Meta fined more than $400 million by Irish regulator over EU privacy breaches

LTC Eugene Chu
..."Schrems, in a statement Wednesday, said the DPC's decision Wednesday meant that Meta would have to develop a version of its apps that doesn't use personal data for advertising within three months.

He added Meta would still be allowed to ask users for consent to ads with a "yes/no" option, however.

"This is a huge blow to Meta's profits in the EU," Schrems said. "People now need to be asked if they want their data to be used for ads or not. They must have a 'yes or no' option and can change their mind at any time. The decision also ensures a level playing field with other advertisers that also need to get opt-in consent."

In December, the European Data Protection Board, which coordinates regulatory action on data privacy across the bloc, said that Meta wasn't entitled to rely on contracts as a legal basis for processing user data for targeted ads, effectively deeming the company's advertising practices illegal.

Subsequent to that move, the DPC said it found Meta was "not entitled to rely on the 'contract' legal basis in connection with the delivery of behavioural advertising as part of its Facebook and Instagram services, and that its processing of users' data to date, in purported reliance on the 'contract' legal basis, amounts to a contravention of Article 6 of the GDPR."

The fines imposed by the DPC were raised substantially from those proposed in a draft decision in October, in which the regulator suggested a levy of between 28 million and 36 million euros."