Meta to let EU users deny cross-site tracking as Digital Markets Act bites

Meta has provided new details of how it plans to respond to incoming competition rules in the European Union that aim to tackle abusive behaviors by Big Tech by enforcing fairer dealing on a handful of the world’s most powerful platforms.

The Digital Markets Act (DMA) applies to just six (mostly US) tech giants, including Meta.

Back in September the EU designated Meta as a so-called “gatekeeper” — listing six of its products as “core platforms services” under the DMA — namely: Its social networks, Facebook and Instagram; its ads delivery system; its messaging services, WhatsApp and Facebook Messenger; and its virtual marketplace platform, Marketplace. Although the rules can apply more widely to other services offered by gatekeepers, not just to named services.

The DMA generally puts limits on how gatekeepers can operate, including — of high relevance here — restricting their ability to process user data for advertising (with the regulation stipulating they must gain consent for this).

The law also says gatekeepers must not combine user data between their core platform services or with user data from any other services gatekeepers provide or with personal data supplied by third parties — unless they provide users with a “specific choice” and obtain their consent.

The deadline for gatekeepers to be compliant wit the DMA is March 7 — hence why the social networking giant is busy working up tweaks to its services in the region.

In a blog post today, Meta writes that it will “soon” (over the “next few weeks”) start sending notifications to users in the region where the law applies (namely: countries in the EU, European Economic Area and/or Switzerland) offering them more choice over how they can use its services — including the ability to block Meta from combining data on their use of Facebook and their use of Instagram.

That’s a biggie as it could effectively reverse a factor that motivated Facebook to spend a billion dollars buying Instagram in the first place, all the way back in 2012: Boosting its visibility of social media users’ activity, and deepening its ability to profile people’s interests to target them with ads, by buying a key rival and getting access to Instagram users’ data.

Users of Meta’s dominant social networks will be able to tap this account separation choice via the existing Account Center feature.

“We are offering these choices to address the requirements of the DMA, which enter into force in March 2024,” Meta writes, suggesting the choices won’t be live until the deadline for DMA compliance starts to bite in early March.

The incoming choices will also enable regional users of Facebook Messenger to stop Meta combining their data with their use of its social network. Although Messenger users wishing to firewall their use of Meta’s products will have to create a new, separate Messenger account — which could generate some friction to discourage people to take the step of firewalling their messaging activity from public social networking.

For users of Meta’s Marketplace buying/selling platform, there will also be new choice they can exercise that will separate their Marketplace activity from their Facebook account — but anyone picking this this option will be penalized by no longer being able to use Facebook Messenger for comms between buyers/sellers; they’ll only be able to use email, per Meta’s blog post.

Meta has devised another notable obstacle for blocking users of Facebook Gaming from choosing not to have their gaming activity linked to their wider use of its social network: No access to social gaming.

“People who choose to use their Facebook information for the games they play on Facebook will have features like multiplayer games, in-game purchases, and personalised game suggestions. People who choose not to use their Facebook information for the games they play on Facebook can play some single-player games,” it writes.

The adtech giant’s blog post also reiterates a change it already made in the region, in relation to its tracking-based advertising — when, back in November, it launched an ad-free subscription. This is the only alternative Meta currently offers EU users who don’t want it to process their information to run tracking ads.

The ‘hobson’s choice’ it’s designed here — i.e. ‘pay us or agree to tracking’ — is already being challenged under the bloc’s privacy rules. And it remains to be seen whether EU data protection regulators will accept it. Although doubts about legality hasn’t stopped Meta from forcing the choice on European users in the meanwhile.

But the DMA is relevant here, too, as the newer regulation explicitly obliges gatekeepers to ensure consent is “as easy to withdraw… as to give”. This means that the Commission, which oversees DMA compliance, may have the power to speed up a crackdown on Meta’s latest iteration of forced consent in the EU — if EU regulators decide Meta requiring users to pay it to not to be tracked is not as easy as Meta letting users hit a button to accept its tracking (and, therefore, that the choice Meta has designed breaches the DMA).

Safe to say, EU privacy advocates will be keenly watching what the Commission does here.

“Gatekeepers should not design, organise or operate their online interfaces in a way that deceives, manipulates or otherwise materially distorts or impairs the ability of end users to freely give consent,” DMA recitals also read — words which may have additional relevance for the Commission’s assessment of other choices Meta has designed, and is announcing today, which could risk manipulating users into agreeing to their data being combined — i.e. since Meta is intending to withhold some (attractive) functionality unless they agree.

“In particular, gatekeepers should not be allowed to prompt end users more than once a year to give consent for the same processing purpose in respect of which they initially did not give consent or withdrew their consent,” the regulation further stipulates.

That means Meta won’t be able to nag users over these same choices until 2025. But if the design of the choices is unfair from the get-go Meta could buy itself more time to keep profiling Europeans, in spite of a flagship EU competition reform that’s intended to prevent tech giants from being able to use their market dominance to force their users to accept profiling.

Breaches of the regime, which is policed by the European Commission itself, can attract fines of up to 10% of global annual turnover — or billions of euros apiece — so the consequences for violating these rules are sizeable enough that Big Tech can’t simply ignore them. However attempts to see how far platform giants can push their luck with regulators, and minimize any concessions they do make, looks likely.

Indeed, Meta may well be setting the pace here. (But it’s the Commission which will set the tone — through its enforcement of the DMA.)

The quality of user consent referenced in the DMA is regulated under another (longer standing) EU law, called the General Data Protection Regulation (GDPR).

Under GDPR consent must be informed, specific (unbundled) and freely given if it is to be valid. And the choices Meta has defined and is presenting today will, ultimately, have to be assessed under that standard. So, for example, it will be up to EU regulators to decide whether a choice where the ability of users to play Facebook games with their friends is withheld unless they agree to Meta’s cross-site tracking and profiling of their activity on its platforms meets the GDPR bar for consent to be “freely given” or not.

An ex ante reform of digital competition law in Germany already led to Meta making some concessions over cross-site tracking last June. But where the German law is national, the DMA applies across the EU, EEA and Switzerland — so the EU regulation is expected to play a bigger role in reshaping platform power.

Last week Google, another of the designated DMA gatekeepers, published a blog post detailing some of its DMA prep — including incoming consent choices users of products such as its ads, Google Search, YouTube, Google Play, Chrome, Google Shopping and Google Maps will be able to express over “linked services”. “Over the next few weeks, we will be presenting European users with an additional consent banner to ask them whether some services can continue to share data for those purposes,” it wrote. “If services aren’t linked, some features may be limited or unavailable. Users can change their choices anytime in their Google Account settings.”