Norway’s data protection authority, the Datatilsynet, has issued a temporary ban on Meta from running behavioral advertising on Facebook and Instagram in the country. The ban will be in effect for three months unless Meta obtains users’ consent for the processing of their data.

The ban allows Meta to continue running other forms of targeted advertising, such as contextual targeting that doesn’t rely on tracking and profiling users. Alternatively, Meta can still run behavioral advertising if it obtains users’ consent. However, if Meta continues to run behavioral ads without offering users a choice to deny tracking and profiling, it could face fines of up to one million NOK per day.

The Norwegian Data Protection Authority considers Meta’s current practices illegal and believes that immediate action is necessary to protect the data protection rights of Norwegian users. The authority has warned that invasive commercial surveillance for marketing purposes poses significant risks to data protection on the internet.

The ban order is a response to a ruling by the Court of Justice of the EU (CJEU) that challenged Meta’s legal basis for microtargeting users with ads in the region. Previously, Meta faced a major decision from Ireland’s Data Protection Commission (DPC), which found its ads processing to be in breach of the EU’s GDPR. Meta was fined and ordered to comply, but the CJEU later stated that the legal basis Meta claimed was also inappropriate for its surveillance advertising business.

While the Norwegian DPA is not Meta’s lead data supervisor, it can utilize emergency powers under the GDPR to protect users in its own market. Therefore, the ban order is specific to Norway. Meta has responded to the ban order by suggesting that there is an ongoing debate regarding the legal bases for its advertising business. However, the CJEU ruling clarified that relying on legitimate interests is not a valid legal basis for its ads.

Meta has not confirmed whether it will appeal the order or make changes to its operations in Norway. If Meta fails to comply with the ban order, it could face significant daily fines. The Norwegian authority has also raised the possibility of referring the matter to the European Data Protection Board, which could lead to a wider ban on consent-less behavioral advertising across the EU.

The temporary ban on Meta’s behavioral ads in Norway highlights the increasing scrutiny faced by tech companies regarding data privacy and advertising practices. The ban emphasizes the need for user consent and compliance with data protection regulations.