Meta has introduced a new free subscription option with less personalised ads for Facebook and Instagram. Is this the end of behavioural advertising or a showcase of illusive compliance? Sebastian Steinert analyses Meta’s tactics to protect its data-driven business model based on behavioural advertising.
By Sebastian Steinert
“We want to empower citizens to be able to take control over their own data and choose a less personalised ads experience”, said outgoing Commissioner Vestager in July. It was the day the Commission preliminarily found that Meta’s “pay or consent” model violates Article 5(2) of the Digital Markets Act. Now, Meta has reacted to this finding and presented a new subscription model. In addition to the binary choice between behavioural ads and a paid subscription, users are now able to choose a version with “less personalised ads”. Additionally, Meta drops the price for the paid subscription by 40% to 6-8 € per month.
In theory, the new option with less-personalised ads has the potential to be an actual alternative for users who do not want to consent to Meta’s extreme accumulation of personal data. But of course, Meta doesn’t just give up on its highly profitable behavioural ads business. Instead, it seems that the company tries to propose a formal compliance solution that doesn’t lead to change in practice.
Meta has applied this strategy before, when it introduced its “pay or consent” model last November. On paper, the model fulfilled the requirement to provide users with an alternative to data accumulation. But Meta knew that no user would start paying 120-150 € a year for a service they got for free before. And Meta was right: “Paid subscriptions” are not among the revenue streams mentioned in Meta’s latest SEC report. Quite the opposite: in 2024 so far, 98% of Meta’s European app revenue stems from ads and its platforms continue to grow.
It seems that Meta’s goal is to continue this strategy. And now that it can no longer rely on a fee to prevent users from switching, it resorts to alternative measures: continued personalisation, complicated choice screens and reduced user experience.
1. Less personalised might be more personalised than you think
Meta is not very transparent on how much personalisation actually takes place within the new version with less-personalised ads. In its press release and on the app choice screens, Meta announces that it will use “a minimal set of data points” which includes age, location, gender and ad engagement. However, in its help center, Meta additionally lists device information “like the device or browser” as a data point. So which is it and are these examples exhaustive? For more information on ads, Meta refers to its privacy policy of 121 pages. But not on a single one of these 121 pages, Meta mentions the “less-personalised ads” option and what data points are being processed for it. So, Meta declares it uses fewer data points, but it won’t tell you which ones exactly.
Another part of the less-personalised ads version are contextual ads that are personalised based on the social media content shown to the user in the active session. But even these contextual ads could be more personalised than you might think. Firstly, Meta doesn’t specify what it considers an active session. If a session only ends when the app is fully closed, it could last a considerable amount of time for users who rarely close all their apps running in the background. And secondly, on social media platforms the context consists of highly personalised content to begin with. Every piece of content displayed to the user is the outcome of a complex algorithm based on profiling. The relevant data points that lead to the display of a specific posting or video might get connected to that content in a way that they also get considered for the advertisement shown in the context of that content. As a result, contextual ads could be much stronger personalised and targeted than many expect them to be.
2. Meta nudges you away from choosing the new option
Meta has started prompting its Instagram and Facebook users to make a choice on the advertising model and to provide consent for the related data processing. Recital 37 DMA requires such consent requests to be “user-friendly” so that users can make their choice “in an explicit, clear and straightforward manner”. Additionally, Article 13 DMA prohibits Meta from using “behavioural techniques or interface design” to undermine effective compliance. A straightforward manner of requesting consent would have been to prompt the user with the three options (paid subscription, regular ads, and less-personalised ads) and easily allow the user to choose. But Meta didn’t take this road. Instead, it decided to present the less-personalised ads option two layers behind the first user choice about ads. Throughout the long consent flow, Meta tries to nudge users away from making a choice about the degree of ad personalisation. Let’s take a look at the prompt screens on Instagram:
On the first Instagram prompt screen, Meta asks the user to “Review whether we can process your data for ads”, stating that the user has been asked before but needs to revisit their choice as part of applicable laws. On the second screen, the user can then choose between the paid subscription and the version with ads – a choice the user has likely already taken after the introduction of the paid subscription model in November 2023. Asking users again for their consent for the same purposes can trigger consent fatigue which might lead users to dismiss the choice screen and refrain from taking a decision. Article 5(2) DMA acknowledges the problem of consent fatigue by prohibiting gatekeepers from requesting consent more than once within a period of one year.
It is not clear why Meta would show the previously presented choice again before offering the new version with less-personalised ads. In the box of the ads-based version, Meta indicates “You’ll later have the option to see less-personalised ads”, which users could interpret as having a long consent flow ahead of them, what again might trigger consent fatigue. But Meta is so kind to offer an easy way out: after the user has (again) chosen the ads based version, the next screen says “You’re all set. You can now manage your ad experience” and it allows the user to dismiss the consent flow. Only if the user actively selects “Manage ad experience”, the flow takes them to the relevant decision. Here, on the fourth screen, the user is able to select the new version with less-personalised ads. After clicking it, a confirmation screen appears, warning the user that their experience will change. Only once the user hits “confirm”, they have successfully opted for the new option. In total, it takes six clicks and viewing five different screens before their decision is registered. Throught this lengthy flow, Meta provides for multiple opportunities to dismiss the consent flow via a “Not now” button.
