Meta to obtain consent for ads in EU, but not UK

Want to receive these weekly privacy recaps in your inbox? Sign up for our privacy newsletter, A Little Privacy, Please.

United States

CPPA Gets New Board Member

California Governor Newsom appointed Jeffrey Worthe, President of the Worthe Real Estate Group, to fill the seat vacated by Chris Thompson on the California Privacy Protection Agency (CPPA) board. 

TAKEAWAY

Worthe’s views on data privacy have not been publicized, so it is unclear at this stage what impact Worthe’s appointment may have on CPPA decision making.

The CPPA is currently in the process of rulemaking activities addressing cybersecurity audits, risk assessments, and automated decision making and will make decisions impacting business processes and consumer rights in these areas, including, for example, whether such rights and processes should align with, or diverge from, existing requirements in other jurisdictions.     

EUROPE

Meta to Obtain Consent for Behavioral Ads in the EU, not the UK

Meta announced, through a blog post update, that it will change the legal basis it uses to process personal data for behavioral advertising for people in the EU, EEA and Switzerland from ‘Legitimate Interest’ to ‘Consent’. The company did not include the UK in its announcement.

The stated reason for the change is emerging regulatory requirements in the impacted regions, interpretation of the GDPR by the Irish Data Protection Commission (Meta’s lead data protection regulatory in the EU), and the Digital Markets Act. 

TAKEAWAY

One day following Meta’s announcement, the UK Information Commissioner’s Office (ICO) said in a statement: “We are assessing what this means for information rights of people in the UK and considering an appropriate response.”

EDPB Issues Binding Decision re TikTok’s Treatment of Children’s Data

 The European Data Protection Board (EDPB) issued a binding dispute resolution decision under Article 65 of the GDPR in response to disagreement among European data protection authorities regarding TikTok’s processing of personal data of children under age 17.

Specifically, the decision concerns, among other things, whether there had been an infringement of data protection by design and default with regard to age verification, and whether there had been an infringement of the principle of fairness with regard to certain design practices.

The EDPB’s Binding Decision has not yet been made publicly available. 

TAKEAWAY

The EDPB’s decision was issued in response to supervisory authority objections to a draft decision of the Irish Data Protection Authority, TikTok’s lead supervisory authority.

The EDPB was called upon to settle the dispute after no consensus was reached.

The Irish DPA will now have one month to adopt a final decision reflecting the findings of the EDPB, after which the EDPB will publish its decision.

Once public, the decision may provide insight into the expectations under the GDPR for age verification.

The UK ICO has already fined TikTok 12.7 million pounds based on allegations, among others, that TikTok failed to carry out adequate checks to identify and remove underage children from its platform, as required by the UK GDPR and the UK Age Appropriate Design Code.  

Want more of the privacy highlights that matter to adtech and martech? Sign up for our privacy newsletter, A Little Privacy, Please.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.