Noyb files GDPR complaint against Meta over "Pay or Okay"
noyb.eu
noyb.eu
FB is basically daring Europe to enforce their laws. I hope the entire concept of paying for privacy gets shut down hard.
Social networking as a fundamental human right? I find the idea ludicrous, but if, then request the governments to build and operate them.
Nobody, absolutely nobody said that ever. So the question is why are you asking that question? No, social networks are not a fundamental right. Privacy is. What is so hard to understand about that?
None of the services I pay costs that much yearly, and sum of top 5 most expensive services I use is still below that amount.
...or they're just an extremely inefficient company, I don't know.
There are plenty of companies running non-targeted ads that are doing just fine, and don't cost millions of dollars to run a year. Facebook wants scale at any cost, and that is unacceptable.
The argument that we have to put up with something we never asked for, but has been carefully integrated into society to be utility-like is disingenuous. I don't want Facebook or WhatsApp, but in the Netherlands they are now used by schools, and even government agencies for communication.
You can't have it both ways: Either you're indispensable (something Facebook has worked very hard to become) and therefore treated as a utility, or you're a private company that can do as they please.
You wouldn't. So what? You don't need to do that.
Maybe you wouldn't. Maybe you'd go bankrupt. Can't say I'm sad about that outcome. Businesses that are only viable if they can violate people's rights don't deserve to exist.
No it isn't hard to comprehend but it isn't relevant here. Privacy doesn't mean no ads and nobody is preventing facebook to require users to pay a fee.
It is similar to organs. It is illegal to sell/buy them. You can still freely give them away(donate them). Privacy is similar to that. You can't buy/sell it but you can freely give it away. In this situation Facebook seems to be trying to sell you your privacy.
Nobody said that. Now, you want to create a fundamental companies right to do whatever they want for revenue. They can't, they'll be shutdown one day, hopefully
One can display ads without tracking/profiling someone.
The issue here isn't the ads, the issue here is the profiling. So in that regard Meta is fully allowed to run as many ads as they want, as long as they comply to GDPR (which says nothing about the ability to advertise, only about the ability to use personal/profiling data).
> Posters, signs and other such ads in the real world exist without tracking.
They used to, but many posters now include fairly sophisticated tracking software—in particular the luminous/screen types. We know what it’s like to have paper glued to boards, and that existed in the real world, but it’s not that clear-cut anymore.
It's not unreasonable for Meta/Facebook to ask for a subscription, if you don't want to be tracked, not that I'd trust them not to. The current fee is set either to avoid having people signup or because settings it at say cost + 10% would reveal that their ads actually doesn't generate that much profit. Meta makes a lot of money on Facebook, but only because of their scale. Individually each European user represents somewhere around €20 per year, ten times less than what Meta is asking. So for €25 you should get not only no tracking, you should get ad-free Facebook.
Meta will never tell us, but how much less would a user be worth without all the tracking?
Maybe a different explanation is that, sure, on average they make €20 per user per year... but the distribution of how much money they make is extremely lopsided, such as a power law. They want everyone using the platform--even the most unprofitable people--as the service only really makes sense if you can find and communicate with everyone on it... but the people who are most likely to be willing to randomly fork over a bunch of cash to not get tracked are the very kind of person who also are most likely to pay for stuff in general and so facebook in fact might be making 10x as much off these users than people who wouldn't pay for the service at any price?
That does sort of leave the whole business model with a problem where Facebook is an unnecessary middle man for customers who where willing to buy your product anyway. The more you think about it the weirder the model of ad supported services becomes. There is a set of service that is valuable, but not to an extend where we'd want to pay for it.
Each user that signs up to pay decreases the value of the ones who don’t because it lowers their number. If the price is reasonable and “too many” people sign up, they’re decreasing revenue on the other side. Plus, paying users have a bigger voice in general, in that they can stop paying and you’ll notice. Free users are easier to control as they’ll stick around and accept much more crap.