And when revisiting the choice later from the regular app interface, the user journey gets even more complicated. Take a look and check how long it takes you to navigate through the settings:
On Instagram, it requires the navigation through multiple privacy setting pages and clicking/scrolling about 14 times until the user is able to select the less-personalised ads option. The option could be described as being “hidden in the settings”.
3. Questionable equivalence: the new option is less personalised but extra disturbing
The DMA requires the alternative service to be equivalent to the service with regular ads. Meta decided to include one feature that calls into question the equivalence of the different alternatives: mandatory ad breaks. If you choose to see less-personalised ads, such ads can be made unskippable for a few seconds. So far, it looks like Meta occasionally forces Instagram users to watch five to six seconds of ads before they are able to continue browsing through their social network feed. Meta points to the fact that such mandatory ad breaks are common in other services (most notably Alphabet’s YouTube). However, in Meta’s case it is not about the general admissibility of ad breaks on digital platforms but about whether they distort the equivalence with the service based on regular ads. Using a service with mandatory ads is certainly not an equivalent experience compared to a service where I can freely browse through content and skip ads. Mandatory ad breaks are a quality downgrade for users in high-speed mode (i.e. TikTok).
The DMA allows deviation from the original service to an extent that “a degradation of quality is a direct consequence of the gatekeeper not being able to process such personal data” (Recital 37). But would it be a technical problem for Meta to offer the less-personalised version without ad breaks? No. So it is not a direct consequence. It seems like Meta simply wants to include ad breaks to make the new version not only less personalised but also less attractive for users. Meta’s argument, the ad breaks are required to increase ad impressions for advertisers can, if at all, only qualify as an indirect consequence, which would be irrelevant under Article 5(2) DMA. The ad break interface seems to be designed to reattract users for the regular ads version: during the mandatory ad break, an information banner explains that the ad break is caused by the user’s choice of less-personalised ads. Conveniently for the annoyed user, the banner includes a button allowing the user to manage the “ad experience” and switch back to the previous behavioural advertising .
4. All or nothing: If you don’t want to see personalised ads, you can’t place any ads yourself
Another one of Meta’s ways of making the new option less attractive has gone largely unnoticed: once you choose less-personalised ads, you’re no longer able to run ads or boost your posts on Instagram or Facebook. Neither can you participate in partnership ads. This may not sound like a problem for the average user but on social media platforms the line between users and advertisers is blurred. One example are influencers who are paid to promote products through the social media content they post. Often such postings are boosted with partnership ads, where a company pays Meta for attributing more impressions to the posting. You might not be too worried about the protection of influencers’ privacy choices either, but shouldn’t they be able to opt for less-personalised ads and still be allowed to promote their content and participate in partnership ads? Whether you are sympathetic with influencers or not, Meta’s “all or nothing” approach raises questions regarding the granularity required for consent requests under the GDPR. The granularity principle obliges Meta to collect separate consent for each separate processing operation. And also, under Article 5(2) DMA it could be argued that Meta should provide two separate consent requests: one for advertisers using the Meta Ads CPS to place ads, and one for users of the social network CPS that view ads, even if the advertiser and user are one and the same person.
By prohibiting users who switch to less-personalised ads from acting as advertisers themselves, Meta found another way of making the new option less attractive.
Will Meta pass the DMA compliance check?
Meta’s less-personalised ads option relates to the heart of the Commission’s DMA non-compliance proceedings. Whether Meta will pass the compliance check fundamentally depends on how the Commission reacts to the tactics presented in this blog post. The European Data Protection Board’s reaction to the new model was surprisingly positive. In a LinkedIn Post it stated, “we welcome the fact that an important platform announces that it will offer a new choice for free with less detailed profiling for advertising.” But the EDPB doesn’t let Meta off the hook and announces, that “the solution still needs to be assessed”. And even if the guidelines that the EDPB is developing on “pay or consent” models, can be relevant considerations for the DMA analysis, the DMA requirements still stand on their own. The pursuit of fair and contestable markets can lead to much stronger changes in business models than what general data protection law might require.
While this should be worrying to Meta, it is good news for smaller players who rely on “pay or consent” models. If the Commission finds Meta’s compliance approach to be incompatible with the DMA, such evaluation only applies to gatekeepers. For smaller publishers, it can still be okay to ask for a proverbial “cup of coffee” from users that say no to data-collection.
This SCiDA Blog, however, will continue to be available for free and without behavioural ads, but it would be great if you advertise for us and recommend the SCiDA blog to your friends! This contribution was written by Sebastian Steinert, Maître en Droit, LL.M., who is a doctoral researcher focusing on the Digital Markets Act. His thesis is being supervised by Prof. Dr. Rupprecht Podszun.
