A human rights campaigner, Tanya O’Carroll, has succeeded in forcing social media giant Meta not to use her data for targeted advertising. The agreement is contained in a settlement to an individual challenge she lodged against Meta’s tracking and profiling back in 2022.
O’Carroll had argued that a legal right to object to the use of personal data for direct marketing that’s contained in U.K. (and E.U.) data protection law, along with an unqualified right that personal data shall no longer be processed for such a purpose if the user objects, meant Meta must respect her objection and stop tracking and profiling her to serve its microtargeted ads.
Meta refuted this — claiming its “personalized ads” are not direct marketing. The case had been due to be heard in the English High Court on Monday, but the settlement ends the legal action.
For O’Carroll it’s an individual win: Meta must stop using her data for ad targeting when she uses its services. She also thinks the settlement sets a precedent that should allow others to confidently exercise the same right to object to direct marketing in order to force the tech giant to respect their privacy.
Speaking to News about the outcome, O’Carroll explained she essentially had little choice to agree to the settlement once Meta agreed to what her legal action had been asking for (i.e. not to process her data for targeted ads). Had she proceeded and the litigation failed, she could have faced substantial costs, she told us.
“It’s a bittersweet victory,” she said. “In lots of ways I’ve achieved what I set out to achieve — which is to prove that the right to object exists, to prove that it applies exactly to a business model of Meta and many other companies on the internet — that targeted advertising is, in fact, direct marketing.
“And I think I’ve shown that that’s the case. But, of course, it’s not determined in law. Mesa has not had to accept liability — so they can still say they just settled with an individual in this case.”
While the E.U. has long had comprehensive legal protections in place for people’s information, such as the General Data Protection Regulation (GDPR) — the law O’Carroll’s legal challenge had hinged on — which the U.K.’s domestic data protection framework is still based on, enforcing these privacy laws against surveillance-based ad business models such as the one Meta operates has proven to be a painstaking and frustrating endeavor.
Years of regulatory whack-a-mole have played out in relation to multiple GDPR complaints about the company since the regime came into force in May 2018.
And while Meta has racked up quite a number of GDPR fines — including some of the largest ever privacy fines for tech — its core consentless surveillance business model has proven harder to shift. Although there are signs that enforcement action is finally chipping away at this position in Europe. And O’Carroll’s example underscores that privacy push-back is possible.
“The thing that gives me hope is that the ICO [U.K.’s Information Commissioner’s Office] did intervene on the case and did very plainly — and incredibly convincing and persuasively — side with me,” O’Carroll added, suggesting that other Meta users who also take steps to object to its processing of their data may have a stronger chance of the ICO stepping in to support them if Meta denies their requests now.
That said, she thinks the company will now likely shift to a “pay or consent” model in the U.K. — which is the legal basis it moved to in the EU last year. That requires users to either consent to tracking and profiling or pay Meta to access ad-free versions of its services.
O’Carroll said she is unable to disclose full details of the tracking-free access Meta will be providing in her case but she confirmed that she will not have to pay Meta.