So in a way: going to a court the user has more chances of winning when they paid for a service than when using it freely, even if using it freely means they pay with their privacy, when there is a breach of the contract.
Not saying this is what Meta is doing but saying that in some cases it is better to give something away for free than to ask even 1 EUR for it.
That's not correct. Their ARPU in Europe is about $20 per quarter, not per year.
Old number is available here: https://www.theguardian.com/technology/2016/jan/28/how-much-...
EDIT: Nevermind: https://www.statista.com/statistics/251328/facebooks-average...
Around €70 per year seems to be the new number, it has also been clarified that this is revenue, not profit, making it a pretty good indicator of how much Meta needs to charge for Facebook to turn a profit (about four times less than what they are actually charging).
The subscription really is priced in line with their ad revenue. It might not be priced in line with the value you're getting from Meta's apps, but it definitely isn't any kind of play to make it intentionally so expensive that nobody would buy it.
Any cheaper, and they'd be basically guaranteed to lose money by offering the subscriptions just due to adverse selection effects. (Frequent users are more likely to subscribe, but also will see more ads.)
And the price they’re asking for is deliberately exorbitant so people will never choose it. Do you truly not see the end game?
It’s like Meta opened a restaurant where they serve food for free and popularised it to the point some families only see each other over those meals. A few years after they hooked everyone we found out they lace the food with drugs, so we make a law saying you can’t do that without consent. To which Meta’s reaction is to introduce a new plan where they will serve you food with fewer drugs in exchange for beating the crap out of you every time you come in.
You have the right to not be served foods with drugs and to not be beaten down. If Meta can’t operate a restaurant without doing either and sustain a business, that is their failure.
It boggles the mind that people defend corporations who exploit their users, giving them a pass to do anything as long as they throw some rancid peanuts on the ground for free.
It seems to me FB is saying people need to either:
- pay money, or
- consent to handing over their data, or
- have their account shut
I know which option I'm choosing! But what is so wrong about this trilemma?
Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.
You need to be able to freely choose to not consent “without detriment”. Meta would like to argue the point, but I think it’s pretty clear, and they’ve lost everything so far.
* When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.*
The way I interpret that is that requiring consent for tracking / data collection for marketing is pretty much always ruled out since it can never actually be necessary.
Facebook can show all the ads they like, and have a "pay to not see them" option too.
At least most of the German and French media industries do, and they've been getting away with doing the exact same pay-or-consent thing for years. So it's easy to see why Meta would think it'll work for them as well.
(I think Meta will lose this, but it'll be a good test for whether the laws really are the same for everyone.)
> What if a privacy subscription costs $1000/mo?
That's a weak argument, because it implies that there is a price at which this is OK. I.e. there's no actual principle at stake and we're just haggling about the price.
And if it comes to some price being ok, Meta isn't trying to charge $1k/month like in your thought experiment, but an amount pretty close to what a typical Facebook user in Europe produces in ad revenue. Trying to argue that pricing that just matches e.g. the 80th percentile user is unreasonable seems like a loser.
It implied the opposite to me.
Just to be clear: I think what Meta is doing should be found non-compliant with the GDPR due to consent-or-pay not counting as freely given consent, but it is less of a slam dunk than it should be due to what the newspapers have been allowed to do.
But if that argument fails, complaining about the cost being too high is not going to work as a backup strategy.
The article brought price into it. But everyone must admit $1000 would be illegal. And €12.99 is illegal for the same reason $1000 would be illegal.
And they are wrong there too.
This is not a "Pay or see ads" issue, this is a "pay or consent" issue.
One wonders if payment can even bind Facebook to refrain from tracking. How is compliance with the terms of this "agreement" monitored. How does anyone even know that Facebook is not still tracking, perhaps through another entity. And of course, Facebook could change the terms anytime. It has a record of ratcheting up the surveilance and ads with further anti-privacy changes.
Facebook tracks people who are not even Facebook users.
