Norway puts pressure on Meta over privacy concerns

Norway's data regulator Datatilsynet has told Meta Platforms, the company that owns Facebook, that it will face a daily fine of 1 million kroner ($96,890) from Aug 14 until November over privacy breaches.

On July 17, the regulator ruled that Meta would be penalized if it did not deal with privacy breaches it had highlighted, relating to the harvesting of user data for targeted advertising — which is a common practice by big technology companies, and which Meta claimed was a key part of its business. The deadline has now passed.

"These data are rather potent in the sense that they will tell you everything about a person's online behavior and therefore also their interests, their personality," Datatilsynet spokesman Tobias Judin told the website Wired.com.

"Literally everything that you do on these platforms can be recorded and used for behavioral advertising purposes."

Although not a member of the European Union, Norway is part of the European single market as a member of the European Economic Area, and has gone further with its actions against Meta than the bloc has.

The wider European market is a huge source of revenue for Meta, with the company saying it generated almost one-fourth of its advertising revenue in the second quarter of this year.

Last month, the EU Court of Justice decided regulators can examine how companies use data to build up their positions of dominance, as part of continuing inquiries into the anticompetitive practices of big technology companies.

Evaluating move

After the ruling, Meta said it was "evaluating the court's decision and will have more to say in due course", and the subsequent decision of the Norwegian regulator seems to have put it under even more pressure to change its behavior.

"The Norwegians are really applying the law as it is, which a lot of other DPAs (data protection authorities) don't really do," Max Schrems, head of privacy campaign group NOYB in Vienna, told the Financial Times.

On Aug 1, following the rulings, Meta updated a blog post saying it would "change the legal basis that we use to process certain data for behavioral advertising for people in the EU, EEA and Switzerland from 'Legitimate Interests' to 'Consent'", though without confirming a date or mentioning Norway by name.

Judin from Datatilsynet said it was "very unconvincing" that Meta is trying to make this look like it was a voluntary decision.

"Asking users for consent could negatively affect the company's earnings, and historically speaking, Meta has not been willing to sacrifice profits for privacy unless forced," he said.