The European Data Protection Board (EDPB) yesterday said it had adopted three binding decisions addressing legal issues arising from draft decisions of Ireland’s Data Protection Commission (DPC) regarding Meta platforms Facebook, Instagram and WhatsApp.

The decisions settle the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising, in the cases of Facebook and Instagram, and for service improvement, in the case of WhatsApp.

EDPB decisions are binding on the DPC, which is now required to issue its final decision within a month. This final decision could be further appealed in the Irish and European courts.

The EDPB said the decisions will not be published until the DPC acts, but The Wall Street Journal reports that they find Meta’s reliance on a clause in its terms of service to be incompatible with the GDPR.

Austrian privacy campaigner Max Schrems, honorary chairman of privacy group noyb which filed the original complaint with the DPC, said: “Instead of having a yes/no option for personalised ads, [Meta] just moved the consent clause in the terms and conditions.

“This is not just unfair but clearly illegal. We are not aware of any other company that has tried to ignore the GDPR in such an arrogant way.”

He added: “This is a huge blow to Meta’s profits in the EU. People now need to be asked if they want their data to be used for ads or not. They must have a ‘yes or no’ answer and can change their mind at any time. The decision also ensures a level playing field with other advertisers that also need to get opt-in consent.”

Helena Brown, a Scottish lawyer who heads the data and privacy team at Addleshaw Goddard, said: “This decision is not surprising and follows hot on the heels of the landmark €265 million fine the Irish regulator issued against Meta last week.

“Continued privacy enforcement from EU regulators seeks to change the way big tech does business in the EU, but it won’t happen overnight; resource constrains and continued reliance on the comparatively small Irish regulator to bring enforcement means change at a slower pace.

“Recent reforms essentially put a match to common forms of online advertising, whereby ads were targeted at individuals based on a detailed analysis of their behaviour across various platforms.”