Apple CEO claims "privacy is a fundamental human right". Is this just more deceptive marketing. Apple must have some employees living in Europe who use Facebook. What's stopping these "data subjects" from filing complaints against Facebook. That's a question left to the reader.
Kudos to Noyb. Amazing work.
For an analysis of the graph between users, does a link between two users break when one is paying or both? Don't they even track graphs beyond non-user, e.g., same non-user phone number in two user address books?
Yet Meta has given a convenient, fixed number here, so perhaps such a lawsuit has a chance to succeed.
Banging Facebook over the head might make Facebook suffer, but it isn't going to create an alternative privacy-conscious social network, or even the incentives to the existence of such an alternative. It's just going to further add cost to a bunch of properties that might have once been dominant and hegemonic, but aren't anymore (hello tiktok) and destroy value that would otherwise have accrued, primarily, to advertisers whose ads now will be much more crappily targeted.
Actually going after the big players is way how to set precedent. If Facebook will be allowed to do this then most likely everybody can.
Here’s what the DPA conference had to say
https://datenschutzkonferenz-online.de/media/pm/DSK_Beschlus...
Deepl:
> Whether the payment option - e.g. a monthly subscription - is to be regarded as an equivalent alternative to consent to tracking depends in particular on whether users are offered equivalent access to the same service in return for a standard market fee. Equivalent access generally exists if the offers include the same service, at least in principle
https://www.enforcementtracker.com/ has a list of enforcement actions, and low and behold, most of them are against EU companies.
(The country filter is for the fining entity, not the fined entity, just in case anyone thinks this doesn't include US companies at all)
They've had like five years of large European media companies doing this. That was the time to make an example out of someone, not hope that some even bigger company comes along.
I doubt that Meta makes anywhere near 10€ per months with the ads they are showing me. If they can show realistic numbers how much money they own by showing me ads, I am absolutely fine to pay that with a 10% surcharge. I doubt this will be more than 5€ per month.
I'm happy that the GDPR already forced Facebook to offer a no-personalized-ads option, even though I don't really trust them that they don't keep collecting your data for when you cancel the subscription.
I think there's a difficult balance to strike, but paying for not violating your privacy is not. I wish them luck!
I would pay for YouTube premium in a heartbeat if it meant they will stop tracking me and stalking my activity.
Advert tracking, and anything where they sell on this data, that's where their interests are no longer aligned with mine.
And I don't use Google search anyway (brave search is really good), I just care about YouTube.
The 'Customize' screen could have lots of power use options for deciding how ads data was used, and sufficiently powerful that the options couldn't be explained without pages of help text, and that choosing "No" or "Yes" to all options made a config with contradictions (ie. "The configuration you have provided requires us to use age data to show you age suitable content, but you have denied us permission to use your age. Please correct your choices before continuing.").
They'd still have the majority of users Pay or Okay, and a tiny minority would go the power user route, and it's existence would keep the EU happy. They'd need to convince the EU that the complexity of the customize screen was necessary due to the inherent complexity of the decisions that need to be made by the user, and not because they want to discourage the users from using it.
They are not activists (there's other orgs for that, like Irish Council for Civil Liberties, which takes much more aggressive approach to privacy rights. Them undertaking these efforts means that it's very likely they'll succeed.
GDPR legal text quite clearly establishes that consent must be freely given. Ultimatums (pay or else) aren't freely given. Also, Meta used their primary color (blue) in the UI modal for "consent" or pay to highlight the "consent". They just can't but not build the case against themselves -- using manipulative UI patterns (priming) to get the choice they want.
that business model has long gone in my view - new businesses will move in and innovate in that vacuum.
"Industry numbers suggest 97% of people like free stuff, but 99% decide against paying when faced with the fact that stuff costs money." ... reads like Onion. Companies somehow refuse to become charities; EU should force them, sounds logical.
Facebook/Instagram, are not fundamental rights, nor will it impede one's ability of living without them (I have neither).
No, but privacy is. That should not be a hard concept to grasp but it seems many on HN, for whatever reason, are struggling.
