In early July, the Court of Justice of the European Union (CJEU) ruled that Meta may not process personal data for the purposes of online behavioural advertising based on ‘legitimate interest’ lawful basis. As a follow-up to this ruling, the Norwegian data protection authority (Datatilsynet) decided to temporarily ban such processing until Meta fixes it or until the European Data Protection Board (EDPB) adopts final measures instead of temporary ones. Besides, Datatilsynet requested an urgent decision from the EDPB, so that final measures may urgently be adopted. The temporary ban is valid from 4 August to 3 November and covers Norway-based internet users. In case the EDPB adopts final measures, those will cover the European Economic Area at large and not just Norway.

In response to the above, Meta has now proposed a consent-based scheme for online behavioural advertising. As the IAPP informs, “the company said its systems would be updated to offer users a “yes or no” option for opt-ins across its platforms, including Facebook and Instagram”. However, as NOYB.eu pointed out, “Meta has so far only announced that it would switch to consent fo “certain data for behavioural advertising. The GDPR does however apply to any type of personal data for any type or processing. The word “behavioural advertisement” is not existent in law. If Meta for example uses the age or location of a person, it is unclear if this would constitute a “behaviour” in the view of Meta and if the consent requirement would be complied with”.

As mentioned above, after an imposition of a temporary ban, Norway’s Datatilsynet requested an urgent decision from the EDPB, which will hopefully give assessment to all the developments that occurred after the Datatilsynet’ temporary ban.

***
Meanwhile, Norway’s Datatilsynet has provided informal guidance on how to use website analytics and tracking tools while adhering to the EU General Data Protection Regulation. The guidance highlights nine key aspects that companies should consider when employing such tools. These, inter alia, include ensuring data is kept to a minimum, finding alternatives to intrusive cookie banners, being mindful of potential cross-border data transfers, maintaining a fair degree of transparency towards users, etc.

The guidance itself is informal and is more adapted to SMEs which consider running a website with analytics and tracking tools being used. Also, the guidance more intends to cover basic and high-level considerations, rather than to provide in-depth explanations.