clarity around data privacy in the EU. “We continue to constructively engage with the Irish DPC, our lead regulator in the EU, regarding our compliance with its decision. We will review the Norway DPA’s decision, and there is no immediate impact to our services,” Pollard said.