I don't see how making the user's only choice be to pay this subscription is a solution to that problem?
Their argument for the price being to high is that Facebook makes about €60 per EU user per year so setting the privacy fee to about €250 seems to be too high. Their argument, the main one, is also that consent should be freely given but if one choice is behind a paywall while the other isn't then the choice isn't freely given.
How is it not? Aren't you free to not use the solution?
I've personally never touched a Meta product and absolutely never will (and despite this they probably still have a shadow profile of me), but this isn't a simple or even possible decision for a lot of people here.
Max Schrems: “Fundamental rights are usually available to everyone. How many people would still exercise their right to vote if they had to pay € 250 to do so? There were times when fundamental rights were reserved for the rich. It seems Meta wants to take us back for more than a hundred years.”
Is Facebook a fundamental right?
No, but privacy is.
The EU protectionism around internet service is due to its lack of competitiveness in the whole internet economy. Or they might just outright start this trade war with US, and see how it goes.
EU and Member States thereof can also use less drastic means to compel people and companies to follow the law.
BTW we also retired capital punishment for people. We don't need 0/1 either-or constructs in law.
that doesnt sound good, no?
privacy laws must be enforced
i dont see how needing a email/phone number to register for something is related to anything were talking about.
In many situations, there are no alternatives if you want to participate in society. This is of course outrageous, but non the less a reality. I have managed to stay of Metas products since 2018, but I do not have children :)
If Milei gets his way, you can go to Argentina!
Is right to privacy while using Facebook services a fundamental right? Well, given some of the services they own - maybe they should be. WhatsApp is massive in the EU, while Instagram seems to be the replacement for Twitter for a lot of people now that Twitter itself is flooded with fools that nobody likes to interact with. We've already had Facebook suprise drop a "EULA change" on WhatsApp users that let them use WA data in the Facebook algorithms. The specific field Facebook is even in makes it unusually hard to leave. It's somewhat socially acceptable to not have a Facebook account. Its less acceptable to not have an Instagram and I don't think you can function in west-european society without WhatsApp at the moment; basically everyone expects you to have it.
So yes, privacy when using Facebook is extremely important (GDPR literally exists to codify privacy as a right) and pay-or-okay is holding it hostage.
> It's somewhat socially acceptable to not have a Facebook account. Its less acceptable to not have an Instagram and I don't think you can function in west-european society without WhatsApp at the moment; basically everyone expects you to have it.
I can assure you that it is perfectly viable to live a normal life in a west-european society without using any Meta product. It gets a bit more difficult if you have kids at school, though, with teachers and parents not being flexible.
For example, parties are organized in Whatsapp group chats and the local library’s events are posted to Instagram.
> Facebook is the big corporation the GDPR was largely written to try and reign in
As I understand it, GDPR was to keep all the different EU member states' rules on the same page and up to date, and was continuing the same path that had already been stated with the Data Protection Directive in 1995: https://en.wikipedia.org/wiki/Data_Protection_Directive
Most of the core ideas were already present before Zuckerberg finished[0] high school.
[0] and possibly started, but I don't know how US schools work.
Actually GDPR text was largely written before shitting on Facebook became the cool kids thing.
The text was adopted by European Parliament in 2014. In 2011, EDPS publishes an opinion on political wants towards GDPR. It's very likely the text becomes written circa 2012-2013. That's waaaaay before any general public's disgruntlemnt with Facebook or any Big Tech giants. The public opinion against Big Tech starts to shift around 2015, after CJEU decides the so called "Google Spain" case (users being allowed to remove their search results from search engines). For reference, Cambridge Analytica story gets broken in 2018.
It is very likely that if GDPR was to be introduced today, the legal text would be much stricter and harsher. We need to realize that GDPR is a general data protection law. It does not prescribe industry-specific measures. It is written to apply to a bread baker so much as it is written to apply for a Big Tech giant. And that means race to the bottom in terms of legal standard.