"Norway Took On Meta’s Surveillance Ads and Won", 3 August 2023

...For years, European courts have argued that Meta cannot use [personal or behavioral] data for advertising unless the company asks for users’ explicit—yes or no—consent. But in July, Norway [the country's privacy watchdog, Datatilsynet] went a step further, branding the way Meta carries out behavioral advertising as illegal. The watchdog threatened to ban Meta’s behavioral ads in Norway and pledged to fine the tech giant $100,000 per day unless the company changed its ways. The ban was due to take effect on August 4; three days before that, on August 1, Meta quietly published an update to a January blog post announcing its intention to comply.

“Today, we are announcing our intention to change the legal basis that we use to process certain data for behavioral advertising for people in the EU, EEA and Switzerland from ‘Legitimate Interests’ to ‘Consent,’” the blog post read, without saying specifically when the change will take place or mentioning Norway. Meta declined WIRED’s request to comment further.

Norway is chalking this up as a victory. “While Meta states that this is a voluntary change on their end, that appears very unconvincing,” says Judin. “Asking users for consent could negatively affect the company’s earnings, and historically speaking, Meta has not been willing to sacrifice profits for privacy unless forced.”..

...The fact that Meta is indicating it will now ask for European users' consent is not significant in itself, says Max Schrems [who runs the Vienna-based privacy campaign group NOYB]. “We knew this is the law since the GDPR came into force,” he says. “It’s more significant that Meta has simply ignored the law for the last five years.”...